@nomad-e/bluma-cli 0.1.58 → 0.1.60

package/dist/config/skills/pdf/scripts/merge_pdfs.py

@@ -3,7 +3,7 @@ Merge multiple PDF files into a single output PDF.
 
 Usage:
     python merge_pdfs.py --output merged.pdf file1.pdf file2.pdf file3.pdf
-    python merge_pdfs.py --output ./artifacts/combined.pdf *.pdf
+    python merge_pdfs.py --output ./.bluma/artifacts/combined.pdf *.pdf
 """
 import argparse
 import sys

package/dist/config/skills/skill-creator/SKILL.md

@@ -193,7 +193,7 @@ Example script header:
 {description of what this script does}
 
 Usage:
-    python {script_name}.py --input data.csv --output ./artifacts/result.pdf
+    python {script_name}.py --input data.csv --output ./.bluma/artifacts/result.pdf
 """
 import argparse
 ```

package/dist/main.js

@@ -113,6 +113,20 @@ function isPathInsideWorkspace(targetPath, policy = getSandboxPolicy()) {
   const relative = path6.relative(policy.workspaceRoot, resolved);
   return relative === "" || !relative.startsWith("..") && !path6.isAbsolute(relative);
 }
+function redirectTopLevelArtifactsPath(resolvedAbsolute, workspaceRoot) {
+  const wr = path6.resolve(workspaceRoot);
+  const abs = path6.resolve(resolvedAbsolute);
+  const rel = path6.relative(wr, abs);
+  if (rel.startsWith("..") || path6.isAbsolute(rel)) {
+    return abs;
+  }
+  const segments = rel.split(path6.sep).filter((s) => s.length > 0);
+  if (segments.length === 0 || segments[0] !== "artifacts") {
+    return abs;
+  }
+  const tail = segments.slice(1);
+  return tail.length > 0 ? path6.join(wr, ".bluma", "artifacts", ...tail) : path6.join(wr, ".bluma", "artifacts");
+}
 function resolveWorkspacePath(inputPath, policy = getSandboxPolicy()) {
   const candidate = path6.isAbsolute(inputPath) ? path6.resolve(inputPath) : path6.resolve(policy.workspaceRoot, inputPath);
   if (policy.isSandbox && !isPathInsideWorkspace(candidate, policy)) {
@@ -120,7 +134,7 @@ function resolveWorkspacePath(inputPath, policy = getSandboxPolicy()) {
       `Path "${inputPath}" escapes the sandbox workspace root ${policy.workspaceRoot}`
     );
   }
-  return candidate;
+  return redirectTopLevelArtifactsPath(candidate, policy.workspaceRoot);
 }
 function resolveCommandCwd(cwd, policy = getSandboxPolicy()) {
   const base = cwd ? path6.resolve(cwd) : policy.workspaceRoot;
@@ -207,6 +221,9 @@ __export(async_command_exports, {
 import os6 from "os";
 import { spawn as spawn2 } from "child_process";
 import { v4 as uuidv42 } from "uuid";
+function normalizeCommandId(raw) {
+  return String(raw ?? "").trim().replace(/^[#:\s]+/, "");
+}
 function cleanupOldCommands() {
   if (runningCommands.size <= MAX_STORED_COMMANDS) return;
   const commands = Array.from(runningCommands.entries()).filter(([_, cmd]) => cmd.status !== "running").sort((a, b) => (a[1].endTime || 0) - (b[1].endTime || 0));
@@ -356,13 +373,14 @@ async function commandStatus(args) {
         error: "command_id is required"
       };
     }
-    const entry = runningCommands.get(command_id);
+    const normalizedCommandId = normalizeCommandId(command_id);
+    const entry = runningCommands.get(normalizedCommandId);
     if (!entry) {
       return {
         success: false,
-        command_id,
+        command_id: normalizedCommandId,
         status: "not_found",
-        error: `Command with id "${command_id}" not found. It may have expired or never existed.`
+        error: `Command with id "${normalizedCommandId}" not found. It may have expired or never existed.`
       };
     }
     const maxWait = Math.min(wait_seconds, 15);
@@ -394,7 +412,7 @@ async function commandStatus(args) {
     const duration = entry.endTime ? (entry.endTime - entry.startTime) / 1e3 : (Date.now() - entry.startTime) / 1e3;
     return {
       success: true,
-      command_id,
+      command_id: normalizedCommandId,
       status: entry.status,
