From 82895971536a1ac1669ead805a74d2b3e62c3873 Mon Sep 17 00:00:00 2001 From: "chinkan.ai" Date: Thu, 10 Sep 2026 22:00:29 +0800 Subject: [PATCH 01/13] feat(memory): temporal facts, knowledge history, cmd timeout + cancel fix - Knowledge history via SQLite UPDATE/DELETE triggers; timeline + as_of queries - Temporal facts (entity/relation/value/valid_from/valid_to); one active per pair - MCP tools: add_fact, query_facts, close_fact, fact_history - execute_command wall-clock timeout (default 90s, config 0=off) - Fix Cancel button: CallbackQuery bypasses per-chat serialization Deferred: agentic RAG (#52), harness evolution (#53) --- CONTEXT.md | 22 +- config.example.toml | 2 + ...04-temporal-facts-and-knowledge-history.md | 3 + ...-callback-query-not-serialized-per-chat.md | 3 + src/command_tool.rs | 61 ++- src/config.rs | 18 +- src/main.rs | 1 + src/memory/knowledge.rs | 418 ++++++++++++++++++ src/memory/mod.rs | 54 +++ src/memory_tools.rs | 164 +++++++ src/platform/telegram.rs | 5 + 11 files changed, 734 insertions(+), 17 deletions(-) create mode 100644 docs/adr/0004-temporal-facts-and-knowledge-history.md create mode 100644 docs/adr/0005-callback-query-not-serialized-per-chat.md diff --git a/CONTEXT.md b/CONTEXT.md index 7993bb6..e831776 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -30,4 +30,24 @@ Entry in Tool Notifier showing: friendly tool name, optional args preview, statu Human-readable label for built-in tools (e.g., "๐Ÿ’ป Running a command" for `execute_command`). ### Args Preview -Truncated (60 chars), redacted JSON args shown in Tool Notifier. Only in Verbose mode. \ No newline at end of file +Truncated (60 chars), redacted JSON args shown in Verbose mode. + +--- + +## Memory + +### Knowledge +Current key-value snapshot the agent stores under `(category, key) โ†’ value`. One live value per pair. +_Avoid_: fact (when meaning KV), memory entry, note + +### Knowledge History +Append-only archive of prior Knowledge values, written automatically on overwrite or delete. +_Avoid_: audit log, version log (generic) + +### Fact +Time-bounded triple `(entity, relation, value)` with `valid_from` / `valid_to`. At most one active value per `(entity, relation)` (`valid_to` null = still active). +_Avoid_: subject/object_value, triple, statement, knowledge (KV sense) + +### valid_from / valid_to +Inclusive start and exclusive-or-end bound of a Fact's validity window. `valid_to` null means still active. Stored as SQLite `datetime` TEXT. +_Avoid_: valid_until, effective_from, learned_at (provenance, not validity) diff --git a/config.example.toml b/config.example.toml index b3a519c..5e13e83 100644 --- a/config.example.toml +++ b/config.example.toml @@ -68,6 +68,8 @@ Be concise and helpful.""" # The LLM's persistent workspace (file/command tools are confined here). # Leave unset to use /workspace. Set an absolute path to override. # allowed_directory = "/absolute/path/to/workspace" +# Wall-clock limit for execute_command (seconds). 0 = no timeout. Default: 90. +# execute_timeout_secs = 90 [memory] # Path to the SQLite database file for persistent memory diff --git a/docs/adr/0004-temporal-facts-and-knowledge-history.md b/docs/adr/0004-temporal-facts-and-knowledge-history.md new file mode 100644 index 0000000..72732e0 --- /dev/null +++ b/docs/adr/0004-temporal-facts-and-knowledge-history.md @@ -0,0 +1,3 @@ +# Temporal Facts and Knowledge History + +Memory gains two layers: Knowledge History (auto-archive on `remember`/`forget` via SQLite triggers) and Facts (explicit bi-temporal triples). Knowledge stays the live KV snapshot; Facts carry validity windows. Schema uses `entity`/`relation`/`value`/`valid_from`/`valid_to` (not subject/object_value/valid_until). One active Fact per `(entity, relation)`; new value auto-closes the prior active row. No agent-loop changes in this phase โ€” data layer + MCP tools only. Agentic RAG and harness evolution deferred to separate issues. diff --git a/docs/adr/0005-callback-query-not-serialized-per-chat.md b/docs/adr/0005-callback-query-not-serialized-per-chat.md new file mode 100644 index 0000000..bc79849 --- /dev/null +++ b/docs/adr/0005-callback-query-not-serialized-per-chat.md @@ -0,0 +1,3 @@ +# Callback queries bypass per-chat serialization + +Teloxide `distribution_function` keyed non-command updates by chat id so messages stay ordered. Callback queries (Cancel button) shared that key, so cancel handlers queued behind the in-flight message handler stuck in `execute_command` โ€” Cancel appeared dead. Decision: return `None` for `CallbackQuery` (and keep `/` commands concurrent) so cancel runs while the tool is still executing. Message ordering unchanged. diff --git a/src/command_tool.rs b/src/command_tool.rs index 4dc7134..cb5df2c 100644 --- a/src/command_tool.rs +++ b/src/command_tool.rs @@ -27,6 +27,8 @@ pub struct CommandTool { sandbox_dir: PathBuf, cancel_registry: Arc, sender: Arc, + /// 0 = no wall-clock timeout. + execute_timeout_secs: u64, } impl CommandTool { @@ -34,11 +36,13 @@ impl CommandTool { sandbox_dir: PathBuf, cancel_registry: Arc, sender: Arc, + execute_timeout_secs: u64, ) -> Self { Self { sandbox_dir, cancel_registry, sender, + execute_timeout_secs, } } } @@ -156,8 +160,19 @@ impl CommandTool { let mut last_edit = Instant::now(); let mut exit_code: Option = None; let mut cancelled = false; + let mut timed_out = false; tokio::pin!(cancel_rx); + let timeout_secs = self.execute_timeout_secs; + let timeout_fut = async { + if timeout_secs == 0 { + std::future::pending::<()>().await; + } else { + tokio::time::sleep(std::time::Duration::from_secs(timeout_secs)).await; + } + }; + tokio::pin!(timeout_fut); + loop { tokio::select! { Some(chunk) = output_rx.recv() => { @@ -182,15 +197,12 @@ impl CommandTool { } _ = &mut cancel_rx => { cancelled = true; - #[cfg(unix)] - if let Some(pid) = child.id() { - let _ = nix::sys::signal::killpg( - nix::unistd::Pid::from_raw(pid as i32), - nix::sys::signal::Signal::SIGKILL, - ); - } - let _ = child.kill().await; - let _ = child.wait().await; + Self::kill_child(&mut child).await; + break; + } + _ = &mut timeout_fut => { + timed_out = true; + Self::kill_child(&mut child).await; break; } } @@ -217,26 +229,33 @@ impl CommandTool { } } - let result = if cancelled { + let result = if cancelled || timed_out { + let label = if timed_out { + format!("Timed out after {}s", timeout_secs) + } else { + "Cancelled".to_string() + }; if let Some(mid) = &msg_id { match send_mode { SendMode::Verbose => { let body = format_body(&output_buffer, ""); let text = match body { - None => format!("โŒ Cancelled: `{}`", escaped_cmd), - Some(b) => format!("โŒ Cancelled: `{}`\n\n{}", escaped_cmd, b), + None => format!("โŒ {}: `{}`", label, escaped_cmd), + Some(b) => format!("โŒ {}: `{}`\n\n{}", label, escaped_cmd, b), }; let _ = self.sender.edit_message(&ctx.chat_id, mid, &text).await; } SendMode::Minimal => { - // Delete the minimal message let _ = self.sender.delete_message(&ctx.chat_id, mid).await; } - // Silent mode sends no message; nothing to clean up. SendMode::Silent => {} } } - "โš ๏ธ User cancelled the command".to_string() + if timed_out { + format!("โš ๏ธ Command timed out after {}s", timeout_secs) + } else { + "โš ๏ธ User cancelled the command".to_string() + } } else if let Some(code) = exit_code { if let Some(mid) = &msg_id { match send_mode { @@ -278,4 +297,16 @@ impl CommandTool { self.cancel_registry.unregister(&cmd_id).await; Ok(result) } + + async fn kill_child(child: &mut tokio::process::Child) { + #[cfg(unix)] + if let Some(pid) = child.id() { + let _ = nix::sys::signal::killpg( + nix::unistd::Pid::from_raw(pid as i32), + nix::sys::signal::Signal::SIGKILL, + ); + } + let _ = child.kill().await; + let _ = child.wait().await; + } } diff --git a/src/config.rs b/src/config.rs index d152a01..e5496ec 100644 --- a/src/config.rs +++ b/src/config.rs @@ -184,10 +184,26 @@ pub struct OcrConfig { pub model_dir: std::path::PathBuf, } -#[derive(Debug, Deserialize, Clone, Default)] +#[derive(Debug, Deserialize, Clone)] pub struct SandboxConfig { #[serde(default)] pub allowed_directory: PathBuf, + /// Wall-clock limit for `execute_command`. 0 = no timeout. + #[serde(default = "default_execute_timeout_secs")] + pub execute_timeout_secs: u64, +} + +impl Default for SandboxConfig { + fn default() -> Self { + Self { + allowed_directory: PathBuf::new(), + execute_timeout_secs: default_execute_timeout_secs(), + } + } +} + +fn default_execute_timeout_secs() -> u64 { + 90 } #[derive(Debug, Deserialize, Clone)] diff --git a/src/main.rs b/src/main.rs index 0941b30..5792d4e 100644 --- a/src/main.rs +++ b/src/main.rs @@ -241,6 +241,7 @@ async fn main() -> Result<()> { config.sandbox.allowed_directory.clone(), cancel_registry.clone(), sender.clone(), + config.sandbox.execute_timeout_secs, ))); // Arc::new_cyclic so Agent can store Weak for job closure captures (breaks Arc cycle) diff --git a/src/memory/knowledge.rs b/src/memory/knowledge.rs index 7e825cf..780f4cb 100644 --- a/src/memory/knowledge.rs +++ b/src/memory/knowledge.rs @@ -15,6 +15,43 @@ pub struct KnowledgeEntry { pub source: Option, } +/// One archived knowledge change (trigger-written). +#[derive(Debug, Clone)] +pub struct KnowledgeVersion { + pub id: String, + pub category: String, + pub key: String, + pub old_value: Option, + pub new_value: Option, + pub source: Option, + pub change_type: String, + pub changed_at: String, +} + +/// Time-bounded triple. +#[derive(Debug, Clone)] +pub struct Fact { + pub id: String, + pub entity: String, + pub relation: String, + pub value: String, + pub valid_from: String, + pub valid_to: Option, + pub source: Option, + pub confidence: f64, +} + +/// Input for [`MemoryStore::add_fact`]. +#[derive(Debug, Clone)] +pub struct FactToAdd { + pub entity: String, + pub relation: String, + pub value: String, + pub valid_from: String, + pub source: Option, + pub confidence: Option, +} + impl MemoryStore { /// Store or update a knowledge entry with vector embedding pub async fn remember( @@ -206,6 +243,200 @@ impl MemoryStore { )?; Ok(rows > 0) } + + /// Full version timeline for a (category, key) pair, oldest first. + pub async fn knowledge_timeline( + &self, + category: &str, + key: &str, + ) -> Result> { + let conn = self.conn.lock().await; + let mut stmt = conn.prepare( + "SELECT id, category, key, old_value, new_value, source, change_type, changed_at + FROM knowledge_history + WHERE category = ?1 AND key = ?2 + ORDER BY changed_at ASC, rowid ASC", + )?; + let rows = stmt + .query_map(rusqlite::params![category, key], parse_knowledge_version)? + .collect::, _>>() + .context("Failed to load knowledge timeline")?; + Ok(rows) + } + + /// Reconstruct knowledge value as of a SQLite datetime string. + pub async fn knowledge_as_of( + &self, + category: &str, + key: &str, + as_of: &str, + ) -> Result> { + let conn = self.conn.lock().await; + + let current: Option<(String, String)> = conn + .query_row( + "SELECT value, created_at FROM knowledge WHERE category = ?1 AND key = ?2", + rusqlite::params![category, key], + |row| Ok((row.get(0)?, row.get(1)?)), + ) + .ok(); + + let mut stmt = conn.prepare( + "SELECT id, category, key, old_value, new_value, source, change_type, changed_at + FROM knowledge_history + WHERE category = ?1 AND key = ?2 + ORDER BY changed_at DESC, rowid DESC", + )?; + let history: Vec = stmt + .query_map(rusqlite::params![category, key], parse_knowledge_version)? + .collect::, _>>() + .context("Failed to load knowledge history for as_of")?; + + // Reverse-apply changes newer than as_of onto the live value. + let mut val = current.as_ref().map(|(v, _)| v.clone()); + for h in &history { + if h.changed_at.as_str() <= as_of { + break; + } + val = h.old_value.clone(); + } + + // Before first create and no residual history โ†’ absent. + if let Some((_, ref created_at)) = current { + if as_of < created_at.as_str() && history.is_empty() { + return Ok(None); + } + if as_of < created_at.as_str() { + let earliest = history.iter().map(|h| h.changed_at.as_str()).min(); + if earliest.is_none_or(|e| as_of < e) { + return Ok(None); + } + } + } + + Ok(val) + } + + /// Insert fact; skip if identical active exists. Auto-closes prior active for pair. + pub async fn add_fact(&self, fact: FactToAdd) -> Result { + let conn = self.conn.lock().await; + let confidence = fact.confidence.unwrap_or(1.0); + + let existing: Option = conn + .query_row( + "SELECT id FROM facts + WHERE entity = ?1 AND relation = ?2 AND value = ?3 AND valid_to IS NULL", + rusqlite::params![&fact.entity, &fact.relation, &fact.value], + |row| row.get(0), + ) + .ok(); + if let Some(id) = existing { + return Ok(id); + } + + conn.execute( + "UPDATE facts SET valid_to = ?1 + WHERE entity = ?2 AND relation = ?3 AND valid_to IS NULL", + rusqlite::params![&fact.valid_from, &fact.entity, &fact.relation], + ) + .context("Failed to close prior active fact")?; + + let id = Uuid::new_v4().to_string(); + conn.execute( + "INSERT INTO facts (id, entity, relation, value, valid_from, source, confidence) + VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)", + rusqlite::params![ + &id, + &fact.entity, + &fact.relation, + &fact.value, + &fact.valid_from, + &fact.source, + confidence + ], + ) + .context("Failed to insert fact")?; + Ok(id) + } + + /// End currently-active fact for (entity, relation). + pub async fn close_fact(&self, entity: &str, relation: &str, valid_to: &str) -> Result { + let conn = self.conn.lock().await; + let rows = conn + .execute( + "UPDATE facts SET valid_to = ?1 + WHERE entity = ?2 AND relation = ?3 AND valid_to IS NULL", + rusqlite::params![valid_to, entity, relation], + ) + .context("Failed to close fact")?; + Ok(rows > 0) + } + + /// Facts for entity; `as_of = None` โ†’ currently active only. + pub async fn query_facts(&self, entity: &str, as_of: Option<&str>) -> Result> { + let conn = self.conn.lock().await; + if let Some(as_of) = as_of { + let mut stmt = conn.prepare( + "SELECT id, entity, relation, value, valid_from, valid_to, source, confidence + FROM facts + WHERE entity = ?1 + AND valid_from <= ?2 + AND (valid_to IS NULL OR valid_to > ?2) + ORDER BY relation, valid_from", + )?; + let facts = stmt + .query_map(rusqlite::params![entity, as_of], parse_fact)? + .collect::, _>>() + .context("Failed to query facts as_of")?; + Ok(facts) + } else { + let mut stmt = conn.prepare( + "SELECT id, entity, relation, value, valid_from, valid_to, source, confidence + FROM facts + WHERE entity = ?1 AND valid_to IS NULL + ORDER BY relation, valid_from", + )?; + let facts = stmt + .query_map(rusqlite::params![entity], parse_fact)? + .collect::, _>>() + .context("Failed to query active facts")?; + Ok(facts) + } + } + + /// Full timeline for one relation, oldest first. + pub async fn fact_timeline(&self, entity: &str, relation: &str) -> Result> { + let conn = self.conn.lock().await; + let mut stmt = conn.prepare( + "SELECT id, entity, relation, value, valid_from, valid_to, source, confidence + FROM facts + WHERE entity = ?1 AND relation = ?2 + ORDER BY valid_from ASC, created_at ASC", + )?; + let facts = stmt + .query_map(rusqlite::params![entity, relation], parse_fact)? + .collect::, _>>() + .context("Failed to load fact timeline")?; + Ok(facts) + } + + /// Substring search across fact values (ponytail: LIKE, not FTS). + pub async fn search_facts(&self, query: &str, limit: usize) -> Result> { + let conn = self.conn.lock().await; + let pattern = format!("%{query}%"); + let mut stmt = conn.prepare( + "SELECT id, entity, relation, value, valid_from, valid_to, source, confidence + FROM facts + WHERE value LIKE ?1 OR entity LIKE ?1 OR relation LIKE ?1 + ORDER BY created_at DESC + LIMIT ?2", + )?; + let facts = stmt + .query_map(rusqlite::params![pattern, limit as i64], parse_fact)? + .collect::, _>>() + .context("Failed to search facts")?; + Ok(facts) + } } fn parse_knowledge_row(row: &rusqlite::Row) -> rusqlite::Result { @@ -217,3 +448,190 @@ fn parse_knowledge_row(row: &rusqlite::Row) -> rusqlite::Result source: row.get(4)?, }) } + +fn parse_knowledge_version(row: &rusqlite::Row) -> rusqlite::Result { + Ok(KnowledgeVersion { + id: row.get(0)?, + category: row.get(1)?, + key: row.get(2)?, + old_value: row.get(3)?, + new_value: row.get(4)?, + source: row.get(5)?, + change_type: row.get(6)?, + changed_at: row.get(7)?, + }) +} + +fn parse_fact(row: &rusqlite::Row) -> rusqlite::Result { + Ok(Fact { + id: row.get(0)?, + entity: row.get(1)?, + relation: row.get(2)?, + value: row.get(3)?, + valid_from: row.get(4)?, + valid_to: row.get(5)?, + source: row.get(6)?, + confidence: row.get(7)?, + }) +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::memory::MemoryStore; + + #[tokio::test] + async fn test_knowledge_history_archives_on_update() { + let store = MemoryStore::open_in_memory().unwrap(); + store.remember("pref", "brand", "Nike", None).await.unwrap(); + store + .remember("pref", "brand", "Adidas", None) + .await + .unwrap(); + let tl = store.knowledge_timeline("pref", "brand").await.unwrap(); + assert_eq!(tl.len(), 1); + assert_eq!(tl[0].old_value.as_deref(), Some("Nike")); + assert_eq!(tl[0].new_value.as_deref(), Some("Adidas")); + assert_eq!(tl[0].change_type, "update"); + } + + #[tokio::test] + async fn test_knowledge_history_archives_on_delete() { + let store = MemoryStore::open_in_memory().unwrap(); + store.remember("pref", "x", "1", None).await.unwrap(); + assert!(store.forget("pref", "x").await.unwrap()); + let tl = store.knowledge_timeline("pref", "x").await.unwrap(); + assert_eq!(tl.len(), 1); + assert_eq!(tl[0].change_type, "delete"); + assert_eq!(tl[0].old_value.as_deref(), Some("1")); + assert!(tl[0].new_value.is_none()); + } + + #[tokio::test] + async fn test_knowledge_as_of_point_in_time() { + let store = MemoryStore::open_in_memory().unwrap(); + store.remember("pref", "brand", "Nike", None).await.unwrap(); + // before any write + assert!(store + .knowledge_as_of("pref", "brand", "2000-01-01") + .await + .unwrap() + .is_none()); + // after write (current) + assert_eq!( + store + .knowledge_as_of("pref", "brand", "9999-01-01") + .await + .unwrap() + .as_deref(), + Some("Nike") + ); + store + .remember("pref", "brand", "Adidas", None) + .await + .unwrap(); + let tl = store.knowledge_timeline("pref", "brand").await.unwrap(); + let changed = &tl[0].changed_at; + // just before the change โ†’ Nike (changed_at is second-resolution; use reverse path) + // After full reverse of the Adidas update, old is Nike. + // as_of equal to changed_at keeps the change (changed_at <= as_of means applied). + assert_eq!( + store + .knowledge_as_of("pref", "brand", changed) + .await + .unwrap() + .as_deref(), + Some("Adidas") + ); + } + + #[tokio::test] + async fn test_add_and_query_fact() { + let store = MemoryStore::open_in_memory().unwrap(); + let id = store + .add_fact(FactToAdd { + entity: "Kan".into(), + relation: "prefers".into(), + value: "Nike".into(), + valid_from: "2024-09-01".into(), + source: None, + confidence: Some(0.9), + }) + .await + .unwrap(); + assert!(!id.is_empty()); + let facts = store.query_facts("Kan", None).await.unwrap(); + assert_eq!(facts.len(), 1); + assert_eq!(facts[0].value, "Nike"); + } + + #[tokio::test] + async fn test_idempotent_add_and_auto_close() { + let store = MemoryStore::open_in_memory().unwrap(); + let a = store + .add_fact(FactToAdd { + entity: "Kan".into(), + relation: "prefers".into(), + value: "Nike".into(), + valid_from: "2024-01-01".into(), + source: None, + confidence: None, + }) + .await + .unwrap(); + let a2 = store + .add_fact(FactToAdd { + entity: "Kan".into(), + relation: "prefers".into(), + value: "Nike".into(), + valid_from: "2024-06-01".into(), + source: None, + confidence: None, + }) + .await + .unwrap(); + assert_eq!(a, a2); + let _ = store + .add_fact(FactToAdd { + entity: "Kan".into(), + relation: "prefers".into(), + value: "Adidas".into(), + valid_from: "2026-03-01".into(), + source: None, + confidence: None, + }) + .await + .unwrap(); + let active = store.query_facts("Kan", None).await.unwrap(); + assert_eq!(active.len(), 1); + assert_eq!(active[0].value, "Adidas"); + let past = store.query_facts("Kan", Some("2025-06-01")).await.unwrap(); + assert_eq!(past.len(), 1); + assert_eq!(past[0].value, "Nike"); + let tl = store.fact_timeline("Kan", "prefers").await.unwrap(); + assert_eq!(tl.len(), 2); + } + + #[tokio::test] + async fn test_close_fact() { + let store = MemoryStore::open_in_memory().unwrap(); + store + .add_fact(FactToAdd { + entity: "Kan".into(), + relation: "lives_in".into(), + value: "HK".into(), + valid_from: "2020-01-01".into(), + source: None, + confidence: None, + }) + .await + .unwrap(); + assert!(store + .close_fact("Kan", "lives_in", "2026-01-01") + .await + .unwrap()); + assert!(store.query_facts("Kan", None).await.unwrap().is_empty()); + let past = store.query_facts("Kan", Some("2025-01-01")).await.unwrap(); + assert_eq!