algo-cli-runtime 0.20.0__tar.gz → 0.20.3__tar.gz

{algo_cli_runtime-0.20.0 → algo_cli_runtime-0.20.3}/CHANGELOG.md

@@ -4,6 +4,187 @@ All notable changes to Algo CLI are documented here. The format follows [Keep a
 
 ## [Unreleased]
 
+### 0.20.3 Core CLI Candidate
+
+- Prepare the Continuum-only runtime, bounded Jev coordinator and interrupted
+  stream/cancellation reliability repairs for exact-source qualification.
+- Require deterministic evidence for exact calculations; preserve decision
+  uncertainty, shell approvals and independent workspace verification. Add
+  machine-keyed graph/probability and confident-wrong-answer regressions.
+- Align protected draft capture with the fresh 0.20.3 candidate; do not reuse
+  the immutable 0.20.2 tag or its draft evidence.
+- Include Go 1.26.9 and qualified website dependency repairs. Keep signed native
+  features disabled and the public catalog free of owner data.
+- Publication remains conditional on local and hosted core-release gates;
+  see `docs/henry-release-0.20.3.md` for scope and excluded native features.
+
+## [0.20.2] - 2026-09-25
+
+A patch release. It closes a secret-redaction gap in captured session command
+output, refreshes the managed-browser security pin, and carries the
+runtime-reliability and terminal-theme work merged since 0.20.1.
+
+### Security
+
+- Strip terminal control sequences from captured `session_command` output
+  before redaction. With `FORCE_COLOR` set, a color code directly before
+  `access_token=` defeated the secret pattern's word boundary, and a `/google`
+  error reached the model with the token unredacted; 0.20.1 is affected. The
+  secret and Bearer patterns no longer depend on a leading word boundary.
+
+### Fixed
+
+- `jev_kernel_status` had no reachable grant in any mode; it is now a local
+  runtime read in the baseline set. `jev_question_contract` stays
+  approval-gated.
+- `jev_question_contract` in its default `lint` mode resolved to the provider
+  target and was denied as a setup gap that no approval could resolve. Local
+  lint now resolves to a runtime target with baseline access; `review`, `run`
+  and `followup` keep provider scope, data-egress capability and session
+  approval.
+- `/agent team` options are parsed with quote awareness: `--roles="planner, critic"`
+  is accepted, and `--roles` inside quoted task text stays part of the task
+  instead of selecting specialists or being removed.
+- A team specialist that was already inside its locked status write when the run
+  was cancelled can no longer move its thread back to `running` or finish it as
+  another status: the thread store refuses in-progress writes over a terminal
+  status, and a cancelled thread can only be finished as cancelled.
+- Missing-grant denials name the action, target and missing scope, say whether
+  the denial is policy or a setup gap, and give the recovery step.
+- An identical denied call is not retried within the turn and gets no second
+  approval prompt; three identical blocks stop the run.
+- `action_search` indexes slash-command capabilities such as
+  `/google gmail-list`, maps email, mail and inbox to Gmail, and reports
+  "no match" instead of "unavailable". `available_actions(topic)` matches the
+  same way.
+- Harness stats and the index-quality recommendation explain why the last
+  embedding pass did not run.
+- Rich cannot resolve compound styles such as `bold primary`, so about thirty
+  surfaces (logo, banner, error label, thinking text, headings) rendered
+  unstyled and several footer chips failed contrast. Every style is now a
+  named token with contrast floors, and `/reload` no longer leaves the footer
+  on the previous theme.
+
+### Changed
+
+- One color profile (truecolor, 256, 16 or mono) is detected once from
+  `COLORTERM`, `TERM`, `NO_COLOR`, `FORCE_COLOR` and the Windows console and
+  applied to output, prompt and footer together. 16-color terminals keep
+  success, warning, error and info distinct; `NO_COLOR` and `TERM=dumb` use
+  bold, dim and reverse only; `FORCE_COLOR` raises the detected depth.
+- Assistant Markdown and code blocks follow the active theme instead of Rich's
+  defaults. All seven themes, including `redeye`, are documented.
+- Jev tool text states that Jev returns advisory judgments only and names the
+  routes that can browse, read mail or act.
+- Refresh the Boron managed-browser pin to Chrome `154.0.8037.57` with its
+  package checksum, release timestamp, regenerated dpkg lock and coupled
+  fixtures, keeping the 72-hour security-update limit.
+- The predecessor upgrade smoke baseline moves to public `0.20.1`.
+
+### Release Limits
+
+- M8 retains five blocked external-browser metrics and M9 retains thirteen
+  blocked requirements. No external-browser or model-quality qualification is
+  claimed from local deterministic evidence.
+
+## [0.20.1] - 2026-09-23
+
+A patch release from a whole-codebase bug hunt. Candidate issues were
+confirmed by reading or running the code, independently challenged, and fixed
+with a regression test each.
+
+### Fixed
+