       stdout: stdout || void 0,
       stderr: stderr || void 0,
@@ -420,11 +438,12 @@ async function sendCommandInput(args) {
         error: "command_id and input are required"
       };
     }
-    const entry = runningCommands.get(command_id);
+    const normalizedCommandId = normalizeCommandId(command_id);
+    const entry = runningCommands.get(normalizedCommandId);
     if (!entry) {
       return {
         success: false,
-        error: `Command with id "${command_id}" not found`
+        error: `Command with id "${normalizedCommandId}" not found`
       };
     }
     if (entry.status !== "running" || !entry.process) {
@@ -436,7 +455,7 @@ async function sendCommandInput(args) {
     entry.process.stdin?.write(input);
     return {
       success: true,
-      message: `Sent ${input.length} characters to command ${command_id}`
+      message: `Sent ${input.length} characters to command ${normalizedCommandId}`
     };
   } catch (error) {
     return {
@@ -448,11 +467,12 @@ async function sendCommandInput(args) {
 async function killCommand(args) {
   try {
     const { command_id } = args;
-    const entry = runningCommands.get(command_id);
+    const normalizedCommandId = normalizeCommandId(command_id);
+    const entry = runningCommands.get(normalizedCommandId);
     if (!entry) {
       return {
         success: false,
-        error: `Command with id "${command_id}" not found`
+        error: `Command with id "${normalizedCommandId}" not found`
       };
     }
     if (entry.status !== "running" || !entry.process) {
@@ -466,7 +486,7 @@ async function killCommand(args) {
     entry.endTime = Date.now();
     return {
       success: true,
-      message: `Command ${command_id} killed`
+      message: `Command ${normalizedCommandId} killed`
     };
   } catch (error) {
     return {
@@ -3913,7 +3933,7 @@ var renderCommandStatus = ({ args }) => {
   const parsed = parseArgs(args);
   const id = parsed.command_id || "[no id]";
   return /* @__PURE__ */ jsx7(Box7, { children: /* @__PURE__ */ jsxs7(Text7, { color: BLUMA_TERMINAL.muted, children: [
-    "#",
+    "id ",
     id
   ] }) });
 };
@@ -8519,10 +8539,16 @@ var AdvancedFeedbackSystem = class {
         score: penalty,
         message: "You are attempting a direct message without a tool_call. All replies must contain tool_call.",
         correction: `
-         ## PROTOCOL VIOLATION \u2014 SERIOUS
-            You are sending a direct response without tool_call, which is strictly prohibited.
-            PENALTY APPLIED: ${penalty.toFixed(1)} points deducted.
-            You MUST always use tool_call without exception.
+## PROTOCOL VIOLATION \u2014 STOP WRITING PLAIN ASSISTANT TEXT
+
+You streamed or returned **user-visible markdown as assistant content** instead of using the **\`message\` tool**. That is prohibited and **does not end the turn** \u2014 the runtime will loop until timeout.
+
+Do this **immediately** in your next step (single tool call, no prose outside tools):
+
+- Call **\`message\`** with **\`message_type\`: \`"result"\`**, put the user-facing summary in **\`content\`**, and put deliverable paths in **\`attachments\`** (absolute paths).
+
+Do **not** repeat the same summary as plain assistant text again.
+PENALTY APPLIED: ${penalty.toFixed(1)} points deducted.
           `.trim()
       };
     }
@@ -9945,6 +9971,7 @@ The \\\`message\\\` tool has TWO types \u2014 use them CORRECTLY:
 - **Use when**: Task is complete, artifacts ready for delivery
 - **Use ONCE per turn** \u2014 only at the very end
 - **Ends the turn** \u2014 agent waits for next input
+- **CRITICAL:** Plain assistant markdown (streaming or not) **does not** end the worker or close the HTTP job \u2014 only a \\\`message\\\` tool call with \\\`message_type: "result"\\\` does. If you only write text in chat, the process loops until **timeout** (e.g. 300s).