(past[0].value, "HK"); + } +} diff --git a/src/memory/mod.rs b/src/memory/mod.rs index 5257775..64aa688 100644 --- a/src/memory/mod.rs +++ b/src/memory/mod.rs @@ -309,6 +309,60 @@ impl MemoryStore { FOREIGN KEY (task_id) REFERENCES sup_tasks(id) ); CREATE INDEX IF NOT EXISTS idx_sup_artifacts_task ON sup_artifacts(task_id, kind); + + -- Knowledge version history (auto-filled by triggers) + CREATE TABLE IF NOT EXISTS knowledge_history ( + id TEXT PRIMARY KEY, + category TEXT NOT NULL, + key TEXT NOT NULL, + old_value TEXT, + new_value TEXT, + source TEXT, + change_type TEXT NOT NULL CHECK(change_type IN ('update','delete')), + changed_at TEXT NOT NULL DEFAULT (datetime('now')) + ); + CREATE INDEX IF NOT EXISTS idx_knowledge_history_cat_key + ON knowledge_history(category, key, changed_at); + + CREATE TRIGGER IF NOT EXISTS knowledge_history_update + AFTER UPDATE ON knowledge + WHEN OLD.value IS NOT NULL AND OLD.value != NEW.value + BEGIN + INSERT INTO knowledge_history + (id, category, key, old_value, new_value, source, change_type) + VALUES ( + printf('hist_%s', lower(hex(randomblob(16)))), + OLD.category, OLD.key, OLD.value, NEW.value, NEW.source, 'update' + ); + END; + + CREATE TRIGGER IF NOT EXISTS knowledge_history_delete + AFTER DELETE ON knowledge + BEGIN + INSERT INTO knowledge_history + (id, category, key, old_value, new_value, source, change_type) + VALUES ( + printf('hist_%s', lower(hex(randomblob(16)))), + OLD.category, OLD.key, OLD.value, NULL, OLD.source, 'delete' + ); + END; + + -- Temporal facts (one active value per entity+relation) + CREATE TABLE IF NOT EXISTS facts ( + id TEXT PRIMARY KEY, + entity TEXT NOT NULL, + relation TEXT NOT NULL, + value TEXT NOT NULL, + valid_from TEXT NOT NULL, + valid_to TEXT, + source TEXT, + confidence REAL NOT NULL DEFAULT 1.0, + created_at TEXT NOT NULL DEFAULT (datetime('now')) + ); + CREATE INDEX IF NOT EXISTS idx_facts_entity_relation + ON facts(entity, relation, valid_from); + CREATE INDEX IF NOT EXISTS idx_facts_active + ON facts(entity, relation) WHERE valid_to IS NULL; ", )?; diff --git a/src/memory_tools.rs b/src/memory_tools.rs index af0b30d..bc430af 100644 --- a/src/memory_tools.rs +++ b/src/memory_tools.rs @@ -3,6 +3,7 @@ use async_trait::async_trait; use serde_json::{json, Value}; use crate::llm::{FunctionDefinition, ToolDefinition}; +use crate::memory::knowledge::FactToAdd; use crate::memory::MemoryStore; use crate::tool_registry::{ToolContext, ToolHandler, ToolResult}; @@ -66,6 +67,72 @@ impl ToolHandler for MemoryTools { }), }, }, + ToolDefinition { + tool_type: "function".to_string(), + function: FunctionDefinition { + name: "add_fact".to_string(), + description: "Record a temporal fact (entity, relation, value) with validity start. Replaces any prior active value for the same entity+relation.".to_string(), + parameters: json!({ + "type": "object", + "properties": { + "entity": { "type": "string", "description": "Subject entity (e.g. 'Kan')" }, + "relation": { "type": "string", "description": "Relation (e.g. 'prefers')" }, + "value": { "type": "string", "description": "Object value (e.g. 'Nike')" }, + "valid_from": { "type": "string", "description": "ISO date when fact became true (e.g. '2024-09-01')" }, + "source": { "type": "string", "description": "Optional provenance" }, + "confidence": { "type": "number", "description": "0.0-1.0, default 1.0" } + }, + "required": ["entity", "relation", "value", "valid_from"] + }), + }, + }, + ToolDefinition { + tool_type: "function".to_string(), + function: FunctionDefinition { + name: "query_facts".to_string(), + description: "Get facts for an entity. Omit as_of for currently active facts; pass a date for a point-in-time snapshot.".to_string(), + parameters: json!({ + "type": "object", + "properties": { + "entity": { "type": "string" }, + "as_of": { "type": "string", "description": "Optional ISO date snapshot" } + }, + "required": ["entity"] + }), + }, + }, + ToolDefinition { + tool_type: "function".to_string(), + function: FunctionDefinition { + name: "close_fact".to_string(), + description: "End the currently-active fact for an entity+relation at valid_to.".to_string(), + parameters: json!({ + "type": "object", + "properties": { + "entity": { "type": "string" }, + "relation": { "type": "string" }, + "valid_to": { "type": "string", "description": "ISO date when fact stopped being true" } + }, + "required": ["entity", "relation", "valid_to"] + }), + }, + }, + ToolDefinition { + tool_type: "function".to_string(), + function: FunctionDefinition { + name: "fact_history".to_string(), + description: "Version timeline for knowledge (category+key) or facts (entity+relation).".to_string(), + parameters: json!({ + "type": "object", + "properties": { + "category": { "type": "string", "description": "Knowledge category" }, + "key": { "type": "string", "description": "Knowledge key" }, + "entity": { "type": "string", "description": "Fact entity" }, + "relation": { "type": "string", "description": "Fact relation" } + } + }), + }, + }, ] } @@ -123,6 +190,103 @@ impl ToolHandler for MemoryTools { Ok(results.join("\n\n")) } } + "add_fact" => { + let entity = args["entity"].as_str().context("Missing entity")?; + let relation = args["relation"].as_str().context("Missing relation")?; + let value = args["value"].as_str().context("Missing value")?; + let valid_from = args["valid_from"].as_str().context("Missing valid_from")?; + let source = args["source"].as_str().map(|s| s.to_string()); + let confidence = args["confidence"].as_f64(); + match self + .memory + .add_fact(FactToAdd { + entity: entity.into(), + relation: relation.into(), + value: value.into(), + valid_from: valid_from.into(), + source, + confidence, + }) + .await + { + Ok(id) => Ok(format!( + "Fact {id}: {entity} โ€”{relation}โ†’ {value} (from {valid_from})" + )), + Err(e) => Ok(format!("Failed to add fact: {e}")), + } + } + "query_facts" => { + let entity = args["entity"].as_str().context("Missing entity")?; + let as_of = args["as_of"].as_str(); + match self.memory.query_facts(entity, as_of).await { + Ok(facts) if facts.is_empty() => Ok("No facts found.".into()), + Ok(facts) => Ok(facts + .iter() + .map(|f| { + let until = f.valid_to.as_deref().unwrap_or("โ€ฆ"); + format!( + "{} โ€”{}โ†’ {} [{}..{}] conf={}", + f.entity, f.relation, f.value, f.valid_from, until, f.confidence + ) + }) + .collect::>() + .join("\n")), + Err(e) => Ok(format!("Failed to query facts: {e}")), + } + } + "close_fact" => { + let entity = args["entity"].as_str().context("Missing entity")?; + let relation = args["relation"].as_str().context("Missing relation")?; + let valid_to = args["valid_to"].as_str().context("Missing valid_to")?; + match self.memory.close_fact(entity, relation, valid_to).await { + Ok(true) => Ok(format!("Closed {entity}.{relation} at {valid_to}")), + Ok(false) => Ok("No active fact to close.".into()), + Err(e) => Ok(format!("Failed to close fact: {e}")), + } + } + "fact_history" => { + let category = args["category"].as_str(); + let key = args["key"].as_str(); + let entity = args["entity"].as_str(); + let relation = args["relation"].as_str(); + if let (Some(cat), Some(k)) = (category, key) { + match self.memory.knowledge_timeline(cat, k).await { + Ok(versions) if versions.is_empty() => Ok("No knowledge history.".into()), + Ok(versions) => Ok(versions + .iter() + .map(|v| { + format!( + "[{}] {} โ†’ {} ({})", + v.changed_at, + v.old_value.as_deref().unwrap_or("โˆ…"), + v.new_value.as_deref().unwrap_or("โˆ…"), + v.change_type + ) + }) + .collect::>() + .join("\n")), + Err(e) => Ok(format!("Failed knowledge history: {e}")), + } + } else if let (Some(ent), Some(rel)) = (entity, relation) { + match self.memory.fact_timeline(ent, rel).await { + Ok(facts) if facts.is_empty() => Ok("No fact history.".into()), + Ok(facts) => Ok(facts + .iter() + .map(|f| { + let until = f.valid_to.as_deref().unwrap_or("โ€ฆ"); + format!( + "{} โ€”{}โ†’ {} [{}..{}]", + f.entity, f.relation, f.value, f.valid_from, until + ) + }) + .collect::>() + .join("\n")), + Err(e) => Ok(format!("Failed fact history: {e}")), + } + } else { + Ok("Provide category+key (knowledge) or entity+relation (facts).".into()) + } + } _ => anyhow::bail!("MemoryTools: unknown tool {name}"), } } diff --git a/src/platform/telegram.rs b/src/platform/telegram.rs index 99868a1..1acf512 100644 --- a/src/platform/telegram.rs +++ b/src/platform/telegram.rs @@ -290,6 +290,11 @@ pub async fn run( // Commands (like /btw) bypass per-chat serialization for true concurrency. // Regular messages keep per-chat ordering to avoid race conditions. .distribution_function(|upd: &Update| { + // Callbacks (Cancel button) must run concurrent with the in-flight + // message handler โ€” chat-keying them queues cancel behind execute_command. + if matches!(upd.kind, UpdateKind::CallbackQuery(_)) { + return None; + } let is_cmd = match &upd.kind { UpdateKind::Message(m) | UpdateKind::EditedMessage(m) From 594d81166f67b23633f8d1339bda0f9c1c0582f4 Mon Sep 17 00:00:00 2001 From: "chinkan.ai" Date: Fri, 11 Sep 2026 00:20:23 +0800 Subject: [PATCH 02/13] ci: add opencode GitHub Action for /oc comments Trigger anomalyco/opencode on issue and PR review comments starting with /oc or /opencode. --- .github/workflows/opencode.yml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 .github/workflows/opencode.yml diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml new file mode 100644 index 0000000..4342c70 --- /dev/null +++ b/.github/workflows/opencode.yml @@ -0,0 +1,33 @@ +name: opencode + +on: + issue_comment: + types: [created] + pull_request_review_comment: + types: [created] + +jobs: + opencode: + if: | + contains(github.event.comment.body, ' /oc') || + startsWith(github.event.comment.body, '/oc') || + contains(github.event.comment.body, ' /opencode') || + startsWith(github.event.comment.body, '/opencode') + runs-on: ubuntu-latest + permissions: + id-token: write + contents: read + pull-requests: read + issues: read + steps: + - name: Checkout repository + uses: actions/checkout@v6 + with: + persist-credentials: false + + - name: Run opencode + uses: anomalyco/opencode/github@latest + env: + OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} + with: + model: opencode-go/qwen3.8-flash \ No newline at end of file From 61c680c17819240331779fa2f971d7b2cd84d713 Mon Sep 17 00:00:00 2001 From: "chinkan.ai" Date: Fri, 11 Sep 2026 00:24:38 +0800 Subject: [PATCH 03/13] ci: auto opencode review on pull_request events Runs opencode on opened/synchronize/reopened/ready_for_review without needing /oc. --- .github/workflows/opencode-review.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/opencode-review.yml diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml new file mode 100644 index 0000000..b543eb6 --- /dev/null +++ b/.github/workflows/opencode-review.yml @@ -0,0 +1,26 @@ +name: opencode-review + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + +jobs: + review: + runs-on: ubuntu-latest + permissions: + id-token: write + contents: read + pull-requests: read + issues: read + steps: + - name: Checkout repository + uses: actions/checkout@v6 + with: + persist-credentials: false + + - name: Run opencode review + uses: anomalyco/opencode/github@latest + env: + OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} + with: + model: opencode-go/qwen3.8-flash From 4406413ea97bd3e5e847fea2c2e790ae63e1a7e4 Mon Sep 17 00:00:00 2001 From: "chinkan.ai" Date: Fri, 11 Sep 2026 07:50:05 +0800 Subject: [PATCH 04/13] fix: address PR #54 review findings - Register cancel before showing Cancel button (race under concurrent callbacks) - Include partial stdout/stderr on timeout/cancel for the LLM - UNIQUE one-active fact index; backfill inserts without inverted windows - Normalize date-only timestamps for as_of / valid_from compares - Expose knowledge_as_of via fact_history(category,key,as_of) - Drop unused search_facts; supervisor shell respects job.timeout_secs - opencode workflows: write perms, checkout@v4; ADR wording (valid-time) --- .github/workflows/opencode-review.yml | 6 +- .github/workflows/opencode.yml | 8 +- ...04-temporal-facts-and-knowledge-history.md | 2 +- src/command_tool.rs | 18 +- src/memory/knowledge.rs | 163 ++++++++++++++---- src/memory/mod.rs | 3 +- src/memory_tools.rs | 14 +- src/supervisor/backend/shell.rs | 31 +++- 8 files changed, 194 insertions(+), 51 deletions(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index b543eb6..0926b38 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -10,11 +10,11 @@ jobs: permissions: id-token: write contents: read - pull-requests: read - issues: read + pull-requests: write + issues: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v4 with: persist-credentials: false diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml index 4342c70..956ff11 100644 --- a/.github/workflows/opencode.yml +++ b/.github/workflows/opencode.yml @@ -17,11 +17,11 @@ jobs: permissions: id-token: write contents: read - pull-requests: read - issues: read + pull-requests: write + issues: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v4 with: persist-credentials: false @@ -30,4 +30,4 @@ jobs: env: OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} with: - model: opencode-go/qwen3.8-flash \ No newline at end of file + model: opencode-go/qwen3.8-flash diff --git a/docs/adr/0004-temporal-facts-and-knowledge-history.md b/docs/adr/0004-temporal-facts-and-knowledge-history.md index 72732e0..163b3a6 100644 --- a/docs/adr/0004-temporal-facts-and-knowledge-history.md +++ b/docs/adr/0004-temporal-facts-and-knowledge-history.md @@ -1,3 +1,3 @@ # Temporal Facts and Knowledge History -Memory gains two layers: Knowledge History (auto-archive on `remember`/`forget` via SQLite triggers) and Facts (explicit bi-temporal triples). Knowledge stays the live KV snapshot; Facts carry validity windows. Schema uses `entity`/`relation`/`value`/`valid_from`/`valid_to` (not subject/object_value/valid_until). One active Fact per `(entity, relation)`; new value auto-closes the prior active row. No agent-loop changes in this phase โ€” data layer + MCP tools only. Agentic RAG and harness evolution deferred to separate issues. +Memory gains two layers: Knowledge History (auto-archive on `remember`/`forget` via SQLite triggers) and Facts (valid-time triples with `valid_from`/`valid_to`; `created_at` is audit only). Knowledge stays the live KV snapshot. Schema uses `entity`/`relation`/`value`/`valid_from`/`valid_to`. One active Fact per `(entity, relation)` (UNIQUE partial index); superseding values close the prior row; backdated inserts close against the active start without inverting windows. No agent-loop changes in this phase โ€” data layer + MCP tools only. Agentic RAG and harness evolution deferred to separate issues. diff --git a/src/command_tool.rs b/src/command_tool.rs index cb5df2c..7f227de 100644 --- a/src/command_tool.rs +++ b/src/command_tool.rs @@ -93,6 +93,12 @@ impl CommandTool { let escaped_cmd = crate::utils::telegram_markdown::escape_text(command); + // Register cancel before showing the button so concurrent callbacks never miss. + let (cancel_tx, cancel_rx) = tokio::sync::oneshot::channel::<()>(); + self.cancel_registry + .register(cmd_id.clone(), cancel_tx) + .await; + // Verbose: cancel button + live output + final result // Minimal: cancel button (simple text) + no live output, delete on finish // Silent: no message at all (tool_notifier handles nothing) @@ -117,11 +123,6 @@ impl CommandTool { ToolUiMode::Silent => (None, SendMode::Silent), }; - let (cancel_tx, cancel_rx) = tokio::sync::oneshot::channel::<()>(); - self.cancel_registry - .register(cmd_id.clone(), cancel_tx) - .await; - let (output_tx, mut output_rx) = tokio::sync::mpsc::channel::(256); let output_tx2 = output_tx.clone(); let mut child_stdout = child.stdout.take(); @@ -251,11 +252,16 @@ impl CommandTool { SendMode::Silent => {} } } - if timed_out { + let mut msg = if timed_out { format!("โš ๏ธ Command timed out after {}s", timeout_secs) } else { "โš ๏ธ User cancelled the command".to_string() + }; + if !output_buffer.is_empty() { + msg.push('\n'); + msg.push_str(output_buffer.trim_end()); } + msg } else if let Some(code) = exit_code { if let Some(mid) = &msg_id { match send_mode { diff --git a/src/memory/knowledge.rs b/src/memory/knowledge.rs index 780f4cb..b662fc7 100644 --- a/src/memory/knowledge.rs +++ b/src/memory/knowledge.rs @@ -271,6 +271,7 @@ impl MemoryStore { key: &str, as_of: &str, ) -> Result> { + let as_of = normalize_as_of(as_of); let conn = self.conn.lock().await; let current: Option<(String, String)> = conn @@ -295,7 +296,7 @@ impl MemoryStore { // Reverse-apply changes newer than as_of onto the live value. let mut val = current.as_ref().map(|(v, _)| v.clone()); for h in &history { - if h.changed_at.as_str() <= as_of { + if normalize_ts(&h.changed_at).as_str() <= as_of.as_str() { break; } val = h.old_value.clone(); @@ -303,12 +304,16 @@ impl MemoryStore { // Before first create and no residual history โ†’ absent. if let Some((_, ref created_at)) = current { - if as_of < created_at.as_str() && history.is_empty() { + let created = normalize_ts(created_at); + if as_of.as_str() < created.as_str() && history.is_empty() { return Ok(None); } - if as_of < created_at.as_str() { - let earliest = history.iter().map(|h| h.changed_at.as_str()).min(); - if earliest.is_none_or(|e| as_of < e) { + if as_of.as_str() < created.as_str() { + let earliest = history.iter().map(|h| normalize_ts(&h.changed_at)).min(); + if earliest + .as_ref() + .is_none_or(|e| as_of.as_str() < e.as_str()) + { return Ok(None); } } @@ -318,9 +323,11 @@ impl MemoryStore { } /// Insert fact; skip if identical active exists. Auto-closes prior active for pair. + /// Backdated inserts (valid_from before active start) land as closed history rows. pub async fn add_fact(&self, fact: FactToAdd) -> Result { let conn = self.conn.lock().await; let confidence = fact.confidence.unwrap_or(1.0); + let valid_from = normalize_from(&fact.valid_from); let existing: Option = conn .query_row( @@ -334,14 +341,48 @@ impl MemoryStore { return Ok(id); } - conn.execute( - "UPDATE facts SET valid_to = ?1 - WHERE entity = ?2 AND relation = ?3 AND valid_to IS NULL", - rusqlite::params![&fact.valid_from, &fact.entity, &fact.relation], - ) - .context("Failed to close prior active fact")?; + let active_from: Option = conn + .query_row( + "SELECT valid_from FROM facts + WHERE entity = ?1 AND relation = ?2 AND valid_to IS NULL", + rusqlite::params![&fact.entity, &fact.relation], + |row| row.get(0), + ) + .ok(); let id = Uuid::new_v4().to_string(); + + if let Some(ref active_vf) = active_from { + let active_vf_n = normalize_from(active_vf); + if valid_from.as_str() < active_vf_n.as_str() { + // Historical backfill: closed against active start; leave active alone. + conn.execute( + "INSERT INTO facts + (id, entity, relation, value, valid_from, valid_to, source, confidence) + VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)", + rusqlite::params![ + &id, + &fact.entity, + &fact.relation, + &fact.value, + &valid_from, + &active_vf_n, + &fact.source, + confidence + ], + ) + .context("Failed to insert historical fact")?; + return Ok(id); + } + + conn.execute( + "UPDATE facts SET valid_to = ?1 + WHERE entity = ?2 AND relation = ?3 AND valid_to IS NULL", + rusqlite::params![&valid_from, &fact.entity, &fact.relation], + ) + .context("Failed to close prior active fact")?; + } + conn.execute( "INSERT INTO facts (id, entity, relation, value, valid_from, source, confidence) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)", @@ -350,7 +391,7 @@ impl MemoryStore { &fact.entity, &fact.relation, &fact.value, - &fact.valid_from, + &valid_from, &fact.source, confidence ], @@ -361,12 +402,14 @@ impl MemoryStore { /// End currently-active fact for (entity, relation). pub async fn close_fact(&self, entity: &str, relation: &str, valid_to: &str) -> Result { + let valid_to = normalize_from(valid_to); let conn = self.conn.lock().await; let rows = conn .execute( "UPDATE facts SET valid_to = ?1 - WHERE entity = ?2 AND relation = ?3 AND valid_to IS NULL", - rusqlite::params![valid_to, entity, relation], + WHERE entity = ?2 AND relation = ?3 AND valid_to IS NULL + AND valid_from <= ?1", + rusqlite::params![&valid_to, entity, relation], ) .context("Failed to close fact")?; Ok(rows > 0) @@ -376,6 +419,7 @@ impl MemoryStore { pub async fn query_facts(&self, entity: &str, as_of: Option<&str>) -> Result> { let conn = self.conn.lock().await; if let Some(as_of) = as_of { + let as_of = normalize_as_of(as_of); let mut stmt = conn.prepare( "SELECT id, entity, relation, value, valid_from, valid_to, source, confidence FROM facts @@ -419,26 +463,41 @@ impl MemoryStore { .context("Failed to load fact timeline")?; Ok(facts) } +} - /// Substring search across fact values (ponytail: LIKE, not FTS). - pub async fn search_facts(&self, query: &str, limit: usize) -> Result> { - let conn = self.conn.lock().await; - let pattern = format!