+- Tool-call and tool-result lines no longer parse tool arguments or output as
+  Rich markup. Text such as `ls [/tmp]` used to crash the turn and leave an
+  unanswered tool call in history, and code previews silently dropped
+  bracketed text (`d[key]` showed as `d`). Recalled-context and info lines
+  get the same treatment.
+- Tool failures reported as `Error reading/writing/listing ...` are now
+  classified as failures instead of "worked".
+- `search_files` keeps ripgrep matches when ripgrep also reports errors (for
+  example one unreadable folder) and marks the result as partial. Long
+  stderr no longer stops the search early. The Python fallback now honors
+  path globs such as `**/*.py`, `dir/*.py` and `!*.md`, case-insensitively on
+  Windows.
+- `run_shell` keeps leading whitespace on the first output line, so formats
+  such as `git status --short` stay intact.
+- A schemeless `OLLAMA_HOST` (for example `127.0.0.1:11434`) no longer fails
+  the readiness check and blocks every prompt, and the supplemental gateway
+  receives a normalized host.
+- Agent-block models are routed to Ollama Cloud or local Ollama by the block's
+  own model instead of the active model.
+- `--oneshot --json` always ends with a `done` event, reporting `partial` when
+  saving the configuration fails.
+- `/agent` fixes: a model error marks the block as failed; tasks that begin
+  with `show`, `switch`, `resume` or `fork` are only treated as thread
+  commands when followed by a thread reference; apostrophes and quotes in the
+  task no longer drop `--pipeline` or `--roles`; Ctrl+C on a team run stops
+  waiting for running specialists.
+- Saving a memory never overwrites a `memory.json` that exists but cannot be
+  read safely; an empty file still counts as no memories. One invalid legacy
+  fact no longer breaks `/remember` or turns off recall, and the load error
+  clears after a successful repair.
+- Lessons written as paragraphs (the template format) are indexed, not only
+  `## ` sections.
+- Automatic memory capture rejects complaints and reported speech such as
+  "You always forget to run the tests".
+- When the context summarizer fails, the lossy fallback summary is reported
+  instead of being used silently.
+- Code-RAG re-embeds chunks after an embedding-width or embedder change
+  instead of failing on every turn, keeps older indexes usable after upgrade,
+  and drops deleted files from the repository map.
+- A source file with a future modification time no longer forces a full
+  harness re-index on every load.
+- Ctrl+C during a streamed answer keeps the partial answer in the
+  conversation and says so.
+- `/agent resume` and `/agent fork` no longer treat English words made of hex
+  letters (`add`, `beef`, `decade`) as thread references; a reference followed
+  by a task must contain a digit or match a full thread id.
+- A schemeless `OLLAMA_HOST` now also works for embedding identity and the
+  gateway upstream, so code, lesson and memory retrieval stay semantic.
+- File contents that happen to begin like a tool error are no longer recorded
+  as failed tool calls, in the chat loop, `/agent`, one-shot and program runs.
+- Partial search results are recorded as not fully successful.
+- Malformed search globs such as `*[^]` no longer crash the Python fallback.
+- `/agent team` cancellation stops `write_file` before it writes and
+  terminates a running `run_shell` command.
+- Ctrl+C during a parallel tool batch returns within a bounded wait and keeps
+  every tool call paired with a result.
+- `/diff`, `/changes`, agent-block panels, `/help`, the memory table and the
+  runtime overview show bracketed text literally instead of treating it as
+  Rich markup.
+- Existing lesson indexes are rebuilt with the new chunker, and lesson text
+  containing comment markers is kept intact.
+- Memory capture: `needed`/`embedded` standing rules are accepted, and
+  first-person complaints (`I always forget ...`) are rejected.
+- Files created after the last code-RAG scan are found on the next scan.
+- The settled thinking panel shows both the opening and the ending of long
+  reasoning, and the live panel keeps indentation.
+
+### Changed
+
+- Ctrl+C at the prompt clears a half-typed line; on an empty line it asks for
+  a second Ctrl+C (or Ctrl+D) before exiting.
+- The footer reflects `/safe`, `/auto`, `/theme` and `/cd` changes
+  immediately.
+- The model-wait spinner shows the elapsed time, and switches to "loading" for
+  slow local model loads.
+- The live thinking panel follows the newest reasoning instead of freezing
+  after the first 1,200 characters.
+- Errors show their class and, for connection, timeout and missing-model
+  failures, a short hint about what to check.
+
+### Security
+
+- The public-release scan also rejects local keychain item names used for
+  companion credentials, in source and in built artifacts.
+
+### Release Limits
+
+- Native signing, M8 external-browser metrics and other blocked hardening
+  work remain blocked and are not claimed.
+
 ## [0.20.0] - 2026-09-20
 