 
 #### \u274C WRONG: Using "info" to ask questions
 \\\`\\\`\\\`typescript
@@ -10063,9 +10090,18 @@ You (Bluma):
 
 - **Sandbox is safe** - You can't break the host system
 - **But workspace matters** - Don't pollute /workspace with junk files
+- **Deliverables path** - Never use a top-level \`./artifacts/\` folder in the job root; use \`./.bluma/artifacts/\` (or the \`artifacts_dir\` from \`task_boundary\`). Shell redirects must use that path \u2014 \`file_write\` remaps \`artifacts/...\` to \`.bluma/artifacts/...\` automatically.
 - **Clean up after yourself** - Remove temporary files when done
 - **Respect session boundaries** - Stay in your session workspace
 
+### Job wall-clock timeout (orchestrator) \u2014 read this
+
+The coordinator sets a **single deadline** for the whole stream (e.g. \`timeout_seconds: 60\`). The timer **starts at job start** and counts **everything**: first LLM call (often **30\u201360s+** of \u201CThinking\u201D), tools, follow-up LLM calls, and your final \`message\`+\`result\`.
+
+- **60 seconds is usually too short** for \`generate_document\` / PDF / multi-step work \u2014 the job can die **after** \`file_write\` succeeds but **before** \`shell_command\` or \`message(result)\`, with \`Job excedeu 60.0s\` / exit \`-9\`. That is **not** proof the sandbox is broken; it means the **budget was too tight**.
+- Prefer asking coordinators (or docs) to use **\u2265180s** for document generation, **\u2265300s** for heavy tasks.
+- When a job times out, **do not** claim \u201Csandbox unavailable\u201D unless you have real infra evidence (connection errors, 5xx). Timeout = **deadline exceeded**, often fixable by **raising \`timeout_seconds\`** on the caller side.
+
 ### You Represent the Platform
 
 - **Severino trusts you** - Don't let him down
@@ -10288,6 +10324,10 @@ Auto-generated map (may be stale after pull/install). Confirm with tools before
 <<<BLUMA_WORKSPACE_SNAPSHOT_BODY>>>
 </workspace_snapshot>
 
+<deliverables>
+**Local and sandbox:** generated artifacts (reports, PDFs, exports, plans you attach) must live under \`<workdir>/.bluma/\` \u2014 use \`.bluma/artifacts/\` (or the \`artifacts_dir\` path returned by \`task_boundary\` after starting a task). Do **not** create a top-level \`./artifacts/\` folder in the project root. \`file_write\` / \`edit_tool\` / \`read_file_lines\` automatically remap \`artifacts/...\` \u2192 \`.bluma/artifacts/...\`. For \`shell_command\` redirects (\`>\` / \`>>\`), target \`.bluma/artifacts/...\` explicitly.
+</deliverables>
+
 <coding_memory>
 Persistent store (~/.bluma/coding_memory.json). Do not invent entries: \`list\` / \`search\` if unsure. \`<coding_memory_snapshot>\` is bootstrap only \u2014 after add/update/remove, list or search again. Operations: add | list | search | update (id) | remove (id), one mutating call at a time.
 </coding_memory>
@@ -10313,7 +10353,7 @@ Output is truncated (~30KB / ~200 lines); use head/tail or write to a file. Use
 The user **only** sees chat content you send through the \`message\` tool (\`content\` as Markdown). Bare assistant text is **not** a substitute \u2014 **you should use \`message\` liberally**.
 
 **Types**
-- \`message_type: "result"\` \u2014 **ends the turn**: final answer, deliverable, or a **question** that needs a user reply; then the agent waits for the user.
+- \`message_type: "result"\` \u2014 **ends the turn**: final answer, deliverable, or a **question** that needs a user reply; then the agent waits for the user. **Sandbox/worker:** only this stops the job; writing markdown as normal assistant output does **not** finish the task and can cause a **timeout loop**.