("%{query}%"); - let mut stmt = conn.prepare( - "SELECT id, entity, relation, value, valid_from, valid_to, source, confidence - FROM facts - WHERE value LIKE ?1 OR entity LIKE ?1 OR relation LIKE ?1 - ORDER BY created_at DESC - LIMIT ?2", - )?; - let facts = stmt - .query_map(rusqlite::params![pattern, limit as i64], parse_fact)? - .collect::, _>>() - .context("Failed to search facts")?; - Ok(facts) +/// Date-only `YYYY-MM-DD` โ†’ start of day for lower bounds / stored from. +fn normalize_from(ts: &str) -> String { + if is_date_only(ts) { + format!("{ts} 00:00:00") + } else { + ts.to_string() } } +/// Date-only `YYYY-MM-DD` โ†’ end of day so "as of that day" includes the whole day. +fn normalize_as_of(ts: &str) -> String { + if is_date_only(ts) { + format!("{ts} 23:59:59") + } else { + ts.to_string() + } +} + +fn normalize_ts(ts: &str) -> String { + if is_date_only(ts) { + format!("{ts} 00:00:00") + } else { + ts.to_string() + } +} + +fn is_date_only(ts: &str) -> bool { + ts.len() == 10 + && ts.as_bytes().get(4) == Some(&b'-') + && ts.as_bytes().get(7) == Some(&b'-') + && ts.bytes().all(|b| b.is_ascii_digit() || b == b'-') +} + fn parse_knowledge_row(row: &rusqlite::Row) -> rusqlite::Result { Ok(KnowledgeEntry { id: row.get(0)?, @@ -634,4 +693,48 @@ mod tests { let past = store.query_facts("Kan", Some("2025-01-01")).await.unwrap(); assert_eq!(past[0].value, "HK"); } + + #[tokio::test] + async fn test_add_fact_backfill_no_invert() { + let store = MemoryStore::open_in_memory().unwrap(); + store + .add_fact(FactToAdd { + entity: "Kan".into(), + relation: "prefers".into(), + value: "Adidas".into(), + valid_from: "2026-01-01".into(), + source: None, + confidence: None, + }) + .await + .unwrap(); + store + .add_fact(FactToAdd { + entity: "Kan".into(), + relation: "prefers".into(), + value: "Nike".into(), + valid_from: "2024-01-01".into(), + source: None, + confidence: None, + }) + .await + .unwrap(); + let active = store.query_facts("Kan", None).await.unwrap(); + assert_eq!(active.len(), 1); + assert_eq!(active[0].value, "Adidas"); + let past = store.query_facts("Kan", Some("2025-06-01")).await.unwrap(); + assert_eq!(past.len(), 1); + assert_eq!(past[0].value, "Nike"); + assert!(past[0].valid_to.is_some()); + } + + #[test] + fn test_date_only_normalize() { + assert_eq!(normalize_as_of("2025-06-01"), "2025-06-01 23:59:59"); + assert_eq!(normalize_from("2025-06-01"), "2025-06-01 00:00:00"); + assert_eq!( + normalize_as_of("2025-06-01 12:00:00"), + "2025-06-01 12:00:00" + ); + } } diff --git a/src/memory/mod.rs b/src/memory/mod.rs index 64aa688..714a8c2 100644 --- a/src/memory/mod.rs +++ b/src/memory/mod.rs @@ -361,7 +361,8 @@ impl MemoryStore { ); CREATE INDEX IF NOT EXISTS idx_facts_entity_relation ON facts(entity, relation, valid_from); - CREATE INDEX IF NOT EXISTS idx_facts_active + -- Enforce one active value per (entity, relation). + CREATE UNIQUE INDEX IF NOT EXISTS idx_facts_one_active ON facts(entity, relation) WHERE valid_to IS NULL; ", )?; diff --git a/src/memory_tools.rs b/src/memory_tools.rs index bc430af..670ae7a 100644 --- a/src/memory_tools.rs +++ b/src/memory_tools.rs @@ -121,14 +121,15 @@ impl ToolHandler for MemoryTools { tool_type: "function".to_string(), function: FunctionDefinition { name: "fact_history".to_string(), - description: "Version timeline for knowledge (category+key) or facts (entity+relation).".to_string(), + description: "Version timeline for knowledge (category+key) or facts (entity+relation). With category+key+as_of, returns knowledge value at that time.".to_string(), parameters: json!({ "type": "object", "properties": { "category": { "type": "string", "description": "Knowledge category" }, "key": { "type": "string", "description": "Knowledge key" }, "entity": { "type": "string", "description": "Fact entity" }, - "relation": { "type": "string", "description": "Fact relation" } + "relation": { "type": "string", "description": "Fact relation" }, + "as_of": { "type": "string", "description": "Optional ISO date; with category+key returns knowledge_as_of" } } }), }, @@ -249,7 +250,14 @@ impl ToolHandler for MemoryTools { let key = args["key"].as_str(); let entity = args["entity"].as_str(); let relation = args["relation"].as_str(); - if let (Some(cat), Some(k)) = (category, key) { + let as_of = args["as_of"].as_str(); + if let (Some(cat), Some(k), Some(as_of)) = (category, key, as_of) { + match self.memory.knowledge_as_of(cat, k, as_of).await { + Ok(Some(v)) => Ok(format!("[{cat}/{k}] as of {as_of}: {v}")), + Ok(None) => Ok(format!("No value for [{cat}/{k}] as of {as_of}")), + Err(e) => Ok(format!("Failed knowledge_as_of: {e}")), + } + } else if let (Some(cat), Some(k)) = (category, key) { match self.memory.knowledge_timeline(cat, k).await { Ok(versions) if versions.is_empty() => Ok("No knowledge history.".into()), Ok(versions) => Ok(versions diff --git a/src/supervisor/backend/shell.rs b/src/supervisor/backend/shell.rs index 883adcb..7db3f6f 100644 --- a/src/supervisor/backend/shell.rs +++ b/src/supervisor/backend/shell.rs @@ -58,12 +58,37 @@ impl Backend for ShellBackend { next_step: None, }); } - let output = Command::new("sh") + let timeout = std::time::Duration::from_secs(job.timeout_secs); + let run = Command::new("sh") .arg("-c") .arg(&cmd) .current_dir(&self.sandbox) - .output() - .await?; + .output(); + let output = match tokio::time::timeout(timeout, run).await { + Ok(Ok(o)) => o, + Ok(Err(e)) => { + job.status = JobStatus::Failed; + return Ok(JobOutput { + status: JobStatus::Failed, + summary: String::new(), + evidence: vec![], + errors: vec![format!("command failed: {e}")], + changed_files: vec![], + next_step: None, + }); + } + Err(_) => { + job.status = JobStatus::Failed; + return Ok(JobOutput { + status: JobStatus::Failed, + summary: String::new(), + evidence: vec![], + errors: vec![format!("timed out after {}s", job.timeout_secs)], + changed_files: vec![], + next_step: None, + }); + } + }; let exit = output.status.code().unwrap_or(-1); let stdout = String::from_utf8_lossy(&output.stdout).into_owned(); let stderr = String::from_utf8_lossy(&output.stderr).into_owned(); From a07e334212cdc34d0291cde31566fc52de5c7551 Mon Sep 17 00:00:00 2001 From: "chinkan.ai" Date: Fri, 11 Sep 2026 20:19:14 +0800 Subject: [PATCH 05/13] fix: remaining PR #54 re-review findings - Wire ShellBackend to sandbox.execute_timeout_secs (min with job timeout) - Kill process group on supervisor shell timeout (same as CommandTool) - Collapse normalize helpers; support ISO-8601 T timestamps - Dedupe active facts before UNIQUE index (safe re-migration) - JobOutput::failed helper; update CLAUDE.md Testing section --- CLAUDE.md | 6 +- src/main.rs | 1 + src/memory/knowledge.rs | 46 +++++---- src/memory/mod.rs | 24 ++++- src/supervisor/backend/shell.rs | 172 ++++++++++++++++++++++++-------- src/supervisor/job.rs | 13 +++ 6 files changed, 194 insertions(+), 68 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index c6bdf3e..0027fff 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -141,11 +141,7 @@ All jobs use `dtolnay/rust-toolchain@stable` and `Swatinem/rust-cache@v2` for ca ## Testing -No automated tests exist yet. When adding tests: - -- Place unit tests in `#[cfg(test)] mod tests` blocks within each source file -- Integration tests go in a top-level `tests/` directory -- The sandbox path validation logic in `tools.rs` and message splitting in `bot.rs` are good candidates for unit tests +Unit tests live in `#[cfg(test)] mod tests` within source files; integration tests in top-level `tests/`. Run `cargo test` (and `cargo clippy -- -D warnings`) before opening a PR. Memory knowledge/history/facts and supervisor backends already have unit coverage โ€” extend those patterns when adding behavior. ## Common Tasks diff --git a/src/main.rs b/src/main.rs index 5792d4e..81c9596 100644 --- a/src/main.rs +++ b/src/main.rs @@ -424,6 +424,7 @@ async fn main() -> Result<()> { sup_registry.register(std::sync::Arc::new( rustfox::supervisor::backend::shell::ShellBackend::new( config.sandbox.allowed_directory.clone(), + config.sandbox.execute_timeout_secs, ), )); diff --git a/src/memory/knowledge.rs b/src/memory/knowledge.rs index b662fc7..3a3b32e 100644 --- a/src/memory/knowledge.rs +++ b/src/memory/knowledge.rs @@ -296,7 +296,7 @@ impl MemoryStore { // Reverse-apply changes newer than as_of onto the live value. let mut val = current.as_ref().map(|(v, _)| v.clone()); for h in &history { - if normalize_ts(&h.changed_at).as_str() <= as_of.as_str() { + if normalize_from(&h.changed_at).as_str() <= as_of.as_str() { break; } val = h.old_value.clone(); @@ -304,12 +304,12 @@ impl MemoryStore { // Before first create and no residual history โ†’ absent. if let Some((_, ref created_at)) = current { - let created = normalize_ts(created_at); + let created = normalize_from(created_at); if as_of.as_str() < created.as_str() && history.is_empty() { return Ok(None); } if as_of.as_str() < created.as_str() { - let earliest = history.iter().map(|h| normalize_ts(&h.changed_at)).min(); + let earliest = history.iter().map(|h| normalize_from(&h.changed_at)).min(); if earliest .as_ref() .is_none_or(|e| as_of.as_str() < e.as_str()) @@ -465,30 +465,31 @@ impl MemoryStore { } } -/// Date-only `YYYY-MM-DD` โ†’ start of day for lower bounds / stored from. +/// Canonicalize timestamps for lexicographic compare with SQLite `datetime('now')`. +/// - `YYYY-MM-DD` โ†’ start of day +/// - `YYYY-MM-DDTHH:MM:SSโ€ฆ` โ†’ space separator (ISO-8601 โ†’ SQLite style) fn normalize_from(ts: &str) -> String { + let ts = ts.trim(); if is_date_only(ts) { - format!("{ts} 00:00:00") - } else { - ts.to_string() + return format!("{ts} 00:00:00"); } -} - -/// Date-only `YYYY-MM-DD` โ†’ end of day so "as of that day" includes the whole day. -fn normalize_as_of(ts: &str) -> String { - if is_date_only(ts) { - format!("{ts} 23:59:59") - } else { - ts.to_string() + if let Some((date, rest)) = ts.split_once('T') { + if is_date_only(date) { + let time = rest.split(['+', 'Z']).next().unwrap_or(rest); + let time = if time.len() >= 8 { &time[..8] } else { time }; + return format!("{date} {time}"); + } } + ts.to_string() } -fn normalize_ts(ts: &str) -> String { +/// Date-only โ†’ end of day so "as of that day" includes the whole day. +fn normalize_as_of(ts: &str) -> String { + let ts = ts.trim(); if is_date_only(ts) { - format!("{ts} 00:00:00") - } else { - ts.to_string() + return format!("{ts} 23:59:59"); } + normalize_from(ts) } fn is_date_only(ts: &str) -> bool { @@ -732,8 +733,13 @@ mod tests { fn test_date_only_normalize() { assert_eq!(normalize_as_of("2025-06-01"), "2025-06-01 23:59:59"); assert_eq!(normalize_from("2025-06-01"), "2025-06-01 00:00:00"); + assert_eq!(normalize_from("2025-06-01 12:00:00"), "2025-06-01 12:00:00"); + assert_eq!( + normalize_from("2025-06-01T12:00:00Z"), + "2025-06-01 12:00:00" + ); assert_eq!( - normalize_as_of("2025-06-01 12:00:00"), + normalize_from("2025-06-01T12:00:00+08:00"), "2025-06-01 12:00:00" ); } diff --git a/src/memory/mod.rs b/src/memory/mod.rs index 714a8c2..f3539cd 100644 --- a/src/memory/mod.rs +++ b/src/memory/mod.rs @@ -361,11 +361,31 @@ impl MemoryStore { ); CREATE INDEX IF NOT EXISTS idx_facts_entity_relation ON facts(entity, relation, valid_from); - -- Enforce one active value per (entity, relation). + ", + )?; + + // Close duplicate active facts (keep newest created_at) before UNIQUE index. + // Safe on fresh DBs (0 rows) and on DBs from intermediate non-unique builds. + conn.execute_batch( + " + UPDATE facts SET valid_to = valid_from + WHERE rowid IN ( + SELECT f.rowid + FROM facts f + INNER JOIN ( + SELECT entity, relation, MAX(created_at) AS mx + FROM facts + WHERE valid_to IS NULL + GROUP BY entity, relation + HAVING COUNT(*) > 1 + ) d ON f.entity = d.entity AND f.relation = d.relation + WHERE f.valid_to IS NULL AND f.created_at < d.mx + ); CREATE UNIQUE INDEX IF NOT EXISTS idx_facts_one_active ON facts(entity, relation) WHERE valid_to IS NULL; ", - )?; + ) + .context("facts one-active index migration")?; // Migration: add is_summarized column (safe no-op if column already exists) conn.execute_batch("ALTER TABLE messages ADD COLUMN is_summarized BOOLEAN DEFAULT 0;") diff --git a/src/supervisor/backend/shell.rs b/src/supervisor/backend/shell.rs index 7db3f6f..afec27b 100644 --- a/src/supervisor/backend/shell.rs +++ b/src/supervisor/backend/shell.rs @@ -1,5 +1,7 @@ use anyhow::Result; use std::path::PathBuf; +use std::time::Duration; +use tokio::io::AsyncReadExt; use tokio::process::Command; use crate::supervisor::backend::{Backend, BackendCapabilities, RunContext}; @@ -7,11 +9,25 @@ use crate::supervisor::job::{Evidence, Job, JobOutput, JobStatus, JobType}; pub struct ShellBackend { sandbox: PathBuf, + /// From `sandbox.execute_timeout_secs`. 0 = no sandbox cap (job.timeout_secs only). + execute_timeout_secs: u64, } impl ShellBackend { - pub fn new(sandbox: PathBuf) -> Self { - Self { sandbox } + pub fn new(sandbox: PathBuf, execute_timeout_secs: u64) -> Self { + Self { + sandbox, + execute_timeout_secs, + } + } + + /// Tighter of job deadline and sandbox wall-clock. 0 sandbox = job only. + fn effective_timeout_secs(&self, job_timeout_secs: u64) -> u64 { + match self.execute_timeout_secs { + 0 => job_timeout_secs, + n if job_timeout_secs == 0 => n, + n => n.min(job_timeout_secs), + } } // TODO(security, M2.5): naive validation โ€” only catches obvious `cd /โ€ฆ`, @@ -29,6 +45,32 @@ impl ShellBackend { } true } + + async fn kill_child(child: &mut tokio::process::Child) { + #[cfg(unix)] + if let Some(pid) = child.id() { + let _ = nix::sys::signal::killpg( + nix::unistd::Pid::from_raw(pid as i32), + nix::sys::signal::Signal::SIGKILL, + ); + } + let _ = child.kill().await; + let _ = child.wait().await; + } + + async fn drain(stream: &mut Option) -> String { + let mut out = String::new(); + let mut buf = vec![0u8; 4096]; + if let Some(s) = stream.as_mut() { + loop { + match s.read(&mut buf).await { + Ok(0) | Err(_) => break, + Ok(n) => out.push_str(&String::from_utf8_lossy(&buf[..n])), + } + } + } + out + } } #[async_trait::async_trait] @@ -49,50 +91,70 @@ impl Backend for ShellBackend { let cmd = job.prompt.clone().unwrap_or_else(|| job.goal.clone()); if !self.validate(&cmd) { job.status = JobStatus::Failed; - return Ok(JobOutput { - status: JobStatus::Failed, - summary: String::new(), - evidence: vec![], - errors: vec!["sandbox-violation: cd outside sandbox".into()], - changed_files: vec![], - next_step: None, - }); + return Ok(JobOutput::failed(vec![ + "sandbox-violation: cd outside sandbox".into(), + ])); } - let timeout = std::time::Duration::from_secs(job.timeout_secs); - let run = Command::new("sh") + + let timeout_secs = self.effective_timeout_secs(job.timeout_secs); + let mut command = Command::new("sh"); + command .arg("-c") .arg(&cmd) .current_dir(&self.sandbox) - .output(); - let output = match tokio::time::timeout(timeout, run).await { - Ok(Ok(o)) => o, - Ok(Err(e)) => { + .stdout(std::process::Stdio::piped()) + .stderr(std::process::Stdio::piped()); + #[cfg(unix)] + command.process_group(0); + + let mut child = match command.spawn() { + Ok(c) => c, + Err(e) => { job.status = JobStatus::Failed; - return Ok(JobOutput { - status: JobStatus::Failed, - summary: String::new(), - evidence: vec![], - errors: vec![format!("command failed: {e}")], - changed_files: vec![], - next_step: None, - }); + return Ok(JobOutput::failed(vec![format!("command failed: {e}")])); } - Err(_) => { - job.status = JobStatus::Failed; - return Ok(JobOutput { - status: JobStatus::Failed, - summary: String::new(), - evidence: vec![], - errors: vec![format!("timed out after {}s", job.timeout_secs)], - changed_files: vec![], - next_step: None, - }); + }; + + let mut stdout_pipe = child.stdout.take(); + let mut stderr_pipe = child.stderr.take(); + let timeout_fut = async { + if timeout_secs == 0 { + std::future::pending::<()>().await; + } else { + tokio::time::sleep(Duration::from_secs(timeout_secs)).await; } }; - let exit = output.status.code().unwrap_or(-1); - let stdout = String::from_utf8_lossy(&output.stdout).into_owned(); - let stderr = String::from_utf8_lossy(&output.stderr).into_owned(); - let status = if output.status.success() { + tokio::pin!(timeout_fut); + + let timed_out; + let exit_code; + tokio::select! { + status = child.wait() => { + timed_out = false; + exit_code = status.map(|s| s.code().unwrap_or(-1)).unwrap_or(-1); + } + _ = &mut timeout_fut => { + timed_out = true; + exit_code = -1; + Self::kill_child(&mut child).await; + } + } + + let stdout = Self::drain(&mut stdout_pipe).await; + let stderr = Self::drain(&mut stderr_pipe).await; + + if timed_out { + job.status = JobStatus::Failed; + let mut errors = vec![format!("timed out after {timeout_secs}s")]; + if !stderr.is_empty() { + errors.push(stderr); + } + let mut out = JobOutput::failed(errors); + out.summary = stdout.trim().to_string(); + return Ok(out); + } + + let status = if exit_code == 0 { JobStatus::Succeeded } else { JobStatus::Failed @@ -101,7 +163,7 @@ impl Backend for ShellBackend { Ok(JobOutput { status, summary: stdout.trim().to_string(), - evidence: vec![Evidence::ExitCode { code: exit }], + evidence: vec![Evidence::ExitCode { code: exit_code }], errors: if stderr.is_empty() { vec![] } else { @@ -120,7 +182,7 @@ mod tests { #[tokio::test] async fn shell_backend_runs_echo_in_sandbox() { let dir = tempfile::tempdir().unwrap(); - let b = ShellBackend::new(dir.path().into()); + let b = ShellBackend::new(dir.path().into(), 90); let mut job = crate::supervisor::job::Job::new( "t", crate::supervisor::job::JobType::ShellJob, @@ -143,7 +205,7 @@ mod tests { #[tokio::test] async fn shell_backend_rejects_command_escaping_sandbox() { let dir = tempfile::tempdir().unwrap(); - let b = ShellBackend::new(dir.path().into()); + let b = ShellBackend::new(dir.path().into(), 90); let mut job = crate::supervisor::job::Job::new( "t", crate::supervisor::job::JobType::ShellJob, @@ -157,4 +219,32 @@ mod tests { crate::supervisor::job::JobStatus::Failed )); } + + #[tokio::test] + async fn shell_backend_timeout_kills_and_respects_config() { + let dir = tempfile::tempdir().unwrap(); + let b = ShellBackend::new(dir.path().into(), 1); + let mut job = crate::supervisor::job::Job::new( + "t", + crate::supervisor::job::JobType::ShellJob, + "shell", + "sleep 30", + ); + job.prompt = Some("sleep 30".into()); + job.timeout_secs = 600; + let start = std::time::Instant::now(); + let out = b.run(&mut job, &RunContext::new()).await.unwrap(); + assert!(start.elapsed() < Duration::from_secs(5)); + assert!(matches!(out.status, JobStatus::Failed)); + assert!(out.errors.iter().any(|e| e.contains("timed out"))); + } + + #[test] + fn effective_timeout_picks_tighter_cap() { + let b = ShellBackend::new(PathBuf::from("/tmp"), 90); + assert_eq!(b.effective_timeout_secs(600), 90); + assert_eq!(b.effective_timeout_secs(30), 30); + let unlimited = ShellBackend::new(PathBuf::from("/tmp"), 0); + assert_eq!