 ### Added

{algo_cli_runtime-0.20.0 → algo_cli_runtime-0.20.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: algo-cli-runtime
-Version: 0.20.0
+Version: 0.20.3
 Summary: Agent runtime for tools, durable context, and verified work
 Project-URL: Homepage, https://algo-cli.com
 Project-URL: Documentation, https://algo-cli.com/docs
@@ -149,7 +149,7 @@ echo "what changed in main.py?" | algo-cli --oneshot --json
 algo-cli --oneshot --json --approval-mode auto --cwd /path/to/project "fix the failing test"
 ```
 
-Signed-in local Ollama can run `:cloud` models without `OLLAMA_API_KEY`. `OLLAMA_API_KEY` is only required for the direct Cloud API route (`--cloud` / `/cloud on` when an API key is present) and web tools. Embedding indexes currently use local Ollama models only; a configured cloud embedding backend falls back to local until Ollama Cloud exposes embedding models.
+Signed-in local Ollama can run `:cloud` models without `OLLAMA_API_KEY`. `OLLAMA_API_KEY` is only required for the direct Cloud API route (`--cloud` / `/cloud on` when an API key is present) and web tools. Native Continuum owns memory without a CLI embedding pipeline. Local reference lookup is lexical; no automatic embedding model is loaded.
 
 `--oneshot --json` emits one JSON object per line to stdout (NDJSON), suitable for subprocess consumption. `--approval-mode never` (default) denies approval-required tools and emits a `tool_denied` event; pass `--approval-mode auto` to grant them. Skill crystallization is disabled in one-shot mode. Event types: `session_start`, `thinking`, `content`, `tool_call`, `tool_result`, `tool_denied`, `error`, `done`. The bridge can rely on `session_start` first and `done` last as framing.
 
@@ -181,13 +181,11 @@ xAI's public API uses `XAI_API_KEY`; API calls can consume paid usage, so setup
 
 Every normal chat request sends the active conversation and the assembled Algo CLI system context to the selected inference provider. That context includes `SOUL.md`, `IDENTITY.md`, `USER.md`, saved memories, and relevant retrieved lessons when available. With a cloud model, this content may leave the machine. Automatic memory capture is off by default. `/memory-auto on` records explicit consent for the current capture policy and enables bounded capture after successful turns. `/memory-auto off` stops future automatic captures and clears that consent (it does not delete existing memories).
 
-The installed harness corpus contains only public Algo CLI docs, skills, and runtime metadata. Other local agent stores, working-directory code retrieval, index-compute-lab, and skill run-history capture are off by default because retrieved or summarized content can become part of a model request.
+The installed reference corpus contains public Algo CLI docs, skills and runtime metadata. Continuum owns memory; Echo Veil, Lab-index, vector Code RAG and embedding routes are retired. External local references remain opt-in because retrieved content can become part of a model request.
 
 - `/harness external on` opts in to supported Codex, Claude, OpenClaw, Mercury, and shared agent stores.
-- `/icl on` opts in to `~/index-compute-lab`; override its root with `ALGO_CLI_INDEX_COMPUTE_LAB_ROOT`.
-- `/code-rag on` opts in to indexing source files beneath the active cwd and adding relevant snippets to model requests. `/code-rag off` disables retrieval and purges persisted code indexes.
 - `/skills on` opts in to bounded run-summary capture under `~/.algo_cli/private/run_history.jsonl` and automatic skill-candidate crystallization by a genuinely local, non-embedding Ollama model. There is no cloud fallback.
-- `/harness external off` and `/icl off` rebuild the generated index without those records.
+- `/harness external off` rebuilds the generated reference index without external records.
 
 Common credential forms are redacted and connector/MCP JSON is metadata-only, but redaction is not a substitute for reviewing the sources you enable. See [Privacy and local context](docs/privacy-and-context.md).
 
@@ -214,11 +212,8 @@ Common credential forms are redacted and connector/MCP JSON is metadata-only, bu
 | `/thinking effort [MODEL] LEVEL` | Set Codex reasoning effort (`low`, `medium`, `high`, `xhigh`, or GPT-5.6 `max`) |
 | `/agent team ...` | Algo's multi-agent counterpart to Codex Ultra; fan out specialists, then integrate and verify |
 | `/memory-auto [on\|off\|status]` | Inspect or toggle bounded, privacy-gated automatic memory capture after successful turns |
-| `/code-rag [on\|off\|status]` | Opt in or out of cwd source indexing and prompt retrieval; `off` purges persisted indexes |
 | `/skills [on\|off\|status\|crystallize]` | Opt in to local run-history capture and review local-only skill candidates |
 | `/remember FACT` | Save a long-term memory |
-| `/intuition [on|off|status|add|list|forget|reindex]` | Manage embedded recall blocks |
-| `/icl [on\|off\|status\|ask\|path]` | index-compute-lab knowledge graph (auto-injected each turn when on) |
 | `/harness external [on\|off\|status]` | Opt in or out of indexing other local agent stores |
 | `/route TASK` | Preview task classification, pipeline, advisory budget, and tool policy |
 | `/agent init` | Write a starter `~/.algo_cli/blocks.toml` without overwriting an existing file |
@@ -259,7 +254,7 @@ Common credential forms are redacted and connector/MCP JSON is metadata-only, bu
 
 Typing `/` in the prompt shows inline slash-command completions.
 
-For the assistant/model, slash commands are session controls, not prose. The model is prompted to use `session_slash` for deterministic `/read`, `/ls`, `/cd`, and `/cwd`; `session_command` for non-file session controls such as `/status`, `/mode`, `/context`, `/code-rag status`, `/harness refresh`, `/route`, and `/agent`; and normal model-callable tools for actual work (`write_file` for edits, `run_shell` for tests/builds). Read-only/status `session_command` calls run without approval; state-changing commands, including `/code-rag on` and `/code-rag off`, and agent execution require approval. Runtime-triggered `/agent` calls are allowed from the parent chat loop, but recursive delegation from inside an Agent Blocks run is rejected. Toggle commands accept explicit idempotent forms such as `/auto on`, `/safe off`, `/code-rag status`, `/thinking status`, `/verify on`, and `/cloud off`.
+For the assistant/model, slash commands are session controls, not prose. The model is prompted to use `session_slash` for deterministic `/read`, `/ls`, `/cd`, and `/cwd`; `session_command` for non-file session controls such as `/status`, `/mode`, `/context`, `/context status`, `/harness refresh`, `/route`, and `/agent`; and normal model-callable tools for actual work (`write_file` for edits, `run_shell` for tests/builds). Read-only/status `session_command` calls run without approval; state-changing commands and agent execution require approval. Runtime-triggered `/agent` calls are allowed from the parent chat loop, but recursive delegation from inside an Agent Blocks run is rejected. Toggle commands accept explicit idempotent forms such as `/auto on`, `/safe off`, `/context status`, `/thinking status`, `/verify on`, and `/cloud off`.
 
 `/reason` is called out in the model prompt as a reasoning-posture control. Use `/reason status` or `/reason guide` before changing it. Keep `react` for ordinary tool loops and simple edits; use `reflexion` after failed/partial attempts; `tot`, `got`, or `mcts` for ambiguous multi-path planning/search; `qcr` for comparing candidate solutions; and `neuro_symbolic` for verification-heavy logic, code invariants, contracts, math, or claim checking. Changing `/reason` does not replace evidence gathering or tool verification.
 