 - \`message_type: "info"\` \u2014 **non-terminal**: shown in chat, does **not** end the turn. **Expected behavior:** call \`info\` **multiple times** in a single turn whenever there is something worth saying (even briefly). Under-using \`info\` is a **mistake** in this product.
 
 **\u26A0\uFE0F CRITICAL: "info" is for INFORMATION ONLY \u2014 NEVER for asking questions**
@@ -11449,6 +11489,8 @@ var BluMaAgent = class {
   factorRouterTurnClosed = false;
   /** Passos seguidos sem tool_calls nem texto visível (só raciocínio) — evita loop lento no mesmo turno. */
   emptyAssistantReplySteps = 0;
+  /** Passos seguidos com texto do assistente sem tool_calls (violação de protocolo) — evita loop até timeout do job. */
+  directTextProtocolSteps = 0;
   constructor(sessionId, eventBus, llm, mcpClient, feedbackSystem) {
     this.sessionId = sessionId;
     this.eventBus = eventBus;
@@ -11592,6 +11634,7 @@ var BluMaAgent = class {
     const userContent = buildUserMessageContent(inputText, process.cwd());
     this.history.push({ role: "user", content: userContent });
     this.emptyAssistantReplySteps = 0;
+    this.directTextProtocolSteps = 0;
     this.eventBus.emit(
       "backend_message",
       buildTurnStartBackendMessage({
@@ -12149,6 +12192,7 @@ ${editData.error.display}`;
     this.history.push(normalizedMessage);
     if (normalizedMessage.tool_calls && normalizedMessage.tool_calls.length > 0) {
       this.emptyAssistantReplySteps = 0;
+      this.directTextProtocolSteps = 0;
       const validToolCalls = normalizedMessage.tool_calls.filter(
         (call) => ToolCallNormalizer.isValidToolCall(call)
       );
@@ -12188,9 +12232,20 @@ ${editData.error.display}`;
       }
     } else if (trimmedText) {
       this.emptyAssistantReplySteps = 0;
+      this.directTextProtocolSteps += 1;
+      const MAX_DIRECT_TEXT_PROTOCOL = 3;
       if (!hasEmittedStart) {
         this.eventBus.emit("backend_message", { type: "assistant_message", content: accumulatedContent });
       }
+      if (this.directTextProtocolSteps >= MAX_DIRECT_TEXT_PROTOCOL) {
+        this.eventBus.emit("backend_message", {
+          type: "error",
+          message: 'Agent kept answering with plain assistant text instead of the `message` tool with message_type "result". Turn forcibly closed to avoid job timeout; fix prompts or model routing.'
+        });
+        await this.notifyFactorTurnEndIfNeeded("protocol_direct_text_exhausted");
+        this.emitTurnCompleted();
+        return;
+      }
       const feedback = this.feedbackSystem.generateFeedback({
         event: "protocol_violation_direct_text",
         details: { violationContent: accumulatedContent }
@@ -12226,6 +12281,7 @@ ${editData.error.display}`;
     this.history.push(message2);
     if (message2.tool_calls && message2.tool_calls.length > 0) {
       this.emptyAssistantReplySteps = 0;
+      this.directTextProtocolSteps = 0;
       const validToolCalls = message2.tool_calls.filter(
         (call) => ToolCallNormalizer.isValidToolCall(call)
       );
@@ -12265,7 +12321,18 @@ ${editData.error.display}`;
       }
     } else if (typeof message2.content === "string" && message2.content.trim()) {
       this.emptyAssistantReplySteps = 0;
+      this.directTextProtocolSteps += 1;
+      const MAX_DIRECT_TEXT_PROTOCOL = 3;
       this.eventBus.emit("backend_message", { type: "assistant_message", content: message2.content });
+      if (this.directTextProtocolSteps >= MAX_DIRECT_TEXT_PROTOCOL) {
+        this.eventBus.emit("backend_message", {
+          type: "error",
+          message: 'Agent kept answering with plain assistant text instead of the `message` tool with message_type "result". Turn forcibly closed to avoid job timeout.'