(unlimited.effective_timeout_secs(600), 600); + } } diff --git a/src/supervisor/job.rs b/src/supervisor/job.rs index 4ed8514..3c7a8e2 100644 --- a/src/supervisor/job.rs +++ b/src/supervisor/job.rs @@ -55,6 +55,19 @@ pub struct JobOutput { pub next_step: Option, } +impl JobOutput { + pub fn failed(errors: Vec) -> Self { + Self { + status: JobStatus::Failed, + summary: String::new(), + evidence: vec![], + errors, + changed_files: vec![], + next_step: None, + } + } +} + #[derive(Debug, Clone, Serialize, Deserialize)] pub struct Job { pub id: String, From c8a8af7ca7a3f6ab6607bb716321fbe31e2e4078 Mon Sep 17 00:00:00 2001 From: "chinkan.ai" Date: Fri, 11 Sep 2026 20:48:31 +0800 Subject: [PATCH 06/13] fix: shell pipe deadlock, shared kill, UTC normalize, dedupe tiebreak - Drain stdout/stderr concurrently while waiting (fixes large-output hang) - Shared utils::process::{kill_child, optional_timeout}; warn on kill failure - Dedupe active facts by max(rowid) before UNIQUE index (same-second safe) - normalize timestamps via chrono to UTC; Fact Display; ADR gap note --- ...04-temporal-facts-and-knowledge-history.md | 2 +- src/command_tool.rs | 24 +---- src/memory/knowledge.rs | 40 ++++++--- src/memory/mod.rs | 23 ++--- src/memory_tools.rs | 16 +--- src/supervisor/backend/shell.rs | 90 ++++++++++++------- src/utils/mod.rs | 1 + src/utils/process.rs | 31 +++++++ 8 files changed, 131 insertions(+), 96 deletions(-) create mode 100644 src/utils/process.rs diff --git a/docs/adr/0004-temporal-facts-and-knowledge-history.md b/docs/adr/0004-temporal-facts-and-knowledge-history.md index 163b3a6..9abc9df 100644 --- a/docs/adr/0004-temporal-facts-and-knowledge-history.md +++ b/docs/adr/0004-temporal-facts-and-knowledge-history.md @@ -1,3 +1,3 @@ # Temporal Facts and Knowledge History -Memory gains two layers: Knowledge History (auto-archive on `remember`/`forget` via SQLite triggers) and Facts (valid-time triples with `valid_from`/`valid_to`; `created_at` is audit only). Knowledge stays the live KV snapshot. Schema uses `entity`/`relation`/`value`/`valid_from`/`valid_to`. One active Fact per `(entity, relation)` (UNIQUE partial index); superseding values close the prior row; backdated inserts close against the active start without inverting windows. No agent-loop changes in this phase โ€” data layer + MCP tools only. Agentic RAG and harness evolution deferred to separate issues. +Memory gains two layers: Knowledge History (auto-archive on `remember`/`forget` via SQLite triggers) and Facts (valid-time triples with `valid_from`/`valid_to`; `created_at` is audit only). Knowledge stays the live KV snapshot. Schema uses `entity`/`relation`/`value`/`valid_from`/`valid_to`. One active Fact per `(entity, relation)` (UNIQUE partial index); superseding values close the prior row; backdated inserts close against the active start without inverting windows. Timestamps normalize to UTC `YYYY-MM-DD HH:MM:SS` for compare with SQLite `datetime('now')`. `knowledge_as_of` reverse-applies history from the live row โ€” a deleteโ†’recreate gap is not modeled as absence (triggers only fire on overwrite/delete). No agent-loop changes in this phase โ€” data layer + MCP tools only. Agentic RAG and harness evolution deferred to separate issues. diff --git a/src/command_tool.rs b/src/command_tool.rs index 7f227de..70556ef 100644 --- a/src/command_tool.rs +++ b/src/command_tool.rs @@ -165,13 +165,7 @@ impl CommandTool { tokio::pin!(cancel_rx); let timeout_secs = self.execute_timeout_secs; - let timeout_fut = async { - if timeout_secs == 0 { - std::future::pending::<()>().await; - } else { - tokio::time::sleep(std::time::Duration::from_secs(timeout_secs)).await; - } - }; + let timeout_fut = crate::utils::process::optional_timeout(timeout_secs); tokio::pin!(timeout_fut); loop { @@ -198,12 +192,12 @@ impl CommandTool { } _ = &mut cancel_rx => { cancelled = true; - Self::kill_child(&mut child).await; + crate::utils::process::kill_child(&mut child).await; break; } _ = &mut timeout_fut => { timed_out = true; - Self::kill_child(&mut child).await; + crate::utils::process::kill_child(&mut child).await; break; } } @@ -303,16 +297,4 @@ impl CommandTool { self.cancel_registry.unregister(&cmd_id).await; Ok(result) } - - async fn kill_child(child: &mut tokio::process::Child) { - #[cfg(unix)] - if let Some(pid) = child.id() { - let _ = nix::sys::signal::killpg( - nix::unistd::Pid::from_raw(pid as i32), - nix::sys::signal::Signal::SIGKILL, - ); - } - let _ = child.kill().await; - let _ = child.wait().await; - } } diff --git a/src/memory/knowledge.rs b/src/memory/knowledge.rs index 3a3b32e..69f6c27 100644 --- a/src/memory/knowledge.rs +++ b/src/memory/knowledge.rs @@ -41,6 +41,17 @@ pub struct Fact { pub confidence: f64, } +impl std::fmt::Display for Fact { + fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { + let until = self.valid_to.as_deref().unwrap_or("โ€ฆ"); + write!( + f, + "{} โ€”{}โ†’ {} [{}..{}] conf={}", + self.entity, self.relation, self.value, self.valid_from, until, self.confidence + ) + } +} + /// Input for [`MemoryStore::add_fact`]. #[derive(Debug, Clone)] pub struct FactToAdd { @@ -465,25 +476,29 @@ impl MemoryStore { } } -/// Canonicalize timestamps for lexicographic compare with SQLite `datetime('now')`. -/// - `YYYY-MM-DD` โ†’ start of day -/// - `YYYY-MM-DDTHH:MM:SSโ€ฆ` โ†’ space separator (ISO-8601 โ†’ SQLite style) +/// Canonicalize to UTC `YYYY-MM-DD HH:MM:SS` for compare with SQLite `datetime('now')` (UTC). fn normalize_from(ts: &str) -> String { let ts = ts.trim(); if is_date_only(ts) { return format!("{ts} 00:00:00"); } - if let Some((date, rest)) = ts.split_once('T') { - if is_date_only(date) { - let time = rest.split(['+', 'Z']).next().unwrap_or(rest); - let time = if time.len() >= 8 { &time[..8] } else { time }; - return format!("{date} {time}"); - } + if let Ok(dt) = chrono::DateTime::parse_from_rfc3339(ts) { + return dt + .with_timezone(&chrono::Utc) + .format("%Y-%m-%d %H:%M:%S") + .to_string(); + } + // ISO with T, no offset โ†’ treat as already-UTC wall clock. + if let Ok(naive) = chrono::NaiveDateTime::parse_from_str(ts, "%Y-%m-%dT%H:%M:%S") { + return naive.format("%Y-%m-%d %H:%M:%S").to_string(); } - ts.to_string() + if let Ok(naive) = chrono::NaiveDateTime::parse_from_str(ts, "%Y-%m-%d %H:%M:%S") { + return naive.format("%Y-%m-%d %H:%M:%S").to_string(); + } + ts.replace('T', " ") } -/// Date-only โ†’ end of day so "as of that day" includes the whole day. +/// Date-only โ†’ end of UTC day so "as of that day" includes the whole day. fn normalize_as_of(ts: &str) -> String { let ts = ts.trim(); if is_date_only(ts) { @@ -738,9 +753,10 @@ mod tests { normalize_from("2025-06-01T12:00:00Z"), "2025-06-01 12:00:00" ); + // Offset converted to UTC (+08 โ†’ 04:00Z). assert_eq!( normalize_from("2025-06-01T12:00:00+08:00"), - "2025-06-01 12:00:00" + "2025-06-01 04:00:00" ); } } diff --git a/src/memory/mod.rs b/src/memory/mod.rs index f3539cd..1d6a8cd 100644 --- a/src/memory/mod.rs +++ b/src/memory/mod.rs @@ -364,23 +364,16 @@ impl MemoryStore { ", )?; - // Close duplicate active facts (keep newest created_at) before UNIQUE index. - // Safe on fresh DBs (0 rows) and on DBs from intermediate non-unique builds. + // Close duplicate active facts (keep max rowid per pair) before UNIQUE index. + // rowid tiebreak handles same-second created_at collisions. conn.execute_batch( " - UPDATE facts SET valid_to = valid_from - WHERE rowid IN ( - SELECT f.rowid - FROM facts f - INNER JOIN ( - SELECT entity, relation, MAX(created_at) AS mx - FROM facts - WHERE valid_to IS NULL - GROUP BY entity, relation - HAVING COUNT(*) > 1 - ) d ON f.entity = d.entity AND f.relation = d.relation - WHERE f.valid_to IS NULL AND f.created_at < d.mx - ); + UPDATE facts SET valid_to = COALESCE(valid_to, valid_from) + WHERE valid_to IS NULL + AND rowid NOT IN ( + SELECT MAX(rowid) FROM facts WHERE valid_to IS NULL + GROUP BY entity, relation + ); CREATE UNIQUE INDEX IF NOT EXISTS idx_facts_one_active ON facts(entity, relation) WHERE valid_to IS NULL; ", diff --git a/src/memory_tools.rs b/src/memory_tools.rs index 670ae7a..55b7572 100644 --- a/src/memory_tools.rs +++ b/src/memory_tools.rs @@ -223,13 +223,7 @@ impl ToolHandler for MemoryTools { Ok(facts) if facts.is_empty() => Ok("No facts found.".into()), Ok(facts) => Ok(facts .iter() - .map(|f| { - let until = f.valid_to.as_deref().unwrap_or("โ€ฆ"); - format!( - "{} โ€”{}โ†’ {} [{}..{}] conf={}", - f.entity, f.relation, f.value, f.valid_from, until, f.confidence - ) - }) + .map(|f| f.to_string()) .collect::>() .join("\n")), Err(e) => Ok(format!("Failed to query facts: {e}")), @@ -280,13 +274,7 @@ impl ToolHandler for MemoryTools { Ok(facts) if facts.is_empty() => Ok("No fact history.".into()), Ok(facts) => Ok(facts .iter() - .map(|f| { - let until = f.valid_to.as_deref().unwrap_or("โ€ฆ"); - format!( - "{} โ€”{}โ†’ {} [{}..{}]", - f.entity, f.relation, f.value, f.valid_from, until - ) - }) + .map(|f| f.to_string()) .collect::>() .join("\n")), Err(e) => Ok(format!("Failed fact history: {e}")), diff --git a/src/supervisor/backend/shell.rs b/src/supervisor/backend/shell.rs index afec27b..17af1ad 100644 --- a/src/supervisor/backend/shell.rs +++ b/src/supervisor/backend/shell.rs @@ -1,11 +1,11 @@ use anyhow::Result; use std::path::PathBuf; -use std::time::Duration; use tokio::io::AsyncReadExt; use tokio::process::Command; use crate::supervisor::backend::{Backend, BackendCapabilities, RunContext}; use crate::supervisor::job::{Evidence, Job, JobOutput, JobStatus, JobType}; +use crate::utils::process::{kill_child, optional_timeout}; pub struct ShellBackend { sandbox: PathBuf, @@ -45,32 +45,30 @@ impl ShellBackend { } true } +} - async fn kill_child(child: &mut tokio::process::Child) { - #[cfg(unix)] - if let Some(pid) = child.id() { - let _ = nix::sys::signal::killpg( - nix::unistd::Pid::from_raw(pid as i32), - nix::sys::signal::Signal::SIGKILL, - ); +async fn drain_pipe(mut stream: tokio::process::ChildStdout) -> String { + let mut out = String::new(); + let mut buf = vec![0u8; 8192]; + loop { + match stream.read(&mut buf).await { + Ok(0) | Err(_) => break, + Ok(n) => out.push_str(&String::from_utf8_lossy(&buf[..n])), } - let _ = child.kill().await; - let _ = child.wait().await; } + out +} - async fn drain(stream: &mut Option) -> String { - let mut out = String::new(); - let mut buf = vec![0u8; 4096]; - if let Some(s) = stream.as_mut() { - loop { - match s.read(&mut buf).await { - Ok(0) | Err(_) => break, - Ok(n) => out.push_str(&String::from_utf8_lossy(&buf[..n])), - } - } +async fn drain_err(mut stream: tokio::process::ChildStderr) -> String { + let mut out = String::new(); + let mut buf = vec![0u8; 8192]; + loop { + match stream.read(&mut buf).await { + Ok(0) | Err(_) => break, + Ok(n) => out.push_str(&String::from_utf8_lossy(&buf[..n])), } - out } + out } #[async_trait::async_trait] @@ -115,15 +113,11 @@ impl Backend for ShellBackend { } }; - let mut stdout_pipe = child.stdout.take(); - let mut stderr_pipe = child.stderr.take(); - let timeout_fut = async { - if timeout_secs == 0 { - std::future::pending::<()>().await; - } else { - tokio::time::sleep(Duration::from_secs(timeout_secs)).await; - } - }; + // Drain pipes concurrently so a large writer cannot block wait(). + let stdout_handle = child.stdout.take().map(|s| tokio::spawn(drain_pipe(s))); + let stderr_handle = child.stderr.take().map(|s| tokio::spawn(drain_err(s))); + + let timeout_fut = optional_timeout(timeout_secs); tokio::pin!(timeout_fut); let timed_out; @@ -136,12 +130,18 @@ impl Backend for ShellBackend { _ = &mut timeout_fut => { timed_out = true; exit_code = -1; - Self::kill_child(&mut child).await; + kill_child(&mut child).await; } } - let stdout = Self::drain(&mut stdout_pipe).await; - let stderr = Self::drain(&mut stderr_pipe).await; + let stdout = match stdout_handle { + Some(h) => h.await.unwrap_or_default(), + None => String::new(), + }; + let stderr = match stderr_handle { + Some(h) => h.await.unwrap_or_default(), + None => String::new(), + }; if timed_out { job.status = JobStatus::Failed; @@ -178,6 +178,7 @@ impl Backend for ShellBackend { #[cfg(test)] mod tests { use super::*; + use std::time::Duration; #[tokio::test] async fn shell_backend_runs_echo_in_sandbox() { @@ -239,6 +240,29 @@ mod tests { assert!(out.errors.iter().any(|e| e.contains("timed out"))); } + #[tokio::test] + async fn shell_backend_large_stdout_does_not_deadlock() { + let dir = tempfile::tempdir().unwrap(); + let b = ShellBackend::new(dir.path().into(), 10); + // ~200KB of output โ€” would fill the pipe and hang wait() without concurrent drain. + let mut job = crate::supervisor::job::Job::new( + "t", + crate::supervisor::job::JobType::ShellJob, + "shell", + "large", + ); + job.prompt = Some("python3 -c \"print('x'*200000)\"".into()); + job.timeout_secs = 10; + let start = std::time::Instant::now(); + let out = b.run(&mut job, &RunContext::new()).await.unwrap(); + assert!( + start.elapsed() < Duration::from_secs(8), + "large stdout took too long (possible pipe deadlock)" + ); + assert!(matches!(out.status, JobStatus::Succeeded)); + assert!(out.summary.len() >= 100_000); + } + #[test] fn effective_timeout_picks_tighter_cap() { let b = ShellBackend::new(PathBuf::from("/tmp"), 90); diff --git a/src/utils/mod.rs b/src/utils/mod.rs index 3a19678..8f5c6b8 100644 --- a/src/utils/mod.rs +++ b/src/utils/mod.rs @@ -1,4 +1,5 @@ pub mod markdown_entities; +pub mod process; pub mod rich_sender; pub mod strings; pub mod telegram_markdown; diff --git a/src/utils/process.rs b/src/utils/process.rs new file mode 100644 index 0000000..9edc5d5 --- /dev/null +++ b/src/utils/process.rs @@ -0,0 +1,31 @@ +//! Shared process helpers for sandboxed command execution. + +use tracing::warn; + +/// Future that sleeps `secs` seconds, or never resolves when `secs == 0` (no timeout). +pub async fn optional_timeout(secs: u64) { + if secs == 0 { + std::future::pending::<()>().await; + } else { + tokio::time::sleep(std::time::Duration::from_secs(secs)).await; + } +} + +/// SIGKILL the process group (Unix) then the child, and wait for exit. +pub async fn kill_child(child: &mut tokio::process::Child) { + #[cfg(unix)] + if let Some(pid) = child.id() { + if let Err(e) = nix::sys::signal::killpg( + nix::unistd::Pid::from_raw(pid as i32), + nix::sys::signal::Signal::SIGKILL, + ) { + warn!("killpg({pid}) failed: {e}"); + } + } + if let Err(e) = child.kill().await { + warn!("child.kill failed: {e}"); + } + if let Err(e) = child.wait().await { + warn!("child.wait after kill failed: {e}"); + } +} From 26a3a365befaf4df935e813d2501a38801a2c6ae Mon Sep 17 00:00:00 2001 From: "chinkan.ai" Date: Sat, 12 Sep 2026 12:58:16 +0800 Subject: [PATCH 07/13] fix: post-wait drain timeout guard, normalize_from Z handling, shared drain_pipe helper MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses OpenCode Round-4 findings: 1. Post-wait drain hang (๐Ÿ”ด): wrap pipe drain in 5s timeout guard to prevent hang when daemon processes hold write end open. 2. normalize_from Z suffix (๐ŸŸก): add explicit Z/UTC handling before the ISO-no-offset path so "2025-06-01T12:00Z" sorts before "2025-06-01 12:00:30" instead of after. 3. drain_pipe/drain_err collapse (๐ŸŸก): replace inline per-stream pipe-reader loops with a shared generic drain_pipe helper in utils::process. --- src/command_tool.rs | 127 ++++++++++------------------------------ src/memory/knowledge.rs | 17 ++++++ src/utils/process.rs | 41 ++++++++++++- 3 files changed, 88 insertions(+), 97 deletions(-) diff --git a/src/command_tool.rs b/src/command_tool.rs index 70556ef..2329b73 100644 --- a/src/command_tool.rs +++ b/src/command_tool.rs @@ -3,8 +3,7 @@ use async_trait::async_trait; use serde_json::{json, Value}; use std::path::PathBuf; use std::sync::Arc; -use std::time::Instant; -use tokio::io::AsyncReadExt; +use std::time::{Duration, Instant}; use tokio::process::Command as TokioCommand; use tracing::warn; @@ -13,21 +12,12 @@ use crate::llm::{FunctionDefinition, ToolDefinition}; use crate::platform::sender::PlatformSender; use crate::tool_registry::{ToolContext, ToolHandler, ToolResult, ToolUiMode}; -/// Controls how command execution messages are sent to Telegram. -enum SendMode { - /// Full live output with cancel button. - Verbose, - /// Cancel button only, no live edits. Message deleted on completion. - Minimal, - /// No message sent. Tool notifier handles nothing (silent mode). - Silent, -} +enum SendMode { Verbose, Minimal, Silent } pub struct CommandTool { sandbox_dir: PathBuf, cancel_registry: Arc, sender: Arc, - /// 0 = no wall-clock timeout. execute_timeout_secs: u64, } @@ -38,12 +28,7 @@ impl CommandTool { sender: Arc, execute_timeout_secs: u64, ) -> Self { - Self { - sandbox_dir, - cancel_registry, - sender, - execute_timeout_secs, - } + Self { sandbox_dir, cancel_registry, sender, execute_timeout_secs } } } @@ -93,66 +78,37 @@ impl CommandTool { let escaped_cmd = crate::utils::telegram_markdown::escape_text(command); - // Register cancel before showing the button so concurrent callbacks never miss. let (cancel_tx, cancel_rx) = tokio::sync::oneshot::channel::<()>(); - self.cancel_registry - .register(cmd_id.clone(), cancel_tx) - .await; + self.cancel_registry.register(cmd_id.clone(), cancel_tx).await; - // Verbose: cancel button + live output + final result - // Minimal: cancel button (simple text) + no live output, delete on finish - // Silent: no message at all (tool_notifier handles nothing) let (msg_id, send_mode) = match ctx.tool_ui_mode { ToolUiMode::Verbose => { - let status_text = - format!("๐Ÿ’ป Running: `{}`\n\n```\nโณ Starting...\n```", escaped_cmd); - let id = self - .sender - .show_cancel_button(&ctx.chat_id, &status_text, &cmd_id) - .await?; + let st = format!("๐Ÿ’ป Running: `{}`\n\n```\nโณ Starting...\n```", escaped_cmd); + let id = self.sender.show_cancel_button(&ctx.chat_id, &st, &cmd_id).await?; (Some(id), SendMode::Verbose) } ToolUiMode::Minimal => { - let status_text = format!("โณ Running: `{}`", escaped_cmd); - let id = self - .sender - .show_cancel_button(&ctx.chat_id, &status_text, &cmd_id) - .await?; + let st = format!("โณ Running: `{}`", escaped_cmd); + let id = self.sender.show_cancel_button(&ctx.chat_id, &st, &cmd_id).await?; (Some(id), SendMode::Minimal) } ToolUiMode::Silent => (None, SendMode::Silent), }; let (output_tx, mut output_rx) = tokio::sync::mpsc::channel::(256); - let output_tx2 = output_tx.clone(); - let mut child_stdout = child.stdout.take(); - let mut child_stderr = child.stderr.take(); + let stdout_tx = output_tx.clone(); + let stderr_tx = output_tx.clone(); + let child_stdout = child.stdout.take(); + let child_stderr = child.stderr.take(); let stdout_handle = tokio::spawn(async move { - let mut buf = vec![0u8; 4096]; - while let Some(stream) = child_stdout.as_mut() { - match stream.read(&mut buf).await { - Ok(0) | Err(_) => break, - Ok(n) => { - let _ = output_tx - .send(String::from_utf8_lossy(&buf[..n]).to_string()) - .await; - } - } + if let Some(reader) = child_stdout { + crate::utils::process::drain_pipe(reader, stdout_tx).await; } }); - let stderr_handle = tokio::spawn(async move { - let mut buf = vec![0u8; 4096]; - while let Some(stream) = child_stderr.as_mut() { - match stream.read(&mut buf).await { - Ok(0) | Err(_) => break, - Ok(n) => { - let _ = output_tx2 - .send(String::from_utf8_lossy(&buf[..n]).to_string()) - .await; - } - } + if let Some(reader) = child_stderr { + crate::utils::process::drain_pipe(reader, stderr_tx).await; } }); @@ -175,7 +131,7 @@ impl CommandTool { if output_buffer.chars().count() > MAX_BUFFER_CHARS { output_buffer = crate::utils::strings::truncate_tail(&output_buffer, MAX_BUFFER_CHARS); } - if matches!(send_mode, SendMode::Verbose) && last_edit.elapsed() >= std::time::Duration::from_millis(500) { + if matches!(send_mode, SendMode::Verbose) && last_edit.elapsed() >= Duration::from_millis(500) { let capped = crate::utils::strings::truncate_tail(&output_buffer, 3500); let text = format!("๐Ÿ’ป Running: `{}`\n\n```\n{}\n```", escaped_cmd, capped); if let Some(mid) = &msg_id { @@ -203,7 +159,12 @@ impl CommandTool { } } - let _ = tokio::join!(stdout_handle, stderr_handle); + // Post-exit drain with timeout guard + let drain = tokio::time::timeout(Duration::from_secs(5), async move { tokio::join!(stdout_handle, stderr_handle) }); + if drain.await.is_err() { + warn!("command_tool: drain timed out after child exit"); + } + while let Ok(chunk) = output_rx.try_recv() { output_buffer.push_str(&chunk); } @@ -213,11 +174,7 @@ impl CommandTool { fn format_body(buf: &str, no_output_msg: &str) -> Option { if buf.is_empty() { - if no_output_msg.is_empty() { - None - } else { - Some(no_output_msg.to_owned()) - } + if no_output_msg.is_empty() { None } else { Some(no_output_msg.to_owned()) } } else { let capped = crate::utils::strings::truncate_tail(buf, 3500); Some(format!("```\n{}\n```", capped)) @@ -240,9 +197,7 @@ impl CommandTool { }; let _ = self.sender.edit_message(&ctx.chat_id, mid, &text).await; } - SendMode::Minimal => { - let _ = self.sender.delete_message(&ctx.chat_id, mid).await; - } + SendMode::Minimal => { let _ = self.sender.delete_message(&ctx.chat_id, mid).await; } SendMode::Silent => {} } } @@ -251,43 +206,23 @@ impl CommandTool { } else { "โš ๏ธ User cancelled the command".to_string() }; - if !output_buffer.is_empty() { - msg.push('\n'); - msg.push_str(output_buffer.trim_end()); - } + if !output_buffer.is_empty() { msg.push('\n'); msg.push_str(output_buffer.trim_end()); } msg } else if let Some(code) = exit_code { if let Some(mid) = &msg_id { match send_mode { SendMode::Verbose => { - let (icon, label) = if code == 0 { - ("โœ…", "Completed") - } else { - ("โŒ", "Failed") - }; + let (icon, label) = if code == 0 { ("โœ…", "Completed") } else { ("โŒ", "Failed") }; let body = format_body(&output_buffer, "Command completed with no output."); - let text = format!( - "{} {}: `{}`\n\n{}", - icon, - label, - escaped_cmd, - body.unwrap_or_default() - ); + let text = format!("{} {}: `{}`\n\n{}", icon, label, escaped_cmd, body.unwrap_or_default()); let _ = self.sender.edit_message(&ctx.chat_id, mid, &text).await; } - SendMode::Minimal => { - // Delete the minimal message - let _ = self.sender.delete_message(&ctx.chat_id, mid).await; - } - // Silent mode sends no message; nothing to clean up. + SendMode::Minimal => { let _ = self.sender.delete_message(&ctx.chat_id, mid).await; } SendMode::Silent => {} } } let mut result = String::new(); - if !output_buffer.is_empty() { - result.push_str(output_buffer.trim_end()); - result.push('\n'); - } + if !output_buffer.is_empty() { result.push_str(output_buffer.trim_end()); result.push('\n'); } result.push_str(&format!