@@ -287,7 +282,7 @@ Every turn semantically supersedes older successful snapshots of the same resour
 
 When a `requires_change` block completes on recorded `write_file` evidence but Git verification is unavailable, the manual-confirmation notice is carried on a dedicated verification field. The block's output stays untouched; the warning is rendered on the completion panel and passed to downstream blocks in a separate `## Verification` section.
 
-Agent Block runs use enabled intuition recall before the first block and display any recalled context. For medium-risk coding tasks with policy enforcement enabled, write and shell tools remain available subject to approval; high-risk tasks remain read-only.
+Agent Block runs use native Continuum context when selected; retired Intuition recall is not injected. For medium-risk coding tasks with policy enforcement enabled, write and shell tools remain available subject to approval; high-risk tasks remain read-only.
 
 The built-in `code-change` plan block may perform up to four local read-only inspection turns before planning, so implementation starts from observed Python paths instead of guessed project structure.
 
@@ -307,7 +302,7 @@ The model can call these tools during a conversation:
 
 **Memory:** `remember`, `append_lesson`, `update_user_profile`
 
-**Multimodal:** `embed_text`, `vision_describe`
+**Multimodal:** `vision_describe`
 
 **Programmatic actions:** `action_search` retrieves a small set of exact deferred action schemas; discovery does not bypass the active capability ceiling, runtime policy, or approval. `action_program` compiles a bounded typed dataflow plan—never arbitrary Python or JavaScript—and routes every nested action through its existing ActionSpec policy, guardrails, approval, attempt ledger, and telemetry. Its wall-clock budget is cooperative: the remaining budget is propagated into timeout-aware actions and checked around every step, while actions without a timeout contract can only be marked over-budget after they return. Large intermediate values are content-addressed in the private runtime store; compact results retain hash-chained mutation and verification receipts. Successful program verifiers reconcile into the outer completion ledger, so the latest passing post-mutation check supersedes earlier failures without relying on model phrasing.
 
@@ -317,9 +312,9 @@ The model can call these tools during a conversation:
 
 **Files and Git:** `read_file`, `read_pdf`, `render_pdf_pages`, `edit_file`, `write_file`, `list_directory`, `search_files`, `find_unique_anchor`, `batch_edit`, `git_status`, `git_diff`
 
-**Harness:** `available_actions`, `harness_stats`, `harness_search`, `harness_read`, `harness_refresh`, `query_knowledge_graph`
+**References:** `available_actions`, `harness_stats`, `harness_search`, `harness_read`, `harness_refresh`. These use lexical search, not an embedding provider.
 
-After `/icl on`, `query_knowledge_graph` reads the configured index-compute-lab ranked association index through its public query CLI. Set `ALGO_CLI_INDEX_COMPUTE_LAB_ROOT` to use a different local checkout.
+**Memory:** explicit scoped native Continuum tools. Retired graph/embedding commands refuse calls and do not select a fallback backend.
 
 `write_file`, `run_shell`, `model_delete`, and `model_create` require approval unless `/auto` is enabled. A typed program is not blanket-approved: each nested mutation or external action keeps its own approval decision, and restricted Agent Blocks supply their own runtime-owned capability ceiling. Safe mode blocks destructive shell patterns by default. Agent Blocks with `requires_change = true` are instructed prescriptively that file creation, edits, appends, and deletes must go through `write_file`; `run_shell` is restricted to read-only verification (status, tests, lint, diff, grep, ls). Shell-based file mutation (heredocs, output redirection, `sed -i`, `Set-Content`, `Out-File`, etc.) is not counted as evidence of a change, and the model is told to stop and report rather than route edits through shell when `write_file` is unavailable.
 
@@ -335,7 +330,7 @@ The CLI retrieves relevant records from a local index. The public built-in corpu
 
 **Default sources:** packaged Algo CLI docs and skills, user-created `~/.algo_cli` records, and explicit `harness_roots.json` entries.
 
-**Opt-in sources:** Codex, Claude, OpenClaw, shared agents, Mercury, CLI Agent, Pi, and index-compute-lab.
+**Opt-in reference sources:** Codex, Claude, OpenClaw, shared agents, Mercury, CLI Agent and Pi. These do not replace Continuum memory.
 
 **Harness commands:**
 ```
@@ -381,7 +376,17 @@ cd harness-gateway
 go run . -addr 127.0.0.1:8765
 ```
 
-Endpoints: `GET /healthz`, `GET /harness/stats`, `GET /harness/search`, `POST /supplemental/embed`
+Gateway endpoints include `GET /healthz`, `GET /harness/stats` and
+`GET /harness/search`. CLI readiness uses the public health check; the CLI does
+not call the historical embedding endpoint.
+
+Index search and statistics are disabled unless `ALGO_CLI_GATEWAY_TOKEN` is set
+in the gateway process environment. Use a cryptographically generated URL-safe
+token of 32 to 512 characters and send it as a single
+`Authorization: Bearer <token>` header. Query-string tokens are not accepted.
+Missing or malformed server configuration returns 503; missing or invalid caller
+credentials return 401. Do not put the token in a URL, shell argument, repository
+or shared log. The health check does not require this index credential.
 
 Override: `ALGO_CLI_GATEWAY_URL`, `ALGO_CLI_GATEWAY_BIN` (legacy `OLLAMA_CLI_*` names are still accepted).
 
@@ -394,8 +399,10 @@ Config is stored in `~/.algo_cli/` by default (data from `~/.ollama_cli` is auto
 | `ALGO_CLI_CONFIG_DIR` | Override config directory |
 | `ALGO_CLI_ENV_FILE` | Override runtime env file path (`env` is preferred; `.env` is supported as a fallback) |
 | `ALGO_CLI_MODEL` | Default model |
-| `ALGO_CLI_THEME` | Default theme (`tokyo-night`, `catppuccin-mocha`, `dracula`, `nord`, `gruvbox`, `dolphie`) |
+| `ALGO_CLI_THEME` | Default theme (`tokyo-night`, `catppuccin-mocha`, `dracula`, `nord`, `gruvbox`, `dolphie`, `redeye`) |
+| `NO_COLOR`, `COLORTERM`, `TERM`, `FORCE_COLOR` | Colour depth, detected once for the whole UI: `NO_COLOR` or `TERM=dumb` renders with bold, dim and reverse only; `COLORTERM=truecolor` gives 24-bit, `*-256color` 256 colours, and `FORCE_COLOR=1/2/3` raises (never lowers) the depth; any other terminal uses a 16-colour ANSI palette in which every theme shares one map that keeps success, warning, error and info distinct |
 | `ALGO_CLI_GATEWAY_URL` | Go gateway URL |
+| `ALGO_CLI_GATEWAY_TOKEN` | Optional gateway index API credential; keep private and transmit only in the Bearer header |
 | `ALGO_CLI_HARNESS_INDEXER` | Optional Rust harness indexer binary |
 | `OPENAI_OAUTH_CLIENT_ID` | Optional override for the bundled ChatGPT/Codex browser OAuth client |
 | `OPENAI_CODEX_CLIENT_ID` | Optional override for the bundled Codex OAuth client |

{algo_cli_runtime-0.20.0 → algo_cli_runtime-0.20.3}/README.md

@@ -81,7 +81,7 @@ echo "what changed in main.py?" | algo-cli --oneshot --json
 algo-cli --oneshot --json --approval-mode auto --cwd /path/to/project "fix the failing test"
 ```
 