+        });
+        await this.notifyFactorTurnEndIfNeeded("protocol_direct_text_exhausted");
+        this.emitTurnCompleted();
+        return;
+      }
       const feedback = this.feedbackSystem.generateFeedback({
         event: "protocol_violation_direct_text",
         details: { violationContent: message2.content }
@@ -14182,6 +14249,40 @@ var ToolResultDisplayComponent = ({
     }
     return /* @__PURE__ */ jsx12(ResultGutter, { children: /* @__PURE__ */ jsx12(MarkdownRenderer, { markdown: String(body) }) });
   }
+  if (toolName.includes("ask_user_question")) {
+    const success = parsed?.success === true;
+    const selectedLabel = typeof parsed?.selected_label === "string" ? parsed.selected_label : "";
+    const selectedIndex = typeof parsed?.selected_index === "number" ? parsed.selected_index : null;
+    const questionIndex = typeof parsed?.question_index === "number" ? parsed.question_index : 0;
+    const qs = Array.isArray(args?.questions) ? args.questions : [];
+    const q = qs[questionIndex];
+    const questionText = typeof q?.question === "string" ? q.question : "";
+    if (success && selectedLabel) {
+      return /* @__PURE__ */ jsx12(ResultGutter, { children: /* @__PURE__ */ jsxs12(Box12, { flexDirection: "column", children: [
+        /* @__PURE__ */ jsxs12(Text12, { dimColor: true, children: [
+          /* @__PURE__ */ jsx12(Text12, { bold: true, children: "Response" }),
+          " \xB7 ",
+          selectedLabel
+        ] }),
+        questionText ? /* @__PURE__ */ jsxs12(Text12, { dimColor: true, wrap: "wrap", children: [
+          truncate3(questionText, 140),
+          selectedIndex !== null ? ` \xB7 option ${selectedIndex + 1}` : ""
+        ] }) : null
+      ] }) });
+    }
+    if (parsed?.cancelled === true) {
+      return /* @__PURE__ */ jsx12(ResultGutter, { children: /* @__PURE__ */ jsxs12(Text12, { dimColor: true, children: [
+        /* @__PURE__ */ jsx12(Text12, { bold: true, children: "Response" }),
+        " \xB7 cancelled by user"
+      ] }) });
+    }
+    const err = typeof parsed?.error === "string" ? parsed.error : "";
+    return /* @__PURE__ */ jsx12(ResultGutter, { children: /* @__PURE__ */ jsxs12(Text12, { color: err ? BLUMA_TERMINAL.err : void 0, dimColor: !err, wrap: "wrap", children: [
+      /* @__PURE__ */ jsx12(Text12, { bold: true, children: "Response" }),
+      " \xB7 ",
+      err || "No answer returned"
+    ] }) });
+  }
   if (toolName.includes("file_write") && parsed) {
     return /* @__PURE__ */ jsx12(ResultGutter, { children: /* @__PURE__ */ jsxs12(Text12, { dimColor: true, children: [
       parsed.created ? "Created " : "Wrote to ",
@@ -15990,6 +16091,9 @@ Run: npm i -g ${BLUMA_PACKAGE_NAME} to update.`;
   }
 }
 
+// src/app/ui/App.tsx
+init_sandbox_policy();
+
 // src/app/ui/components/UpdateNotice.tsx
 import { Box as Box17, Text as Text16 } from "ink";
 import { jsx as jsx18, jsxs as jsxs16 } from "react/jsx-runtime";
@@ -16640,7 +16744,7 @@ var AppComponent = ({ eventBus, sessionId, cliVersion }) => {
   const [liveToolArgs, setLiveToolArgs] = useState11(void 0);
   const [isReasoning, setIsReasoning] = useState11(false);
   const alwaysAcceptList = useRef6([]);
-  const workdir = process.cwd();
+  const workdir = getSandboxPolicy().workspaceRoot;
   const turnStartedAtRef = useRef6(null);
   const [processingStartMs, setProcessingStartMs] = useState11(null);
   const markTurnStarted = useCallback4(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nomad-e/bluma-cli",
-	"version": "0.1.58",
+	"version": "0.1.60",
 	"description": "BluMa independent agent for automation and advanced software engineering.",
 	"author": "Alex Fonseca",
 	"license": "Apache-2.0",