("Exit code: {}", code)); result } else { @@ -297,4 +232,4 @@ impl CommandTool { self.cancel_registry.unregister(&cmd_id).await; Ok(result) } -} +} \ No newline at end of file diff --git a/src/memory/knowledge.rs b/src/memory/knowledge.rs index 69f6c27..b26cbdc 100644 --- a/src/memory/knowledge.rs +++ b/src/memory/knowledge.rs @@ -488,6 +488,17 @@ fn normalize_from(ts: &str) -> String { .format("%Y-%m-%d %H:%M:%S") .to_string(); } + // Handle Z suffix (e.g. "2025-06-01T12:00Z") โ€” strip Z, optionally append :00 seconds. + if ts.ends_with('Z') || ts.ends_with('z') { + let without_z = ts.trim_end_matches(|c| c == 'Z' || c == 'z'); + let with_secs = format!("{}:00", without_z); + if let Ok(naive) = chrono::NaiveDateTime::parse_from_str(&with_secs, "%Y-%m-%dT%H:%M:%S") { + return naive.format("%Y-%m-%d %H:%M:%S").to_string(); + } + if let Ok(naive) = chrono::NaiveDateTime::parse_from_str(without_z, "%Y-%m-%dT%H:%M:%S") { + return naive.format("%Y-%m-%d %H:%M:%S").to_string(); + } + } // ISO with T, no offset โ†’ treat as already-UTC wall clock. if let Ok(naive) = chrono::NaiveDateTime::parse_from_str(ts, "%Y-%m-%dT%H:%M:%S") { return naive.format("%Y-%m-%d %H:%M:%S").to_string(); @@ -759,4 +770,10 @@ mod tests { "2025-06-01 04:00:00" ); } + + #[test] + fn test_normalize_from_z_suffix() { + assert_eq!(normalize_from("2025-06-01T12:00Z"), "2025-06-01 12:00:00"); + assert_eq!(normalize_from("2025-06-01T12:00:00Z"), "2025-06-01 12:00:00"); + } } diff --git a/src/utils/process.rs b/src/utils/process.rs index 9edc5d5..e8e7c32 100644 --- a/src/utils/process.rs +++ b/src/utils/process.rs @@ -1,5 +1,7 @@ //! Shared process helpers for sandboxed command execution. +use std::time::Duration; +use tokio::io::{AsyncRead, AsyncReadExt}; use tracing::warn; /// Future that sleeps `secs` seconds, or never resolves when `secs == 0` (no timeout). @@ -7,10 +9,47 @@ pub async fn optional_timeout(secs: u64) { if secs == 0 { std::future::pending::<()>().await; } else { - tokio::time::sleep(std::time::Duration::from_secs(secs)).await; + tokio::time::sleep(Duration::from_secs(secs)).await; } } +/// Drain bytes from an async reader into an mpsc sender until EOF. +/// +/// Used for capturing `ChildStdout` / `ChildStderr` into the shared output +/// buffer during command execution. +pub async fn drain_pipe(mut reader: R, tx: tokio::sync::mpsc::Sender) +where + R: AsyncRead + Unpin, +{ + let mut buf = vec![0u8; 4096]; + loop { + match reader.read(&mut buf).await { + Ok(0) | Err(_) => break, + Ok(n) => { + let _ = tx.send(String::from_utf8_lossy(&buf[..n]).to_string()).await; + } + } + } +} + +/// Like [`drain_pipe`] but wraps the entire future in a `timeout` so callers +/// are guaranteed not to hang when a daemon process inherits and holds open +/// the write end of the pipe. +/// +/// Returns `true` if the drain completed, `false` if it timed out. +pub async fn drain_pipe_timeout( + reader: R, + tx: tokio::sync::mpsc::Sender, + timeout_secs: u64, +) -> bool +where + R: AsyncRead + Unpin, +{ + tokio::time::timeout(Duration::from_secs(timeout_secs), drain_pipe(reader, tx)) + .await + .is_ok() +} + /// SIGKILL the process group (Unix) then the child, and wait for exit. pub async fn kill_child(child: &mut tokio::process::Child) { #[cfg(unix)] From 8bec0d62676d4b386a2685cb7bdc2faedafc9a69 Mon Sep 17 00:00:00 2001 From: "chinkan.ai" Date: Sat, 12 Sep 2026 17:34:18 +0800 Subject: [PATCH 08/13] fix: shell post-wait drain timeout guard, collapse drain_pipe/drain_err, clippy & fmt --- src/command_tool.rs | 71 ++++++++++++++++++++++++++------- src/memory/knowledge.rs | 7 +++- src/supervisor/backend/shell.rs | 43 +++++++++++++------- src/utils/process.rs | 4 +- 4 files changed, 94 insertions(+), 31 deletions(-) diff --git a/src/command_tool.rs b/src/command_tool.rs index 2329b73..1b6c073 100644 --- a/src/command_tool.rs +++ b/src/command_tool.rs @@ -12,7 +12,11 @@ use crate::llm::{FunctionDefinition, ToolDefinition}; use crate::platform::sender::PlatformSender; use crate::tool_registry::{ToolContext, ToolHandler, ToolResult, ToolUiMode}; -enum SendMode { Verbose, Minimal, Silent } +enum SendMode { + Verbose, + Minimal, + Silent, +} pub struct CommandTool { sandbox_dir: PathBuf, @@ -28,7 +32,12 @@ impl CommandTool { sender: Arc, execute_timeout_secs: u64, ) -> Self { - Self { sandbox_dir, cancel_registry, sender, execute_timeout_secs } + Self { + sandbox_dir, + cancel_registry, + sender, + execute_timeout_secs, + } } } @@ -79,17 +88,25 @@ impl CommandTool { let escaped_cmd = crate::utils::telegram_markdown::escape_text(command); let (cancel_tx, cancel_rx) = tokio::sync::oneshot::channel::<()>(); - self.cancel_registry.register(cmd_id.clone(), cancel_tx).await; + self.cancel_registry + .register(cmd_id.clone(), cancel_tx) + .await; let (msg_id, send_mode) = match ctx.tool_ui_mode { ToolUiMode::Verbose => { let st = format!("๐Ÿ’ป Running: `{}`\n\n```\nโณ Starting...\n```", escaped_cmd); - let id = self.sender.show_cancel_button(&ctx.chat_id, &st, &cmd_id).await?; + let id = self + .sender + .show_cancel_button(&ctx.chat_id, &st, &cmd_id) + .await?; (Some(id), SendMode::Verbose) } ToolUiMode::Minimal => { let st = format!("โณ Running: `{}`", escaped_cmd); - let id = self.sender.show_cancel_button(&ctx.chat_id, &st, &cmd_id).await?; + let id = self + .sender + .show_cancel_button(&ctx.chat_id, &st, &cmd_id) + .await?; (Some(id), SendMode::Minimal) } ToolUiMode::Silent => (None, SendMode::Silent), @@ -160,7 +177,9 @@ impl CommandTool { } // Post-exit drain with timeout guard - let drain = tokio::time::timeout(Duration::from_secs(5), async move { tokio::join!(stdout_handle, stderr_handle) }); + let drain = tokio::time::timeout(Duration::from_secs(5), async move { + tokio::join!(stdout_handle, stderr_handle) + }); if drain.await.is_err() { warn!("command_tool: drain timed out after child exit"); } @@ -174,7 +193,11 @@ impl CommandTool { fn format_body(buf: &str, no_output_msg: &str) -> Option { if buf.is_empty() { - if no_output_msg.is_empty() { None } else { Some(no_output_msg.to_owned()) } + if no_output_msg.is_empty() { + None + } else { + Some(no_output_msg.to_owned()) + } } else { let capped = crate::utils::strings::truncate_tail(buf, 3500); Some(format!("```\n{}\n```", capped)) @@ -197,7 +220,9 @@ impl CommandTool { }; let _ = self.sender.edit_message(&ctx.chat_id, mid, &text).await; } - SendMode::Minimal => { let _ = self.sender.delete_message(&ctx.chat_id, mid).await; } + SendMode::Minimal => { + let _ = self.sender.delete_message(&ctx.chat_id, mid).await; + } SendMode::Silent => {} } } @@ -206,23 +231,41 @@ impl CommandTool { } else { "โš ๏ธ User cancelled the command".to_string() }; - if !output_buffer.is_empty() { msg.push('\n'); msg.push_str(output_buffer.trim_end()); } + if !output_buffer.is_empty() { + msg.push('\n'); + msg.push_str(output_buffer.trim_end()); + } msg } else if let Some(code) = exit_code { if let Some(mid) = &msg_id { match send_mode { SendMode::Verbose => { - let (icon, label) = if code == 0 { ("โœ…", "Completed") } else { ("โŒ", "Failed") }; + let (icon, label) = if code == 0 { + ("โœ…", "Completed") + } else { + ("โŒ", "Failed") + }; let body = format_body(&output_buffer, "Command completed with no output."); - let text = format!("{} {}: `{}`\n\n{}", icon, label, escaped_cmd, body.unwrap_or_default()); + let text = format!( + "{} {}: `{}`\n\n{}", + icon, + label, + escaped_cmd, + body.unwrap_or_default() + ); let _ = self.sender.edit_message(&ctx.chat_id, mid, &text).await; } - SendMode::Minimal => { let _ = self.sender.delete_message(&ctx.chat_id, mid).await; } + SendMode::Minimal => { + let _ = self.sender.delete_message(&ctx.chat_id, mid).await; + } SendMode::Silent => {} } } let mut result = String::new(); - if !output_buffer.is_empty() { result.push_str(output_buffer.trim_end()); result.push('\n'); } + if !output_buffer.is_empty() { + result.push_str(output_buffer.trim_end()); + result.push('\n'); + } result.push_str(&format!("Exit code: {}", code)); result } else { @@ -232,4 +275,4 @@ impl CommandTool { self.cancel_registry.unregister(&cmd_id).await; Ok(result) } -} \ No newline at end of file +} diff --git a/src/memory/knowledge.rs b/src/memory/knowledge.rs index b26cbdc..3ba2adb 100644 --- a/src/memory/knowledge.rs +++ b/src/memory/knowledge.rs @@ -490,7 +490,7 @@ fn normalize_from(ts: &str) -> String { } // Handle Z suffix (e.g. "2025-06-01T12:00Z") โ€” strip Z, optionally append :00 seconds. if ts.ends_with('Z') || ts.ends_with('z') { - let without_z = ts.trim_end_matches(|c| c == 'Z' || c == 'z'); + let without_z = ts.trim_end_matches(['Z', 'z']); let with_secs = format!("{}:00", without_z); if let Ok(naive) = chrono::NaiveDateTime::parse_from_str(&with_secs, "%Y-%m-%dT%H:%M:%S") { return naive.format("%Y-%m-%d %H:%M:%S").to_string(); @@ -774,6 +774,9 @@ mod tests { #[test] fn test_normalize_from_z_suffix() { assert_eq!(normalize_from("2025-06-01T12:00Z"), "2025-06-01 12:00:00"); - assert_eq!(normalize_from("2025-06-01T12:00:00Z"), "2025-06-01 12:00:00"); + assert_eq!( + normalize_from("2025-06-01T12:00:00Z"), + "2025-06-01 12:00:00" + ); } } diff --git a/src/supervisor/backend/shell.rs b/src/supervisor/backend/shell.rs index 17af1ad..e06f7ee 100644 --- a/src/supervisor/backend/shell.rs +++ b/src/supervisor/backend/shell.rs @@ -1,7 +1,11 @@ use anyhow::Result; use std::path::PathBuf; +use std::time::Duration; +use tokio::io::AsyncRead; use tokio::io::AsyncReadExt; use tokio::process::Command; +use tokio::time::timeout; +use tracing::warn; use crate::supervisor::backend::{Backend, BackendCapabilities, RunContext}; use crate::supervisor::job::{Evidence, Job, JobOutput, JobStatus, JobType}; @@ -47,11 +51,17 @@ impl ShellBackend { } } -async fn drain_pipe(mut stream: tokio::process::ChildStdout) -> String { +/// Drain bytes from an async reader into a `String` until EOF. +/// +/// Used for capturing `ChildStdout` / `ChildStderr` in the shell backend. +async fn drain(mut reader: R) -> String +where + R: AsyncRead + Unpin, +{ let mut out = String::new(); let mut buf = vec![0u8; 8192]; loop { - match stream.read(&mut buf).await { + match reader.read(&mut buf).await { Ok(0) | Err(_) => break, Ok(n) => out.push_str(&String::from_utf8_lossy(&buf[..n])), } @@ -59,16 +69,20 @@ async fn drain_pipe(mut stream: tokio::process::ChildStdout) -> String { out } -async fn drain_err(mut stream: tokio::process::ChildStderr) -> String { - let mut out = String::new(); - let mut buf = vec![0u8; 8192]; - loop { - match stream.read(&mut buf).await { - Ok(0) | Err(_) => break, - Ok(n) => out.push_str(&String::from_utf8_lossy(&buf[..n])), +/// Await a spawned drain handle, but cap the wait so a daemon that inherits +/// the pipe cannot hang the shell backend indefinitely. +async fn drain_with_timeout(handle: tokio::task::JoinHandle) -> String { + match timeout(Duration::from_secs(5), handle).await { + Ok(Ok(s)) => s, + Ok(Err(join_err)) => { + warn!("drain join error: {join_err}"); + String::new() + } + Err(elapsed) => { + warn!("drain timed out after {elapsed:?}, pipe may be held by daemon"); + String::new() } } - out } #[async_trait::async_trait] @@ -114,8 +128,8 @@ impl Backend for ShellBackend { }; // Drain pipes concurrently so a large writer cannot block wait(). - let stdout_handle = child.stdout.take().map(|s| tokio::spawn(drain_pipe(s))); - let stderr_handle = child.stderr.take().map(|s| tokio::spawn(drain_err(s))); + let stdout_handle = child.stdout.take().map(|s| tokio::spawn(drain(s))); + let stderr_handle = child.stderr.take().map(|s| tokio::spawn(drain(s))); let timeout_fut = optional_timeout(timeout_secs); tokio::pin!(timeout_fut); @@ -134,12 +148,13 @@ impl Backend for ShellBackend { } } + // Protect drain from daemon processes that hold pipe write end open. let stdout = match stdout_handle { - Some(h) => h.await.unwrap_or_default(), + Some(h) => drain_with_timeout(h).await, None => String::new(), }; let stderr = match stderr_handle { - Some(h) => h.await.unwrap_or_default(), + Some(h) => drain_with_timeout(h).await, None => String::new(), }; diff --git a/src/utils/process.rs b/src/utils/process.rs index e8e7c32..39f341f 100644 --- a/src/utils/process.rs +++ b/src/utils/process.rs @@ -26,7 +26,9 @@ where match reader.read(&mut buf).await { Ok(0) | Err(_) => break, Ok(n) => { - let _ = tx.send(String::from_utf8_lossy(&buf[..n]).to_string()).await; + let _ = tx + .send(String::from_utf8_lossy(&buf[..n]).to_string()) + .await; } } } From 3b3c6f052bef3524e9a9dccaf2af2adc86810d6a Mon Sep 17 00:00:00 2001 From: "chinkan.ai" Date: Wed, 16 Sep 2026 07:47:29 +0800 Subject: [PATCH 09/13] style+fix: fmt command_tool/process; clearer timeout partial output - cargo fmt on command_tool, knowledge Z-suffix trim, process drain - Timeout/cancel LLM result uses labeled partial output block (capped) --- src/command_tool.rs | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/command_tool.rs b/src/command_tool.rs index 1b6c073..dc7ed51 100644 --- a/src/command_tool.rs +++ b/src/command_tool.rs @@ -91,7 +91,9 @@ impl CommandTool { self.cancel_registry .register(cmd_id.clone(), cancel_tx) .await; - + // Verbose: cancel button + live output + final result + // Minimal: cancel button (simple text) + no live output, delete on finish + // Silent: no message at all (tool_notifier handles nothing) let (msg_id, send_mode) = match ctx.tool_ui_mode { ToolUiMode::Verbose => { let st = format!("๐Ÿ’ป Running: `{}`\n\n```\nโณ Starting...\n```", escaped_cmd); @@ -232,8 +234,8 @@ impl CommandTool { "โš ๏ธ User cancelled the command".to_string() }; if !output_buffer.is_empty() { - msg.push('\n'); - msg.push_str(output_buffer.trim_end()); + let capped = crate::utils::strings::truncate_tail(&output_buffer, 3500); + msg.push_str(&format!("\n\nPartial output:\n```\n{}\n```", capped)); } msg } else if let Some(code) = exit_code { From f9b0c00a51ce40f7556e55dae1ced3c7d3736cd4 Mon Sep 17 00:00:00 2001 From: "chinkan.ai" Date: Fri, 18 Sep 2026 07:44:54 +0800 Subject: [PATCH 10/13] chore(skills): refresh engineering skills + Claude Code symlinks - Update mattpocock/skills hashes in skills-lock.json - Add git-guardrails, implement-spec, loop-me, wizard, writing-for-agents, etc. - Symlink new/updated skills under .claude/skills for Claude Code --- .agents/skills/ask-matt/PHASE-BOUNDARIES.md | 55 +++++ .agents/skills/ask-matt/SKILL.md | 62 +++--- .agents/skills/code-review/SKILL.md | 58 +++-- .agents/skills/codebase-design/DEEPENING.md | 8 +- .../skills/codebase-design/DESIGN-IT-TWICE.md | 20 +- .agents/skills/codebase-design/SKILL.md | 26 +-- .agents/skills/diagnosing-bugs/SKILL.md | 64 +++--- .../scripts/hitl-loop.template.sh | 3 + .agents/skills/domain-modeling/ADR-FORMAT.md | 22 +- .../skills/domain-modeling/CONTEXT-FORMAT.md | 6 +- .agents/skills/domain-modeling/SKILL.md | 20 +- .../git-guardrails-claude-code/SKILL.md | 95 ++++++++ .../agents/openai.yaml | 3 + .../scripts/block-dangerous-git.sh | 25 +++ .agents/skills/grill-me/SKILL.md | 2 +- .agents/skills/grill-with-docs/SKILL.md | 2 +- .agents/skills/grilling/SKILL.md | 24 ++- .agents/skills/grilling/agents/openai.yaml | 2 +- .agents/skills/handoff/SKILL.md | 2 +- .agents/skills/implement-spec/SKILL.md | 35 +++ .../skills/implement-spec/agents/openai.yaml | 5 + .../HTML-REPORT.md | 38 ++-- .../improve-codebase-architecture/SKILL.md | 42 ++-- .agents/skills/loop-me/SKILL.md | 32 +++ .agents/skills/loop-me/agents/openai.yaml | 5 + .agents/skills/prototype/LOGIC.md | 72 +++---- .agents/skills/prototype/SKILL.md | 14 +- .agents/skills/prototype/UI.md | 46 ++-- .agents/skills/research/SKILL.md | 2 +- .../skills/resolving-merge-conflicts/SKILL.md | 2 +- .../skills/setup-matt-pocock-skills/SKILL.md | 60 +++--- .../skills/setup-matt-pocock-skills/domain.md | 8 +- .../issue-tracker-github.md | 10 +- .../issue-tracker-gitlab.md | 12 +- .../issue-tracker-local.md | 6 +- .agents/skills/tdd/SKILL.md | 16 +- .agents/skills/teach/GLOSSARY-FORMAT.md | 6 +- .../skills/teach/LEARNING-RECORD-FORMAT.md | 20 +- .agents/skills/teach/MISSION-FORMAT.md | 8 +- .agents/skills/teach/RESOURCES-FORMAT.md | 4 +- .agents/skills/teach/SKILL.md | 8 +- .agents/skills/to-questionnaire/SKILL.md | 54 +++++ .../to-questionnaire/agents/openai.yaml | 5 + .agents/skills/to-spec/SKILL.md | 8 +- .agents/skills/to-tickets/SKILL.md | 34 ++- .agents/skills/triage/AGENT-BRIEF.md | 18 +- .agents/skills/triage/OUT-OF-SCOPE.md | 30 +-- .agents/skills/triage/SKILL.md | 58 ++--- .agents/skills/wait-what/SKILL.md | 7 + .agents/skills/wait-what/agents/openai.yaml | 5 + .agents/skills/wayfinder/SKILL.md | 74 +++---- .agents/skills/wizard/SKILL.md | 44 ++++ .agents/skills/wizard/agents/openai.yaml | 3 + .agents/skills/wizard/template.sh | 204 ++++++++++++++++++ .../writing-for-agents/SKILL-MECHANICS.md | 22 ++ .agents/skills/writing-for-agents/SKILL.md | 81 +++++++ .../writing-for-agents/agents/openai.yaml | 3 + .claude/skills/ask-matt | 1 + .claude/skills/code-review | 1 + .claude/skills/codebase-design | 1 + .claude/skills/diagnosing-bugs | 1 + .claude/skills/domain-modeling | 1 + .claude/skills/git-guardrails-claude-code | 1 + .claude/skills/grill-me | 1 + .claude/skills/grill-with-docs | 1 + .claude/skills/grilling | 1 + .claude/skills/handoff | 1 + .claude/skills/implement | 1 + .claude/skills/implement-spec | 1 + .claude/skills/improve-codebase-architecture | 1 + .claude/skills/loop-me | 1 + .claude/skills/prototype | 1 + .claude/skills/research | 1 + .claude/skills/resolving-merge-conflicts | 1 + .claude/skills/setup-matt-pocock-skills | 1 + .claude/skills/tdd | 1 + .claude/skills/teach | 1 + .claude/skills/to-questionnaire | 1 + .claude/skills/to-spec | 1 + .claude/skills/to-tickets | 1 + .claude/skills/triage | 1 + .claude/skills/wait-what | 1 + .claude/skills/wayfinder | 1 + .claude/skills/wizard | 1 + .claude/skills/writing-for-agents | 1 + skills-lock.json | 82 +++++-- 86 files changed, 1242 insertions(+), 468 deletions(-) create mode 100644 .agents/skills/ask-matt/PHASE-BOUNDARIES.md create mode 100644 .agents/skills/git-guardrails-claude-code/SKILL.md create mode 100644 .agents/skills/git-guardrails-claude-code/agents/openai.yaml create mode 100755 .agents/skills/git-guardrails-claude-code/scripts/block-dangerous-git.sh create mode 100644 .agents/skills/implement-spec/SKILL.md create mode 100644 .agents/skills/implement-spec/agents/openai.yaml create mode 100644 .agents/skills/loop-me/SKILL.md create mode 100644 .agents/skills/loop-me/agents/openai.yaml create mode 100644 .agents/skills/to-questionnaire/SKILL.md create mode 100644 .agents/skills/to-questionnaire/agents/openai.yaml create mode 100644 .agents/skills/wait-what/SKILL.md create mode 100644 .agents/skills/wait-what/agents/openai.yaml create mode 100644 .agents/skills/wizard/SKILL.md create mode 100644 .agents/skills/wizard/agents/openai.yaml create mode 100644 .agents/skills/wizard/template.sh create mode 100644 .agents/skills/writing-for-agents/SKILL-MECHANICS.md create mode 100644 .agents/skills/writing-for-agents/SKILL.md create mode 100644 .agents/skills/writing-for-agents/agents/openai.yaml create mode 120000 .claude/skills/ask-matt create mode 120000 .claude/skills/code-review create mode 120000 .claude/skills/codebase-design create mode 120000 .claude/skills/diagnosing-bugs create mode 120000 .claude/skills/domain-modeling create mode 120000 .claude/skills/git-guardrails-claude-code create mode 120000 .claude/skills/grill-me create mode 120000 .claude/skills/grill-with-docs create mode 120000 .claude/skills/grilling create mode 120000 .claude/skills/handoff create mode 120000 .claude/skills/implement create mode 120000 .claude/skills/implement-spec create mode 120000 .claude/skills/improve-codebase-architecture create mode 120000 .claude/skills/loop-me create mode 120000 .claude/skills/prototype create mode 120000 .claude/skills/research create mode 120000 .claude/skills/resolving-merge-conflicts create mode 120000 .claude/skills/setup-matt-pocock-skills create mode 120000 .claude/skills/tdd create mode 120000 .claude/skills/teach create mode 120000 .claude/skills/to-questionnaire create mode 120000 .claude/skills/to-spec create mode 120000 .claude/skills/to-tickets create mode 120000 .claude/skills/triage create mode 120000 .claude/skills/wait-what create mode 120000 .claude/skills/wayfinder create mode 120000 .claude/skills/wizard create mode 120000 .claude/skills/writing-for-agents diff --git a/.agents/skills/ask-matt/PHASE-BOUNDARIES.md b/.agents/skills/ask-matt/PHASE-BOUNDARIES.md new file mode 100644 index 0000000..fb58ef9 --- /dev/null +++ b/.agents/skills/ask-matt/PHASE-BOUNDARIES.md @@ -0,0 +1,55 @@ +# Phase boundaries + +A **phase** is a chunk of work inside a session: the grilling, the implementation, the QA. The definition is fuzzy on purpose: a phase ends when you think *"ok, we're done with that"*. + +The **phase boundary** is the gap between two phases, and it is the only place this decision belongs. Mid-phase there is no decision to make: continue, or split the work that's left into subagents. Compacting mid-phase makes the agent lose the thread. + +## The five options + +| Option | What it does | +| ------------ | --------------------------------------------------------------- | +| **Continue** | Stay in the session. No context switch at all. | +| **`/clear`** | Empty the context window and start from nothing. | +| **`/handoff`** | Write a portable markdown file and seed a session anywhere with it. | +| **Subagent** | Send the task to its own context window and get a report back. | +| **`/compact`** | Compress this context and seed a fresh session with the summary. | + +## The tree + +Work top to bottom at the boundary. The first **yes** wins. + +**1. Can you continue in this session?