-Signed-in local Ollama can run `:cloud` models without `OLLAMA_API_KEY`. `OLLAMA_API_KEY` is only required for the direct Cloud API route (`--cloud` / `/cloud on` when an API key is present) and web tools. Embedding indexes currently use local Ollama models only; a configured cloud embedding backend falls back to local until Ollama Cloud exposes embedding models.
+Signed-in local Ollama can run `:cloud` models without `OLLAMA_API_KEY`. `OLLAMA_API_KEY` is only required for the direct Cloud API route (`--cloud` / `/cloud on` when an API key is present) and web tools. Native Continuum owns memory without a CLI embedding pipeline. Local reference lookup is lexical; no automatic embedding model is loaded.
 
 `--oneshot --json` emits one JSON object per line to stdout (NDJSON), suitable for subprocess consumption. `--approval-mode never` (default) denies approval-required tools and emits a `tool_denied` event; pass `--approval-mode auto` to grant them. Skill crystallization is disabled in one-shot mode. Event types: `session_start`, `thinking`, `content`, `tool_call`, `tool_result`, `tool_denied`, `error`, `done`. The bridge can rely on `session_start` first and `done` last as framing.
 
@@ -113,13 +113,11 @@ xAI's public API uses `XAI_API_KEY`; API calls can consume paid usage, so setup
 
 Every normal chat request sends the active conversation and the assembled Algo CLI system context to the selected inference provider. That context includes `SOUL.md`, `IDENTITY.md`, `USER.md`, saved memories, and relevant retrieved lessons when available. With a cloud model, this content may leave the machine. Automatic memory capture is off by default. `/memory-auto on` records explicit consent for the current capture policy and enables bounded capture after successful turns. `/memory-auto off` stops future automatic captures and clears that consent (it does not delete existing memories).
 
-The installed harness corpus contains only public Algo CLI docs, skills, and runtime metadata. Other local agent stores, working-directory code retrieval, index-compute-lab, and skill run-history capture are off by default because retrieved or summarized content can become part of a model request.
+The installed reference corpus contains public Algo CLI docs, skills and runtime metadata. Continuum owns memory; Echo Veil, Lab-index, vector Code RAG and embedding routes are retired. External local references remain opt-in because retrieved content can become part of a model request.
 
 - `/harness external on` opts in to supported Codex, Claude, OpenClaw, Mercury, and shared agent stores.
-- `/icl on` opts in to `~/index-compute-lab`; override its root with `ALGO_CLI_INDEX_COMPUTE_LAB_ROOT`.
-- `/code-rag on` opts in to indexing source files beneath the active cwd and adding relevant snippets to model requests. `/code-rag off` disables retrieval and purges persisted code indexes.
 - `/skills on` opts in to bounded run-summary capture under `~/.algo_cli/private/run_history.jsonl` and automatic skill-candidate crystallization by a genuinely local, non-embedding Ollama model. There is no cloud fallback.
-- `/harness external off` and `/icl off` rebuild the generated index without those records.
+- `/harness external off` rebuilds the generated reference index without external records.
 
 Common credential forms are redacted and connector/MCP JSON is metadata-only, but redaction is not a substitute for reviewing the sources you enable. See [Privacy and local context](docs/privacy-and-context.md).
 
@@ -146,11 +144,8 @@ Common credential forms are redacted and connector/MCP JSON is metadata-only, bu
 | `/thinking effort [MODEL] LEVEL` | Set Codex reasoning effort (`low`, `medium`, `high`, `xhigh`, or GPT-5.6 `max`) |
 | `/agent team ...` | Algo's multi-agent counterpart to Codex Ultra; fan out specialists, then integrate and verify |
 | `/memory-auto [on\|off\|status]` | Inspect or toggle bounded, privacy-gated automatic memory capture after successful turns |
-| `/code-rag [on\|off\|status]` | Opt in or out of cwd source indexing and prompt retrieval; `off` purges persisted indexes |
 | `/skills [on\|off\|status\|crystallize]` | Opt in to local run-history capture and review local-only skill candidates |
 | `/remember FACT` | Save a long-term memory |
-| `/intuition [on|off|status|add|list|forget|reindex]` | Manage embedded recall blocks |
-| `/icl [on\|off\|status\|ask\|path]` | index-compute-lab knowledge graph (auto-injected each turn when on) |
 | `/harness external [on\|off\|status]` | Opt in or out of indexing other local agent stores |
 | `/route TASK` | Preview task classification, pipeline, advisory budget, and tool policy |
 | `/agent init` | Write a starter `~/.algo_cli/blocks.toml` without overwriting an existing file |
@@ -191,7 +186,7 @@ Common credential forms are redacted and connector/MCP JSON is metadata-only, bu
 
 Typing `/` in the prompt shows inline slash-command completions.
 
-For the assistant/model, slash commands are session controls, not prose. The model is prompted to use `session_slash` for deterministic `/read`, `/ls`, `/cd`, and `/cwd`; `session_command` for non-file session controls such as `/status`, `/mode`, `/context`, `/code-rag status`, `/harness refresh`, `/route`, and `/agent`; and normal model-callable tools for actual work (`write_file` for edits, `run_shell` for tests/builds). Read-only/status `session_command` calls run without approval; state-changing commands, including `/code-rag on` and `/code-rag off`, and agent execution require approval. Runtime-triggered `/agent` calls are allowed from the parent chat loop, but recursive delegation from inside an Agent Blocks run is rejected. Toggle commands accept explicit idempotent forms such as `/auto on`, `/safe off`, `/code-rag status`, `/thinking status`, `/verify on`, and `/cloud off`.
+For the assistant/model, slash commands are session controls, not prose. The model is prompted to use `session_slash` for deterministic `/read`, `/ls`, `/cd`, and `/cwd`; `session_command` for non-file session controls such as `/status`, `/mode`, `/context`, `/context status`, `/harness refresh`, `/route`, and `/agent`; and normal model-callable tools for actual work (`write_file` for edits, `run_shell` for tests/builds). Read-only/status `session_command` calls run without approval; state-changing commands and agent execution require approval. Runtime-triggered `/agent` calls are allowed from the parent chat loop, but recursive delegation from inside an Agent Blocks run is rejected. Toggle commands accept explicit idempotent forms such as `/auto on`, `/safe off`, `/context status`, `/thinking status`, `/verify on`, and `/cloud off`.
 
 `/reason` is called out in the model prompt as a reasoning-posture control. Use `/reason status` or `/reason guide` before changing it. Keep `react` for ordinary tool loops and simple edits; use `reflexion` after failed/partial attempts; `tot`, `got`, or `mcts` for ambiguous multi-path planning/search; `qcr` for comparing candidate solutions; and `neuro_symbolic` for verification-heavy logic, code invariants, contracts, math, or claim checking. Changing `/reason` does not replace evidence gathering or tool verification.
 
@@ -219,7 +214,7 @@ Every turn semantically supersedes older successful snapshots of the same resour
 
 When a `requires_change` block completes on recorded `write_file` evidence but Git verification is unavailable, the manual-confirmation notice is carried on a dedicated verification field. The block's output stays untouched; the warning is rendered on the completion panel and passed to downstream blocks in a separate `## Verification` section.
 
-Agent Block runs use enabled intuition recall before the first block and display any recalled context. For medium-risk coding tasks with policy enforcement enabled, write and shell tools remain available subject to approval; high-risk tasks remain read-only.
+Agent Block runs use native Continuum context when selected; retired Intuition recall is not injected. For medium-risk coding tasks with policy enforcement enabled, write and shell tools remain available subject to approval; high-risk tasks remain read-only.
 
 The built-in `code-change` plan block may perform up to four local read-only inspection turns before planning, so implementation starts from observed Python paths instead of guessed project structure.
 