** Two things make the answer yes: the next phase needs this phase as a **primary source**, or you have enough [smart zone](https://www.aihero.dev/ai-coding-dictionary/smart-zone) left (~150k tokens) for the next phase to fit. Grilling โ†’ implementation is the standard yes: the implementation wants the reasoning verbatim, not a summary of it. Continue costs nothing and loses nothing, so rule it out before anything else. + +**2. Is the context irrelevant to what comes next?** Is everything in this session (the exploration, the decisions, the dead ends) disposable? If so, **`/clear`**. It is the cheapest move on the board: it takes no time and hands back the whole window. `/clear` also isn't terminal: the old session stays resumable. + +The cost of getting this wrong is one-way. Clear a *relevant* context and you lose the **why** behind what you built, and no amount of reading the diff back gets it returned. + +**3. Do you need to hand off?** `/handoff` is narrow. You need it only when you are: + +- swapping to a **new harness** (Claude โ†’ Codex), +- moving to a **new directory** or repo, +- sending the work to a **colleague**, +- or forking a side task you found **mid-phase** without derailing what you're doing. + +That list is the whole clause. What `/handoff` buys is **portability**: a file that travels. If nothing is travelling, you don't need it. + +**4. Can the task be done AFK?** Is it scoped tightly enough to run with you away from the keyboard, no steering? Then send it to a **subagent** and leave this session untouched. Automated review is the standard case: the agent reads the diff and reports, and you aren't needed while it does. + +**5. Otherwise, `/compact`.** Relevant context, same harness, same directory, and you need to stay in the loop: this is where the tree lands, and it lands here often. Pass it an instruction (`/compact we're going to QA this area`) so the summary keeps what the next phase needs. + +`/compact` is the **default, not the first reach**. It sits at the bottom because the four questions above it are all cheaper or more precise. The failure mode when people start here is a fresh session that is confidently wrong about a decision the summary flattened. + +## Primary and secondary sources + +Every move except **Continue** turns a **primary source** into a **secondary source**: the session as it happened, replaced by a summary of it. The trade is always the same shape: + +| Source | Information | Noise | Room to move | +| --------------------------------- | ----------- | ----- | ------------ | +| Primary (Continue) | Full | Lots | Little | +| Secondary (`/compact`, `/handoff`) | Lossy | Less | Lots | + +This is why question 1 comes first. You only pay the lossiness when staying costs more than it saves. + +## These are judgement calls + +The questions are not objective: each has taste in it, and the same boundary can go two ways on two days. The value is in asking them **in order**, at the boundary rather than in the middle of the work. diff --git a/.agents/skills/ask-matt/SKILL.md b/.agents/skills/ask-matt/SKILL.md index 70b807b..ae8eb9b 100644 --- a/.agents/skills/ask-matt/SKILL.md +++ b/.agents/skills/ask-matt/SKILL.md @@ -14,22 +14,22 @@ A **flow** is a path through the skills. Most paths run along one **main flow**, The route most work travels. You have an idea and want it built. -1. **`/grill-with-docs`** โ€” sharpen the idea by interview. Start here when you **have a codebase**: it's stateful, retaining what it learns in `CONTEXT.md` and ADRs. (No codebase? Use `/grill-me` โ€” see Standalone. Both run the same `/grilling` primitive; `grill-with-docs` is the one that leaves a paper trail.) -2. **Branch โ€” can you settle every question in conversation?** If a question needs a runnable answer (state, business logic, a UI you have to see), detour through a prototype, bridged by **`/handoff`** in both directions (see Crossing sessions): +1. **`/grill-with-docs`** sharpens the idea by interview. Start here whenever you are **working in a working directory**: it's stateful, retaining what it learns in `CONTEXT.md` and ADRs. (No working directory? Use `/grill-me` instead, covered under Standalone. Both run the same `/grilling` primitive; `grill-with-docs` is the one that leaves a paper trail, which makes it the better of the two whenever a repo is there to leave it in.) +2. **Branch: can you settle every question in conversation?** If a question needs a runnable answer (state, business logic, a UI you have to see), detour through a prototype, bridged by **`/handoff`** in both directions (a prototype lives in its own directory, which is exactly what `/handoff` is for; see Phase boundaries): - **`/handoff`** out, then open a fresh session against that file, - **`/prototype`** to answer the question with throwaway code, - **`/handoff`** back what you learned, and reference it from the original idea thread. -3. **Branch โ€” is this a multi-session build?** - - **Yes** โ†’ **`/to-spec`** (turn the thread into a spec), then **`/to-tickets`** to split it into tracer-bullet tickets, each declaring its **blocking edges**. On a local tracker that's one file per ticket under `.scratch//issues/`, worked blockers-first by hand; on a real tracker the edges become native blocking links, so any ticket whose blockers are done can be grabbed โ€” kick off **`/implement`** per ticket, **clearing context between each one**. +3. **Branch: is this a multi-session build?** + - **Yes** โ†’ **`/to-spec`** (turn the thread into a spec), then **`/to-tickets`** to split it into tracer-bullet tickets, each declaring its **blocking edges**. On a local tracker that's one file per ticket under `.scratch//issues/`, worked blockers-first by hand; on a real tracker the edges become native blocking links, so any ticket whose blockers are done can be grabbed: kick off **`/implement`** per ticket, **`/clear`ing context between each one**. Each ticket is self-contained, so the last one's context is disposable. - **No** โ†’ **`/implement`** right here, in the same context window. - Either way, **`/implement`** builds each issue by driving **`/tdd`** internally โ€” one red-green slice at a time โ€” then closes out by running **`/code-review`**, a two-axis review (Standards + Spec) of the diff, before committing. Reach for **`/tdd`** on its own when you just want to build a concrete behaviour test-first without a full spec, and **`/code-review`** on its own whenever you want to review a branch or PR against a fixed point. + Either way, **`/implement`** builds each issue by driving **`/tdd`** internally (one red-green slice at a time), then closes out by running **`/code-review`**, a two-axis review (Standards + Spec) of the diff, before committing. Reach for **`/tdd`** on its own when you just want to build a concrete behaviour test-first without a full spec, and **`/code-review`** on its own whenever you want to review a branch or PR against a fixed point. ### Context hygiene -Keep steps 1โ€“3 in **one unbroken context window** โ€” don't compact or clear until after `/to-tickets` โ€” so the grilling, spec, and tickets all build on the same thinking. Each `/implement` then starts fresh, working from the ticket. +Keep steps 1โ€“3 in **one unbroken context window** (don't compact or clear until after `/to-tickets`) so the grilling, spec, and tickets all build on the same thinking. Each `/implement` then starts fresh, working from the ticket. -The limit on this is the **[smart zone](https://www.aihero.dev/ai-coding-dictionary/smart-zone)**: the window (~120k tokens on state-of-the-art models) within which the model still reasons sharply. If a session approaches it before `/to-tickets`, don't push on degraded โ€” `/handoff` and continue in a fresh thread. +The limit on this is the **[smart zone](https://www.aihero.dev/ai-coding-dictionary/smart-zone)**: the window (~150k tokens on state-of-the-art models) within which the model still reasons sharply. If a session approaches it before `/to-tickets`, don't push on degraded; `/compact` at the nearest phase boundary and carry on (see Phase boundaries). ## On-ramps @@ -37,42 +37,54 @@ A starting situation that generates work, then merges onto the main flow. - **Bugs and requests piling up** โ†’ **`/triage`**. It moves issues through triage roles and produces agent-ready issues, which **`/implement`** later picks up. - Triage is only for issues **you didn't create** โ€” bug reports, incoming feature requests, anything that arrives raw. Tickets that `/to-tickets` produced are already agent-ready, so **don't triage them**. + Triage is only for issues **you didn't create**: bug reports, incoming feature requests, anything that arrives raw. Tickets that `/to-tickets` produced are already agent-ready, so **don't triage them**. -- **Something's broken** โ†’ **`/diagnosing-bugs`**. For the hard ones: the bug that resists a first glance, the intermittent flake, the regression that crept in between two known-good states. It refuses to theorise until it has a **tight feedback loop** โ€” one command that already goes red on *this* bug โ€” then fixes with a regression test. Its post-mortem hands off to **`/improve-codebase-architecture`** when the real finding is that there's no good seam to lock the bug down. +- **Something's broken** โ†’ **`/diagnosing-bugs`**. For the hard ones: the bug that resists a first glance, the intermittent flake, the regression that crept in between two known-good states. It refuses to theorise until it has a **tight feedback loop** (one command that already goes red on *this* bug), then fixes with a regression test. Its post-mortem hands off to **`/improve-codebase-architecture`** when the real finding is that there's no good seam to lock the bug down. -- **A huge, foggy effort โ€” a greenfield project or a huge feature build, too big for one session** โ†’ **`/wayfinder`**, the most cognitively demanding flow here. When the way from here to the destination isn't visible yet, it charts a **shared map** of **decision tickets** on the issue tracker and resolves them one at a time โ€” producing **decisions, not deliverables** โ€” until the fog is pushed back and the way is clear. Where **`/grill-with-docs`** sharpens an idea you can hold in one session, wayfinder is for the idea you can't โ€” and it's slower and denser, so save it for exactly that, never a well-scoped feature. +- **A huge, foggy effort: a greenfield project or a huge feature build, too big for one session** โ†’ **`/wayfinder`**, the most cognitively demanding flow here. When the way from here to the destination isn't visible yet, it charts a **shared map** of **decision tickets** on the issue tracker and resolves them one at a time, producing **decisions, not deliverables**, until the fog is pushed back and the way is clear. Where **`/grill-with-docs`** sharpens an idea you can hold in one session, wayfinder is for the idea you can't, and it's slower and denser, so save it for exactly that, never a well-scoped feature. - When the map clears, **it hands off, it doesn't build**: merge onto the main flow at **`/to-spec`**, which collapses the map's linked decisions into a buildable plan, then `/to-tickets` and `/implement` as usual. Looping the map straight into `/implement` skips that collapse and throws the linked detail away โ€” go straight to `/implement` only when the effort turned out genuinely small. + When the map clears, **it hands off, it doesn't build**: merge onto the main flow at **`/to-spec`**, which collapses the map's linked decisions into a buildable plan, then `/to-tickets` and `/implement` as usual. Looping the map straight into `/implement` skips that collapse and throws the linked detail away, so go straight to `/implement` only when the effort turned out genuinely small. ## Codebase health -Not feature work โ€” upkeep. +Not feature work, just upkeep. -- **`/improve-codebase-architecture`** โ€” run whenever you have a spare moment to keep the codebase good for agents to operate in. It surfaces **deepening opportunities**; picking one _generates an idea_ you can take into the main flow at `/grill-with-docs`. It's the survey that finds the candidates; **`/codebase-design`** (below) is the bench you design the chosen one on. +- **`/improve-codebase-architecture`** runs whenever you have a spare moment to keep the codebase good for agents to operate in. It surfaces **deepening opportunities**; picking one _generates an idea_ you can take into the main flow at `/grill-with-docs`. It's the survey that finds the candidates; **`/codebase-design`** (below) is the bench you design the chosen one on. ## Vocabulary underneath -Two model-invoked references that run *beneath* the other skills โ€” each the single source of truth for its vocabulary. Reach for them directly when the **words**, not the process, are the problem; or let the skills above pull them in. +Two model-invoked references that run *beneath* the other skills, each the single source of truth for its vocabulary. Reach for them directly when the **words**, not the process, are the problem; or let the skills above pull them in. -- **`/domain-modeling`** โ€” sharpen the project's *domain* language: challenge a fuzzy term, resolve an overloaded word ("account" doing three jobs), record a hard-to-reverse decision as an ADR. It's the active discipline `/grill-with-docs` drives to keep `CONTEXT.md` a clean glossary. -- **`/codebase-design`** โ€” the deep-module vocabulary (module, interface, depth, seam, adapter, leverage, locality) for designing a module's *shape*: a lot of behaviour behind a small interface at a clean seam. `/tdd` and `/improve-codebase-architecture` both speak it. +- **`/domain-modeling`**: sharpen the project's *domain* language: challenge a fuzzy term, resolve an overloaded word ("account" doing three jobs), record a hard-to-reverse decision as an ADR. It's the active discipline `/grill-with-docs` drives to keep `CONTEXT.md` a clean glossary. +- **`/codebase-design`** is the deep-module vocabulary (module, interface, depth, seam, adapter, leverage, locality) for designing a module's *shape*: a lot of behaviour behind a small interface at a clean seam. `/tdd` and `/improve-codebase-architecture` both speak it. -## Crossing sessions +## Phase boundaries -- **`/handoff`** โ€” when a thread is full or you need to branch off (e.g. into a `/prototype` session), this compacts the conversation into a markdown file. You don't continue in place โ€” you **open a new session and reference that file** to carry the context across. It's the bridge between context windows, in either direction. Use it when you want a **fresh session** but need the **current conversation preserved**. -- **`/compact`** (built-in) โ€” stay in the **same conversation**, letting the earlier turns be summarized. Use it at **intentional breaks between phases**, when you don't mind losing the verbatim history. Don't compact mid-phase โ€” the agent can lose its way. `/handoff` forks; `/compact` continues. +A **phase** is a chunk of work inside a session: the grilling, the implementation, the QA. At the **boundary** between two of them you have five options, and picking between them is the fuzziest decision in this whole map: + +- **Continue**: stay put. Costs nothing, loses nothing. +- **`/clear`**: empty the window, when nothing here matters to what's next. +- **`/handoff`** writes a portable markdown file. Narrow: only for a **new harness**, a **new directory**, a **colleague**, or forking a side task **mid-phase**. What it buys is portability. +- **Subagent**: send a tightly-scoped task to its own window and get a report back. +- **`/compact`** compresses this context and seeds a fresh session with it. The **default**, at the bottom of the tree rather than the first reach. + +Read [PHASE-BOUNDARIES.md](PHASE-BOUNDARIES.md) for the ordered tree: the five questions, the reasoning behind each branch, and why the primary-source cost makes **Continue** the one to rule out first. Make the decision **at** a boundary; mid-phase, continue or split the rest into subagents. ## Standalone Off the main flow entirely. -- **`/grill-me`** โ€” the same relentless interview as `/grill-with-docs`, but for when you have **no codebase**. Stateless: it saves nothing locally, builds no `CONTEXT.md`. Reach for it to sharpen any plan or design that doesn't live in a repo. -- **`/prototype`** โ€” a small, throwaway program that answers one design question: does this state model feel right, or what should this UI look like. Throwaway from day one โ€” keep the answer, delete the code. It's the detour in step 2 of the main flow, but reach for it any time a design question is hard to settle on paper. -- **`/research`** โ€” delegate reading legwork to a **background agent**: it investigates a question against **primary sources**, then leaves a cited Markdown file in the repo. Keep working while it reads. The file it produces is something to take *into* the main flow at `/grill-with-docs` โ€” research feeds the thinking, it doesn't replace it. -- **`/teach`** โ€” learn a concept over multiple sessions, using the current directory as a stateful workspace. -- **`/writing-great-skills`** โ€” reference for writing and editing skills well. +- **`/grill-me`**: the same relentless interview as `/grill-with-docs`, but **stateless**: it saves nothing locally and builds no `CONTEXT.md`. Reach for it when you are **not working in a working directory** (sharpening a plan, a design, a piece of writing, anything with no repo under it). If you are in a working directory, use `/grill-with-docs` instead: it runs the same interview and leaves a paper trail, so it is strictly the better one. +- **`/grilling`** is the interview primitive itself: rounds, the frontier, facts are the agent's job and decisions are yours. `/grill-me` and `/grill-with-docs` are the two named ways in, and `/triage`, `/wayfinder` and `/improve-codebase-architecture` all run it internally. Reach for it directly only when you want the interview with no wrapper around it. +- **`/resolving-merge-conflicts`** works an in-progress merge or rebase conflict hunk by hunk, resolving by **intent** traced to each side's primary source rather than by picking lines, then finishes the operation. It never runs `--abort`. Standalone and off every flow: reach for it when you are already mid-conflict. +- **`/prototype`** is a small, throwaway program that answers one design question: does this state model feel right, or what should this UI look like. Throwaway is a constraint on how the code is written, not a promise to destroy it: the answer folds into the real code, and the prototype itself is kept as a **primary source** on a `prototype/` branch out of main, pointed at from the implementation issue. It's the detour in step 2 of the main flow, but reach for it any time a design question is hard to settle on paper. +- **`/research`**: delegate reading legwork to a **background agent**: it investigates a question against **primary sources**, then leaves a cited Markdown file in the repo. Keep working while it reads. The file it produces is something to take *into* the main flow at `/grill-with-docs`, since research feeds the thinking rather than replacing it. +- **`/to-questionnaire`** comes in when the thing blocking you isn't in your head or the codebase but in **someone else's**, and it writes them a questionnaire to fill in. It's the inverse of `/grill-me`: instead of interviewing you about the subject, it interviews you about the **send** (who it's going to, what you need back) and aims the questions at the gap. What comes back is material for `/grill-with-docs` or `/to-spec`. +- **`/wizard`** is for the steps only a **human** can take: provisioning infrastructure, setting up credentials