@@ -239,7 +234,7 @@ The model can call these tools during a conversation:
 
 **Memory:** `remember`, `append_lesson`, `update_user_profile`
 
-**Multimodal:** `embed_text`, `vision_describe`
+**Multimodal:** `vision_describe`
 
 **Programmatic actions:** `action_search` retrieves a small set of exact deferred action schemas; discovery does not bypass the active capability ceiling, runtime policy, or approval. `action_program` compiles a bounded typed dataflow plan—never arbitrary Python or JavaScript—and routes every nested action through its existing ActionSpec policy, guardrails, approval, attempt ledger, and telemetry. Its wall-clock budget is cooperative: the remaining budget is propagated into timeout-aware actions and checked around every step, while actions without a timeout contract can only be marked over-budget after they return. Large intermediate values are content-addressed in the private runtime store; compact results retain hash-chained mutation and verification receipts. Successful program verifiers reconcile into the outer completion ledger, so the latest passing post-mutation check supersedes earlier failures without relying on model phrasing.
 
@@ -249,9 +244,9 @@ The model can call these tools during a conversation:
 
 **Files and Git:** `read_file`, `read_pdf`, `render_pdf_pages`, `edit_file`, `write_file`, `list_directory`, `search_files`, `find_unique_anchor`, `batch_edit`, `git_status`, `git_diff`
 
-**Harness:** `available_actions`, `harness_stats`, `harness_search`, `harness_read`, `harness_refresh`, `query_knowledge_graph`
+**References:** `available_actions`, `harness_stats`, `harness_search`, `harness_read`, `harness_refresh`. These use lexical search, not an embedding provider.
 
-After `/icl on`, `query_knowledge_graph` reads the configured index-compute-lab ranked association index through its public query CLI. Set `ALGO_CLI_INDEX_COMPUTE_LAB_ROOT` to use a different local checkout.
+**Memory:** explicit scoped native Continuum tools. Retired graph/embedding commands refuse calls and do not select a fallback backend.
 
 `write_file`, `run_shell`, `model_delete`, and `model_create` require approval unless `/auto` is enabled. A typed program is not blanket-approved: each nested mutation or external action keeps its own approval decision, and restricted Agent Blocks supply their own runtime-owned capability ceiling. Safe mode blocks destructive shell patterns by default. Agent Blocks with `requires_change = true` are instructed prescriptively that file creation, edits, appends, and deletes must go through `write_file`; `run_shell` is restricted to read-only verification (status, tests, lint, diff, grep, ls). Shell-based file mutation (heredocs, output redirection, `sed -i`, `Set-Content`, `Out-File`, etc.) is not counted as evidence of a change, and the model is told to stop and report rather than route edits through shell when `write_file` is unavailable.
 
@@ -267,7 +262,7 @@ The CLI retrieves relevant records from a local index. The public built-in corpu
 
 **Default sources:** packaged Algo CLI docs and skills, user-created `~/.algo_cli` records, and explicit `harness_roots.json` entries.
 
-**Opt-in sources:** Codex, Claude, OpenClaw, shared agents, Mercury, CLI Agent, Pi, and index-compute-lab.
+**Opt-in reference sources:** Codex, Claude, OpenClaw, shared agents, Mercury, CLI Agent and Pi. These do not replace Continuum memory.
 
 **Harness commands:**
 ```
@@ -313,7 +308,17 @@ cd harness-gateway
 go run . -addr 127.0.0.1:8765
 ```
 
-Endpoints: `GET /healthz`, `GET /harness/stats`, `GET /harness/search`, `POST /supplemental/embed`
+Gateway endpoints include `GET /healthz`, `GET /harness/stats` and
+`GET /harness/search`. CLI readiness uses the public health check; the CLI does
+not call the historical embedding endpoint.
+
+Index search and statistics are disabled unless `ALGO_CLI_GATEWAY_TOKEN` is set
+in the gateway process environment. Use a cryptographically generated URL-safe
+token of 32 to 512 characters and send it as a single
+`Authorization: Bearer <token>` header. Query-string tokens are not accepted.
+Missing or malformed server configuration returns 503; missing or invalid caller
+credentials return 401. Do not put the token in a URL, shell argument, repository
+or shared log. The health check does not require this index credential.
 
 Override: `ALGO_CLI_GATEWAY_URL`, `ALGO_CLI_GATEWAY_BIN` (legacy `OLLAMA_CLI_*` names are still accepted).
 
@@ -326,8 +331,10 @@ Config is stored in `~/.algo_cli/` by default (data from `~/.ollama_cli` is auto
 | `ALGO_CLI_CONFIG_DIR` | Override config directory |
 | `ALGO_CLI_ENV_FILE` | Override runtime env file path (`env` is preferred; `.env` is supported as a fallback) |
 | `ALGO_CLI_MODEL` | Default model |
-| `ALGO_CLI_THEME` | Default theme (`tokyo-night`, `catppuccin-mocha`, `dracula`, `nord`, `gruvbox`, `dolphie`) |
+| `ALGO_CLI_THEME` | Default theme (`tokyo-night`, `catppuccin-mocha`, `dracula`, `nord`, `gruvbox`, `dolphie`, `redeye`) |
+| `NO_COLOR`, `COLORTERM`, `TERM`, `FORCE_COLOR` | Colour depth, detected once for the whole UI: `NO_COLOR` or `TERM=dumb` renders with bold, dim and reverse only; `COLORTERM=truecolor` gives 24-bit, `*-256color` 256 colours, and `FORCE_COLOR=1/2/3` raises (never lowers) the depth; any other terminal uses a 16-colour ANSI palette in which every theme shares one map that keeps success, warning, error and info distinct |
 | `ALGO_CLI_GATEWAY_URL` | Go gateway URL |
+| `ALGO_CLI_GATEWAY_TOKEN` | Optional gateway index API credential; keep private and transmit only in the Bearer header |
 | `ALGO_CLI_HARNESS_INDEXER` | Optional Rust harness indexer binary |
 | `OPENAI_OAUTH_CLIENT_ID` | Optional override for the bundled ChatGPT/Codex browser OAuth client |
 | `OPENAI_CODEX_CLIENT_ID` | Optional override for the bundled Codex OAuth client |