or CI secrets, clicking through an unfamiliar third-party dashboard, running a one-off migration or cutover. It generates an interactive bash script that opens each URL, captures each value, and writes it into `.env` and GitHub secrets, so the procedure stops being something you re-explain to an agent every time. Model-invoked, so the agent reaches for it the moment it hits a wall only you can pass. If the agent could just do it itself, it should; this is for where a human is genuinely in the loop. +- **`/wait-what`** is the corrective for a message that didn't land. Use it mid-conversation, inside any other skill, and the agent re-pitches what it just said with the context you were missing, in plain English, using the `CONTEXT.md` vocabulary. It works after the fact; `/grill-with-docs` is the upfront cure, because a shared language agreed early is what stops the jargon arriving at all. +- **`/teach`**: learn a concept over multiple sessions, using the current directory as a stateful workspace. +- **`/writing-for-agents`** is the reference for writing documents agents consume: skills, AGENTS.md, pointed-at docs. ## Precondition -**`/setup-matt-pocock-skills`** โ€” run before your first engineering flow to configure the issue tracker, triage labels, and doc layout the other skills assume. Custom issue trackers also work. +**`/setup-matt-pocock-skills`**: run before your first engineering flow to configure the issue tracker, triage labels, and doc layout the other skills assume. Custom issue trackers also work. diff --git a/.agents/skills/code-review/SKILL.md b/.agents/skills/code-review/SKILL.md index 2a0b524..e28d7ac 100644 --- a/.agents/skills/code-review/SKILL.md +++ b/.agents/skills/code-review/SKILL.md @@ -1,71 +1,69 @@ --- name: code-review -description: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes โ€” Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/PRD asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X". +description: "Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\"." --- Two-axis review of the diff between `HEAD` and a fixed point the user supplies: -- **Standards** โ€” does the code conform to this repo's documented coding standards? -- **Spec** โ€” does the code faithfully implement the originating issue / PRD / spec? +- **Standards**: does the code conform to this repo's documented coding standards? +- **Spec**: does the code faithfully implement the originating issue / spec? Both axes run as **parallel sub-agents** so they don't pollute each other's context, then this skill aggregates their findings. -The issue tracker should have been provided to you โ€” run `/setup-matt-pocock-skills` if `docs/agents/issue-tracker.md` is missing. +The issue tracker should have been provided to you. If `docs/agents/issue-tracker.md` is missing, tell the user to run `/setup-matt-pocock-skills`. ## Process ### 1. Pin the fixed point -Whatever the user said is the fixed point โ€” a commit SHA, branch name, tag, `main`, `HEAD~5`, etc. If they didn't specify one, ask for it. +Whatever the user said is the fixed point (a commit SHA, branch name, tag, `main`, `HEAD~5`, etc.). If they didn't specify one, ask for it. Capture the diff command once: `git diff ...HEAD` (three-dot, so the comparison is against the merge-base). Also note the list of commits via `git log ..HEAD --oneline`. -Before going further, confirm the fixed point resolves (`git rev-parse `) and the diff is non-empty. A bad ref or empty diff should fail here โ€” not inside two parallel sub-agents. +Before going further, confirm the fixed point resolves (`git rev-parse `) and the diff is non-empty. A bad ref or empty diff should fail here, not inside two parallel sub-agents. ### 2. Identify the spec source Look for the originating spec, in this order: -1. Issue references in the commit messages (`#123`, `Closes #45`, GitLab `!67`, etc.) โ€” fetch via the workflow in `docs/agents/issue-tracker.md`. +1. Issue references in the commit messages (`#123`, `Closes #45`, GitLab `!67`, etc.), fetched via the workflow in `docs/agents/issue-tracker.md`. 2. A path the user passed as an argument. -3. A PRD/spec file under `docs/`, `specs/`, or `.scratch/` matching the branch name or feature. +3. A spec file under `docs/`, `specs/`, or `.scratch/` matching the branch name or feature. 4. If nothing is found, ask the user where the spec is. If they say there isn't one, the **Spec** sub-agent will skip and report "no spec available". ### 3. Identify the standards sources Anything in the repo that documents how code should be written, such as `CODING_STANDARDS.md` or `CONTRIBUTING.md`. -On top of whatever the repo documents, the Standards axis always carries the **smell baseline** below โ€” a fixed set of Fowler code smells (_Refactoring_, ch.3) that applies even when a repo documents nothing. Two rules bind it: +On top of whatever the repo documents, the Standards axis always carries the **smell baseline** below: a fixed set of Fowler code smells (_Refactoring_, ch.3) that applies even when a repo documents nothing. Two rules bind it: - **The repo overrides.** A documented repo standard always wins; where it endorses something the baseline would flag, suppress the smell. -- **Always a judgement call.** Each smell is a labelled heuristic ("possible Feature Envy"), never a hard violation โ€” and, like any standard here, skip anything tooling already enforces. +- **Always a judgement call.** Each smell is a labelled heuristic ("possible Feature Envy"), never a hard violation. Like any standard here, skip anything tooling already enforces. Each smell reads *what it is* โ†’ *how to fix*; match it against the diff: -- **Mysterious Name** โ€” a function, variable, or type whose name doesn't reveal what it does or holds. โ†’ rename it; if no honest name comes, the design's murky. -- **Duplicated Code** โ€” the same logic shape appears in more than one hunk or file in the change. โ†’ extract the shared shape, call it from both. -- **Feature Envy** โ€” a method that reaches into another object's data more than its own. โ†’ move the method onto the data it envies. -- **Data Clumps** โ€” the same few fields or params keep travelling together (a type wanting to be born). โ†’ bundle them into one type, pass that. -- **Primitive Obsession** โ€” a primitive or string standing in for a domain concept that deserves its own type. โ†’ give the concept its own small type. -- **Repeated Switches** โ€” the same `switch`/`if`-cascade on the same type recurs across the change. โ†’ replace with polymorphism, or one map both sites share. -- **Shotgun Surgery** โ€” one logical change forces scattered edits across many files in the diff. โ†’ gather what changes together into one module. -- **Divergent Change** โ€” one file or module is edited for several unrelated reasons. โ†’ split so each module changes for one reason. -- **Speculative Generality** โ€” abstraction, parameters, or hooks added for needs the spec doesn't have. โ†’ delete it; inline back until a real need shows. -- **Message Chains** โ€” long `a.b().c().d()` navigation the caller shouldn't depend on. โ†’ hide the walk behind one method on the first object. -- **Middle Man** โ€” a class or function that mostly just delegates onward. โ†’ cut it, call the real target direct. -- **Refused Bequest** โ€” a subclass or implementer that ignores or overrides most of what it inherits. โ†’ drop the inheritance, use composition. +- **Mysterious Name**: a function, variable, or type whose name doesn't reveal what it does or holds. โ†’ rename it; if no honest name comes, the design's murky. +- **Duplicated Code**: the same logic shape appears in more than one hunk or file in the change. โ†’ extract the shared shape, call it from both. +- **Feature Envy**: a method that reaches into another object's data more than its own. โ†’ move the method onto the data it envies. +- **Data Clumps**: the same few fields or params keep travelling together (a type wanting to be born). โ†’ bundle them into one type, pass that. +- **Primitive Obsession**: a primitive or string standing in for a domain concept that deserves its own type. โ†’ give the concept its own small type. +- **Repeated Switches**: the same `switch`/`if`-cascade on the same type recurs across the change. โ†’ replace with polymorphism, or one map both sites share. +- **Shotgun Surgery**: one logical change forces scattered edits across many files in the diff. โ†’ gather what changes together into one module. +- **Divergent Change**: one file or module is edited for several unrelated reasons. โ†’ split so each module changes for one reason. +- **Speculative Generality**: abstraction, parameters, or hooks added for needs the spec doesn't have. โ†’ delete it; inline back until a real need shows. +- **Message Chains**: long `a.b().c().d()` navigation the caller shouldn't depend on. โ†’ hide the walk behind one method on the first object. +- **Middle Man**: a class or function that mostly just delegates onward. โ†’ cut it, call the real target direct. +- **Refused Bequest**: a subclass or implementer that ignores or overrides most of what it inherits. โ†’ drop the inheritance, use composition. ### 4. Spawn both sub-agents in parallel -Send a single message with two `Agent` tool calls. Use the `general-purpose` subagent for both. - -**Standards sub-agent prompt** โ€” include: +**Standards sub-agent prompt** should include: - The full diff command and commit list. -- The list of standards-source files you found in step 3, **plus the smell baseline from step 3** pasted in full โ€” the sub-agent has no other access to it. -- The brief: "Report โ€” per file/hunk where relevant โ€” (a) every place the diff violates a documented standard: cite the standard (file + the rule); and (b) any baseline smell you spot: name it and quote the hunk. Distinguish hard violations from judgement calls โ€” documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented repo standard overrides the baseline. Skip anything tooling enforces. Under 400 words." +- The list of standards-source files you found in step 3, **plus the smell baseline from step 3** pasted in full (the sub-agent has no other access to it). +- The brief: "Report, per file/hunk where relevant, (a) every place the diff violates a documented standard: cite the standard (file + the rule); and (b) any baseline smell you spot: name it and quote the hunk. Distinguish hard violations from judgement calls: documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented repo standard overrides the baseline. Skip anything tooling enforces. Under 400 words." -**Spec sub-agent prompt** โ€” include: +**Spec sub-agent prompt** should include: - The diff command and commit list. - The path or fetched contents of the spec. @@ -75,9 +73,9 @@ If the spec is missing, skip the Spec sub-agent and note this in the final repor ### 5. Aggregate -Present the two reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. Do **not** merge or rerank findings โ€” the two axes are deliberately separate (see _Why two axes_). +Present the two reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. Do **not** merge or rerank findings, because the two axes are deliberately separate (see _Why two axes_). -End with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes โ€” that's the reranking the separation exists to prevent. +End with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes: that's the reranking the separation exists to prevent. ## Why two axes diff --git a/.agents/skills/codebase-design/DEEPENING.md b/.agents/skills/codebase-design/DEEPENING.md index 3938457..cd94075 100644 --- a/.agents/skills/codebase-design/DEEPENING.md +++ b/.agents/skills/codebase-design/DEEPENING.md @@ -1,6 +1,6 @@ # Deepening -How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [SKILL.md](SKILL.md) โ€” **module**, **interface**, **seam**, **adapter**. +How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [SKILL.md](SKILL.md): **module**, **interface**, **seam**, **adapter**. ## Dependency categories @@ -8,7 +8,7 @@ When assessing a candidate for deepening, classify its dependencies. The categor ### 1. In-process -Pure computation, in-memory state, no I/O. Always deepenable โ€” merge the modules and test through the new interface directly. No adapter needed. +Pure computation, in-memory state, no I/O. Always deepenable: merge the modules and test through the new interface directly. No adapter needed. ### 2. Local-substitutable @@ -31,7 +31,7 @@ Third-party services (Stripe, Twilio, etc.) you don't control. The deepened modu ## Testing strategy: replace, don't layer -- Old unit tests on shallow modules become waste once tests at the deepened module's interface exist โ€” delete them. +- Old unit tests on shallow modules become waste once tests at the deepened module's interface exist; delete them. - Write new tests at the deepened module's interface. The **interface is the test surface**. - Tests assert on observable outcomes through the interface, not internal state. -- Tests should survive internal refactors โ€” they describe behaviour, not implementation. If a test has to change when the implementation changes, it's testing past the interface. +- Tests should survive internal refactors, since they describe behaviour, not implementation. If a test has to change when the implementation changes, it's testing past the interface. diff --git a/.agents/skills/codebase-design/DESIGN-IT-TWICE.md b/.agents/skills/codebase-design/DESIGN-IT-TWICE.md index 49a7c42..7edc861 100644 --- a/.agents/skills/codebase-design/DESIGN-IT-TWICE.md +++ b/.agents/skills/codebase-design/DESIGN-IT-TWICE.md @@ -1,8 +1,8 @@ # Design It Twice -When the user wants to explore alternative interfaces for a chosen deepening candidate, use this parallel sub-agent pattern. Based on "Design It Twice" (Ousterhout) โ€” your first idea is unlikely to be the best. +When the user wants to explore alternative interfaces for a chosen deepening candidate, use this parallel sub-agent pattern. Based on "Design It Twice" (Ousterhout): your first idea is unlikely to be the best. -Uses the vocabulary in [SKILL.md](SKILL.md) โ€” **module**, **interface**, **seam**, **adapter**, **leverage**. +Uses the vocabulary in [SKILL.md](SKILL.md): **module**, **interface**, **seam**, **adapter**, **leverage**. ## Process @@ -12,33 +12,33 @@ Before spawning sub-agents, write a user-facing explanation of the problem space - The constraints any new interface would need to satisfy - The dependencies it would rely on, and which category they fall into (see [DEEPENING.md](DEEPENING.md)) -- A rough illustrative code sketch to ground the constraints โ€” not a proposal, just a way to make the constraints concrete +- A rough illustrative code sketch to ground the constraints, not a proposal, just a way to make the constraints concrete Show this to the user, then immediately proceed to Step 2. The user reads and thinks while the sub-agents work in parallel. ### 2. Spawn sub-agents -Spawn 3+ sub-agents in parallel using the Agent tool. Each must produce a **radically different** interface for the deepened module. +Spawn 3+ sub-agents in parallel. Each must produce a **radically different** interface for the deepened module. Prompt each sub-agent with a separate technical brief (file paths, coupling details, dependency category from [DEEPENING.md](DEEPENING.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each agent a different design constraint: -- Agent 1: "Minimize the interface โ€” aim for 1โ€“3 entry points max. Maximise leverage per entry point." -- Agent 2: "Maximise flexibility โ€” support many use cases and extension." -- Agent 3: "Optimise for the most common caller โ€” make the default case trivial." +- Agent 1: "Minimize the interface: aim for 1โ€“3 entry points max. Maximise leverage per entry point." +- Agent 2: "Maximise flexibility: support many use cases and extension." +- Agent 3: "Optimise for the most common caller: make the default case trivial." - Agent 4 (if applicable): "Design around ports & adapters for cross-seam dependencies." Include both [SKILL.md](SKILL.md) vocabulary and CONTEXT.md vocabulary in the brief so each sub-agent names things consistently with the architecture language and the project's domain language. Each sub-agent outputs: -1. Interface (types, methods, params โ€” plus invariants, ordering, error modes) +1. Interface (types, methods, params, plus invariants, ordering, error modes) 2. Usage example showing how callers use it 3. What the implementation hides behind the seam 4. Dependency strategy and adapters (see [DEEPENING.md](DEEPENING.md)) -5. Trade-offs โ€” where leverage is high, where it's thin +5. Trade-offs: where leverage is high, where it's thin ### 3. Present and compare Present designs sequentially so the user can absorb each one, then compare them in prose. Contrast by **depth** (leverage at the interface), **locality** (where change concentrates), and **seam placement**. -After comparing, give your own recommendation: which design you think is strongest and why. If elements from different designs would combine well, propose a hybrid. Be opinionated โ€” the user wants a strong read, not a menu. +After comparing, give your own recommendation: which design you think is strongest and why. If elements from different designs would combine well, propose a hybrid. Be opinionated: the user wants a strong read, not a menu. diff --git a/.agents/skills/codebase-design/SKILL.md b/.agents/skills/codebase-design/SKILL.md index 16620c2..3f63c81 100644 --- a/.agents/skills/codebase-design/SKILL.md +++ b/.agents/skills/codebase-design/SKILL.md @@ -9,23 +9,23 @@ Design **deep modules**: a lot of behaviour behind a small interface, placed at ## Glossary -Use these terms exactly โ€” don't substitute "component," "service," "API," or "boundary." Consistent language is the whole point. +Use these terms exactly: don't substitute "component," "service," "API," or "boundary." Consistent language is the whole point. -**Module** โ€” anything with an interface and an implementation. Deliberately scale-agnostic: a function, class, package, or tier-spanning slice. _Avoid_: unit, component, service. +**Module**: anything with an interface and an implementation. Deliberately scale-agnostic: a function, class, package, or tier-spanning slice. _Avoid_: unit, component, service. -**Interface** โ€” everything a caller must know to use the module correctly: the type signature, but also invariants, ordering constraints, error modes, required configuration, and performance characteristics. _Avoid_: API, signature (too narrow โ€” they refer only to the type-level surface). +**Interface**: everything a caller must know to use the module correctly: the type signature, but also invariants, ordering constraints, error modes, required configuration, and performance characteristics. _Avoid_: API, signature (too narrow, they refer only to the type-level surface). -**Implementation** โ€” what's inside a module, its body of code. Distinct from **Adapter**: a thing can be a small adapter with a large implementation (a Postgres repo) or a large adapter with a small implementation (an in-memory fake). Reach for "adapter" when the seam is the topic; "implementation" otherwise. +**Implementation**: what's inside a module, its body of code. Distinct from **Adapter**: a thing can be a small adapter with a large implementation (a Postgres repo) or a large adapter with a small implementation (an in-memory fake). Reach for "adapter" when the seam is the topic; "implementation" otherwise. -**Depth** โ€” leverage at the interface: the amount of behaviour a caller (or test) can exercise per unit of interface they have to learn. A module is **deep** when a large amount of behaviour sits behind a small interface, **shallow** when the interface is nearly as complex as the implementation. +**Depth**: leverage at the interface. The amount of behaviour a caller (or test) can exercise per unit of interface they have to learn. A module is **deep** when a large amount of behaviour sits behind a small interface, **shallow** when the interface is nearly as complex as the implementation. -**Seam** _(Michael Feathers)_ โ€” a place where you can alter behaviour without editing in that place; the *location* at which a module's interface lives. Where to put the seam is its own design decision, distinct from what goes behind it. _Avoid_: boundary (overloaded with DDD's bounded context). +**Seam** _(Michael Feathers)_: a place where you can alter behaviour without editing in that place; the *location* at which a module's interface lives. Where to put the seam is its own design decision, distinct from what goes behind it. _Avoid_: boundary (overloaded with DDD's bounded context). -**Adapter** โ€” a concrete thing that satisfies an interface at a seam. Describes *role* (what slot it fills), not substance (what's inside). +**Adapter**: a concrete thing that satisfies an interface at a seam. Describes *role* (what slot it fills), not substance (what's inside). -**Leverage** โ€” what callers get from depth: more capability per unit of interface they learn. One implementation pays back across N call sites and M tests. +**Leverage**: what callers get from depth. More capability per unit of interface they learn. One implementation pays back across N call sites and M tests. -**Locality** โ€” what maintainers get from depth: change, bugs, knowledge, and verification concentrate in one place rather than spreading across callers. Fix once, fixed everywhere. +**Locality**: what maintainers get from depth. Change, bugs, knowledge, and verification concentrate in one place rather than spreading across callers. Fix once, fixed everywhere. ## Deep vs shallow @@ -59,7 +59,7 @@ When designing an interface, ask: ## Principles -- **Depth is a property of the interface, not the implementation.