{algo_cli_runtime-0.20.0 → algo_cli_runtime-0.20.3}/algo_cli/__init__.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 from importlib import import_module
 from types import ModuleType
 
-__version__ = "0.20.0"
+__version__ = "0.20.3"
 
 _RENAMED_INTERNAL_MODULES = {
     "elsie_memory_path_policy": "irene_memory_path_policy",

{algo_cli_runtime-0.20.0 → algo_cli_runtime-0.20.3}/algo_cli/action_registry.py

@@ -276,18 +276,6 @@ ACTION_SPECS: tuple[ActionSpec, ...] = (
         requires_network=True,
         requires_provider="ollama-cloud",
     ),
-    _spec(
-        "query_knowledge_graph",
-        "tool",
-        "Query index-compute-lab ranked associations.",
-        "read",
-        ("icl", "knowledge-graph", "read-only"),
-        "Detects local knowledge graph readiness for grounded context.",
-        "low",
-        False,
-        False,
-        True,
-    ),
     _spec(
         "remember",
         "tool",
@@ -361,21 +349,6 @@ ACTION_SPECS: tuple[ActionSpec, ...] = (
         True,
         True,
     ),
-    _spec(
-        "/code-rag",
-        "slash",
-        "Show or toggle working-directory code retrieval.",
-        "harness",
-        ("code-rag", "privacy", "local-index", "toggle"),
-        "Requires explicit versioned consent before cwd snippets can enter model prompts.",
-        "medium",
-        True,
-        True,
-        True,
-        known_limitations=(
-            "When enabled, retrieved snippets join the active provider request; /code-rag off purges persisted indexes.",
-        ),
-    ),
     _spec(
         "/actions",
         "slash",
@@ -1400,6 +1373,14 @@ def _first_doc_line(obj: Any, fallback: str) -> str:
     return first or fallback
 
 
+# Discovery vocabulary only; policy still comes from policy_for_action. Gmail,
+# Drive, and Calendar are reachable solely as /google slash commands, so
+# session_command must answer to their domain words.
+_GENERATED_TOOL_DISCOVERY_TAGS: dict[str, tuple[str, ...]] = {
+    "session_command": ("slash", "google", "gmail", "email", "mail", "inbox", "drive", "calendar"),
+}
+
+
 def _generated_tool_spec(name: str, fn: Any) -> ActionSpec:
     policy = policy_for_action(name)
     memory_tool = name.startswith("memory_")
@@ -1429,7 +1410,7 @@ def _generated_tool_spec(name: str, fn: Any) -> ActionSpec:
         (
             ("continuum", "memory", "curated-runtime", "tool")
             if memory_tool
-            else ("curated-runtime", "runtime", "tool")
+            else ("curated-runtime", "runtime", "tool", *_GENERATED_TOOL_DISCOVERY_TAGS.get(name, ()))
             if policy.curated
             else ("unclassified", "runtime", "tool")
         ),
@@ -1806,40 +1787,6 @@ def build_doctor_report(cfg: Any) -> DoctorReport:
             )
         )
 
-    from . import index_compute_lab
-
-    root = index_compute_lab.resolve_lab_root()
-    icl_enabled = bool(getattr(cfg, "index_compute_lab_auto_inject", False))
-    if not icl_enabled:
-        findings.append(
-            DoctorFinding(
-                "ready",
-                "index-compute-lab",
-                "optional index-compute-lab context is disabled",
-                "Use /icl on only when this local source is appropriate for the selected model provider.",
-            )
-        )
-    elif not root.exists():
-        findings.append(
-            DoctorFinding(
-                "degraded",
-                "index-compute-lab",
-                f"enabled index-compute-lab root is missing: {root}",
-                "Set ALGO_CLI_INDEX_COMPUTE_LAB_ROOT or clone/build the lab.",
-            )
-        )
-    elif index_compute_lab.lab_available():
-        findings.append(DoctorFinding("ready", "index-compute-lab", "index-compute-lab graph ready"))
-    else:
-        findings.append(
-            DoctorFinding(
-                "degraded",
-                "index-compute-lab",
-                "index-compute-lab root exists but query assets are missing",
-                "Need query.py, atoms/ranked-association-map.json, and atoms/alias-table.json.",
-            )
-        )
-
     if bool(getattr(cfg, "safe_mode", True)):
         findings.append(DoctorFinding("ready", "safety", "safe mode enabled"))
     else:

{algo_cli_runtime-0.20.0 → algo_cli_runtime-0.20.3}/algo_cli/agent_blocks.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from dataclasses import dataclass, field
+from importlib import import_module
 from pathlib import Path
 from typing import Any
 
@@ -10,10 +11,10 @@ from .config import CONFIG_DIR, _atomic_write_text
 from .samuel_policy import TOOL_GROUP_MAP, expand_tool_groups
 
 try:
-    import tomllib  # type: ignore[import-not-found]
+    tomllib = import_module("tomllib")
 except ImportError:  # Python 3.10: fall back to the tomli backport.
     try:
-        import tomli as tomllib
+        tomllib = import_module("tomli")
     except ImportError:  # pragma: no cover - tomli is a declared 3.10 dependency.
         tomllib = None  # type: ignore[assignment]