** A deep module can be internally composed of small, mockable, swappable parts โ€” they just aren't part of the interface. A module can have **internal seams** (private to its implementation, used by its own tests) as well as the **external seam** at its interface. +- **Depth is a property of the interface, not the implementation.** A deep module can be internally composed of small, mockable, swappable parts; they just aren't part of the interface. A module can have **internal seams** (private to its implementation, used by its own tests) as well as the **external seam** at its interface. - **The deletion test.** Imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep. - **The interface is the test surface.** Callers and tests cross the same seam. If you want to test *past* the interface, the module is probably the wrong shape. - **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a seam unless something actually varies across it. @@ -105,10 +105,10 @@ Good interfaces make testing natural: ## Rejected framings - **Depth as ratio of implementation-lines to interface-lines** (Ousterhout): rewards padding the implementation. We use depth-as-leverage instead. -- **"Interface" as the TypeScript `interface` keyword or a class's public methods**: too narrow โ€” interface here includes every fact a caller must know. +- **"Interface" as the TypeScript `interface` keyword or a class's public methods**: too narrow: interface here includes every fact a caller must know. - **"Boundary"**: overloaded with DDD's bounded context. Say **seam** or **interface**. ## Going deeper -- **Deepening a cluster given its dependencies** โ€” see [DEEPENING.md](DEEPENING.md): dependency categories, seam discipline, and replace-don't-layer testing. -- **Exploring alternative interfaces** โ€” see [DESIGN-IT-TWICE.md](DESIGN-IT-TWICE.md): spin up parallel sub-agents to design the interface several radically different ways, then compare on depth, locality, and seam placement. +- **Deepening a cluster given its dependencies**, see [DEEPENING.md](DEEPENING.md): dependency categories, seam discipline, and replace-don't-layer testing. +- **Exploring alternative interfaces**, see [DESIGN-IT-TWICE.md](DESIGN-IT-TWICE.md): spin up parallel sub-agents to design the interface several radically different ways, then compare on depth, locality, and seam placement. diff --git a/.agents/skills/diagnosing-bugs/SKILL.md b/.agents/skills/diagnosing-bugs/SKILL.md index f400de7..061c25a 100644 --- a/.agents/skills/diagnosing-bugs/SKILL.md +++ b/.agents/skills/diagnosing-bugs/SKILL.md @@ -9,18 +9,24 @@ A discipline for hard bugs. Skip phases only when explicitly justified. When exploring the codebase, read `CONTEXT.md` (if it exists) to get a clear mental model of the relevant modules, and check ADRs in the area you're touching. -## Phase 1 โ€” Build a feedback loop +## Redact -**This is the skill.** Everything else is mechanical. If you have a **tight** pass/fail signal for the bug โ€” one that goes red on _this_ bug โ€” you will find the cause; bisection, hypothesis-testing, and instrumentation all just consume it. If you don't have one, no amount of staring at code will save you. +This skill has you show commands, outputs and captured artifacts. **Redact every secret first**: write `` in its place. Build loops against env vars, so the credential stays in the environment rather than in what you show. Captured artifacts carry auth headers: quote only the lines that carry the signal. + +If the redacted output is not enough to diagnose the bug, say so and ask the user. + +## Phase 1: Build a feedback loop + +**This is the skill.** Everything else is mechanical. If you have a **tight** pass/fail signal for the bug (one that goes red on _this_ bug), you will find the cause; bisection, hypothesis-testing, and instrumentation all just consume it. If you don't have one, no amount of staring at code will save you. Spend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.** -### Ways to construct one โ€” try them in roughly this order +### Ways to construct one, in roughly this order -1. **Failing test** at whatever seam reaches the bug โ€” unit, integration, e2e. +1. **Failing test** at whatever seam reaches the bug: unit, integration, e2e. 2. **Curl / HTTP script** against a running dev server. 3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot. -4. **Headless browser script** (Playwright / Puppeteer) โ€” drives the UI, asserts on DOM/console/network. +4. **Headless browser script** (Playwright / Puppeteer) that drives the UI and asserts on DOM/console/network. 5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation. 6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call. 7. **Property / fuzz loop.** If the bug is "sometimes wrong output", run 1000 random inputs and look for the failure mode. @@ -38,48 +44,48 @@ Treat the loop as a product. Once you have _a_ loop, **tighten** it: - Can I make the signal sharper? (Assert on the specific symptom, not "didn't crash".) - Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.) -A 30-second flaky loop is barely better than no loop; a 2-second deterministic one is tight โ€” a debugging superpower. +A 30-second flaky loop is barely better than no loop; a 2-second deterministic one is tight, a debugging superpower. ### Non-deterministic bugs -The goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100ร—, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not โ€” keep raising the rate until it's debuggable. +The goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100ร—, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not, so keep raising the rate until it's debuggable. ### When you genuinely cannot build a loop -Stop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop. +Stop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a redacted captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop. -### Completion criterion โ€” a tight loop that goes red +### Completion criterion: a tight loop that goes red -Phase 1 is done when the loop is **tight** and **red-capable**: you can name **one command** โ€” a script path, a test invocation, a curl โ€” that you have **already run at least once** (paste the invocation and its output), and that is: +Phase 1 is done when the loop is **tight** and **red-capable**: you can name **one command** (a script path, a test invocation, a curl) that you have **already run at least once** (show the invocation and its output, redacted), and that is: -- [ ] **Red-capable** โ€” it drives the actual bug code path and asserts the **user's exact symptom**, so it can go red on this bug and green once fixed. Not "runs without erroring" โ€” it must be able to _catch this specific bug_. -- [ ] **Deterministic** โ€” same verdict every run (flaky bugs: a pinned, high reproduction rate, per above). -- [ ] **Fast** โ€” seconds, not minutes. -- [ ] **Agent-runnable** โ€” you can run it unattended; a human in the loop only via `scripts/hitl-loop.template.sh`. +- [ ] **Red-capable**: it drives the actual bug code path and asserts the **user's exact symptom**, so it can go red on this bug and green once fixed. Not "runs without erroring"; it must be able to _catch this specific bug_. +- [ ] **Deterministic**: same verdict every run (flaky bugs: a pinned, high reproduction rate, per above). +- [ ] **Fast**: seconds, not minutes. +- [ ] **Agent-runnable**: you can run it unattended; a human in the loop only via `scripts/hitl-loop.template.sh`. -If you catch yourself reading code to build a theory before this command exists, **stop โ€” jumping straight to a hypothesis is the exact failure this skill prevents.** No red-capable command, no Phase 2. +If you catch yourself reading code to build a theory before this command exists, **stop: jumping straight to a hypothesis is the exact failure this skill prevents.** No red-capable command, no Phase 2. -## Phase 2 โ€” Reproduce + minimise +## Phase 2: Reproduce + minimise -Run the loop. Watch it go red โ€” the bug appears. +Run the loop. Watch it go red as the bug appears. Confirm: -- [ ] The loop produces the failure mode the **user** described โ€” not a different failure that happens to be nearby. Wrong bug = wrong fix. +- [ ] The loop produces the failure mode the **user** described, not a different failure that happens to be nearby. Wrong bug = wrong fix. - [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against). - [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it. ### Minimise -Once it's red, shrink the repro to the **smallest scenario that still goes red**. Cut inputs, callers, config, data, and steps **one at a time**, re-running the loop after each cut โ€” keep only what's load-bearing for the failure. +Once it's red, shrink the repro to the **smallest scenario that still goes red**. Cut inputs, callers, config, data, and steps **one at a time**, re-running the loop after each cut, and keep only what's load-bearing for the failure. Why bother: a minimal repro shrinks the hypothesis space in Phase 3 (fewer moving parts left to suspect) and becomes the clean regression test in Phase 5. -Done when **every remaining element is load-bearing** โ€” removing any one of them makes the loop go green. +Done when **every remaining element is load-bearing**: removing any one of them makes the loop go green. Do not proceed until you have reproduced **and** minimised. -## Phase 3 โ€” Hypothesise +## Phase 3: Hypothesise Generate **3โ€“5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea. @@ -87,11 +93,11 @@ Each hypothesis must be **falsifiable**: state the prediction it makes. > Format: "If is the cause, then will make the bug disappear / will make it worse." -If you cannot state the prediction, the hypothesis is a vibe โ€” discard or sharpen it. +If you cannot state the prediction, the hypothesis is a vibe: discard or sharpen it. -**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly ("we just deployed a change to #3"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it โ€” proceed with your ranking if the user is AFK. +**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly ("we just deployed a change to #3"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it; proceed with your ranking if the user is AFK. -## Phase 4 โ€” Instrument +## Phase 4: Instrument Each probe must map to a specific prediction from Phase 3. **Change one variable at a time.** @@ -105,9 +111,9 @@ Tool preference: **Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second. -## Phase 5 โ€” Fix + regression test +## Phase 5: Fix + regression test -Write the regression test **before the fix** โ€” but only if there is a **correct seam** for it. +Write the regression test **before the fix**, but only if there is a **correct seam** for it. A correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence. @@ -121,7 +127,7 @@ If a correct seam exists: 4. Watch it pass. 5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario. -## Phase 6 โ€” Cleanup + post-mortem +## Phase 6: Cleanup Required before declaring done: @@ -129,6 +135,4 @@ Required before declaring done: - [ ] Regression test passes (or absence of seam is documented) - [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix) - [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location) -- [ ] The hypothesis that turned out correct is stated in the commit / PR message โ€” so the next debugger learns - -**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `/improve-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before โ€” you have more information now than when you started. +- [ ] The hypothesis that turned out correct is stated in the commit / PR message, so the next debugger learns diff --git a/.agents/skills/diagnosing-bugs/scripts/hitl-loop.template.sh b/.agents/skills/diagnosing-bugs/scripts/hitl-loop.template.sh index 40afc46..2431984 100644 --- a/.agents/skills/diagnosing-bugs/scripts/hitl-loop.template.sh +++ b/.agents/skills/diagnosing-bugs/scripts/hitl-loop.template.sh @@ -11,6 +11,9 @@ # capture VAR "" โ†’ show question, read response into VAR # # At the end, captured values are printed as KEY=VALUE for the agent to parse. +# +# `capture` prints its value back to the terminal, where the agent reads it, +# so capture observations, and leave signing in to the user as a `step`. set -euo pipefail diff --git a/.agents/skills/domain-modeling/ADR-FORMAT.md b/.agents/skills/domain-modeling/ADR-FORMAT.md index da7e78e..d7e61f3 100644 --- a/.agents/skills/domain-modeling/ADR-FORMAT.md +++ b/.agents/skills/domain-modeling/ADR-FORMAT.md @@ -2,7 +2,7 @@ ADRs live in `docs/adr/` and use sequential numbering: `0001-slug.md`, `0002-slug.md`, etc. -Create the `docs/adr/` directory lazily โ€” only when the first ADR is needed. +Create the `docs/adr/` directory lazily: only when the first ADR is needed. ## Template @@ -12,15 +12,15 @@ Create the `docs/adr/` directory lazily โ€” only when the first ADR is needed. {1-3 sentences: what's the context, what did we decide, and why.} ``` -That's it. An ADR can be a single paragraph. The value is in recording *that* a decision was made and *why* โ€” not in filling out sections. +That's it. An ADR can be a single paragraph. The value is in recording *that* a decision was made and *why*, not in filling out sections. ## Optional sections Only include these when they add genuine value. Most ADRs won't need them. -- **Status** frontmatter (`proposed | accepted | deprecated | superseded by ADR-NNNN`) โ€” useful when decisions are revisited -- **Considered Options** โ€” only when the rejected alternatives are worth remembering -- **Consequences** โ€” only when non-obvious downstream effects need to be called out +- **Status** frontmatter (`proposed | accepted | deprecated | superseded by ADR-NNNN`): useful when decisions are revisited +- **Considered Options**: only when the rejected alternatives are worth remembering +- **Consequences**: only when non-obvious downstream effects need to be called out ## Numbering @@ -30,18 +30,18 @@ Scan `docs/adr/` for the highest existing number and increment by one. All three of these must be true: -1. **Hard to reverse** โ€” the cost of changing your mind later is meaningful -2. **Surprising without context** โ€” a future reader will look at the code and wonder "why on earth did they do it this way?" -3. **The result of a real trade-off** โ€” there were genuine alternatives and you picked one for specific reasons +1. **Hard to reverse**: the cost of changing your mind later is meaningful +2. **Surprising without context**: a future reader will look at the code and wonder "why on earth did they do it this way?" +3. **The result of a real trade-off**: there were genuine alternatives and you picked one for specific reasons -If a decision is easy to reverse, skip it โ€” you'll just reverse it. If it's not surprising, nobody will wonder why. If there was no real alternative, there's nothing to record beyond "we did the obvious thing." +If a decision is easy to reverse, skip it: you'll just reverse it. If it's not surprising, nobody will wonder why. If there was no real alternative, there's nothing to record beyond "we did the obvious thing." ### What qualifies - **Architectural shape.** "We're using a monorepo." "The write model is event-sourced, the read model is projected into Postgres." - **Integration patterns between contexts.** "Ordering and Billing communicate via domain events, not synchronous HTTP." -- **Technology choices that carry lock-in.** Database, message bus, auth provider, deployment target. Not every library โ€” just the ones that would take a quarter to swap out. +- **Technology choices that carry lock-in.** Database, message bus, auth provider, deployment target. Not every library: just the ones that would take a quarter to swap out. - **Boundary and scope decisions.** "Customer data is owned by the Customer context; other contexts reference it by ID only." The explicit no-s are as valuable as the yes-s. - **Deliberate deviations from the obvious path.** "We're using manual SQL instead of an ORM because X." Anything where a reasonable reader would assume the opposite. These stop the next engineer from "fixing" something that was deliberate. - **Constraints not visible in the code.** "We can't use AWS because of compliance requirements." "Response times must be under 200ms because of the partner API contract." -- **Rejected alternatives when the rejection is non-obvious.** If you considered GraphQL and picked REST for subtle reasons, record it โ€” otherwise someone will suggest GraphQL again in six months. +- **Rejected alternatives when the rejection is non-obvious.** If you considered GraphQL and picked REST for subtle reasons, record it; otherwise someone will suggest GraphQL again in six months. diff --git a/.agents/skills/domain-modeling/CONTEXT-FORMAT.md b/.agents/skills/domain-modeling/CONTEXT-FORMAT.md index eaf2a18..79bbb32 100644 --- a/.agents/skills/domain-modeling/CONTEXT-FORMAT.md +++ b/.agents/skills/domain-modeling/CONTEXT-FORMAT.md @@ -40,9 +40,9 @@ _Avoid_: Client, buyer, account ## Contexts -- [Ordering](./src/ordering/CONTEXT.md) โ€” receives and tracks customer orders -- [Billing](./src/billing/CONTEXT.md) โ€” generates invoices and processes payments -- [Fulfillment](./src/fulfillment/CONTEXT.md) โ€” manages warehouse picking and shipping +- [Ordering](./src/ordering/CONTEXT.md): receives and tracks customer orders +- [Billing](./src/billing/CONTEXT.md): generates invoices and processes payments +- [Fulfillment](./src/fulfillment/CONTEXT.md): manages warehouse picking and shipping ## Relationships diff --git a/.agents/skills/domain-modeling/SKILL.md b/.agents/skills/domain-modeling/SKILL.md index d0f7e1a..9b97707 100644 --- a/.agents/skills/domain-modeling/SKILL.md +++ b/.agents/skills/domain-modeling/SKILL.md @@ -1,11 +1,11 @@ --- name: domain-modeling -description: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model. +description: Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a CONTEXT.md, or recording or editing an ADR. --- # Domain Modeling -Actively build and sharpen the project's domain model as you design. This is the *active* discipline โ€” challenging terms, inventing edge-case scenarios, and writing the glossary and decisions down the moment they crystallise. (Merely *reading* `CONTEXT.md` for vocabulary is not this skill โ€” that's a one-line habit any skill can do. This skill is for when you're changing the model, not just consuming it.) +Actively build and sharpen the project's domain model as you design. This is the *active* discipline: challenging terms, inventing edge-case scenarios, and writing the glossary and decisions down the moment they crystallise. (Merely *reading* `CONTEXT.md` for vocabulary is not this skill: that's a one-line habit any skill can do. This skill is for when you're changing the model, not just consuming it.) ## File structure @@ -37,17 +37,17 @@ If a `CONTEXT-MAP.md` exists at the root, the repo has multiple contexts. The ma โ”‚ โ””โ”€โ”€ docs/adr/ ``` -Create files lazily โ€” only when you have something to write. If no `CONTEXT.md` exists, create one when the first term is resolved. If no `docs/adr/` exists, create it when the first ADR is needed. +Create files lazily: only when you have something to write. If no `CONTEXT.md` exists, create one when the first term is resolved. If no `docs/adr/` exists, create it when the first ADR is needed. ## During the session ### Challenge against the glossary -When the user uses a term that conflicts with the existing language in `CONTEXT.md`, call it out immediately. "Your glossary defines 'cancellation' as X, but you seem to mean Y โ€” which is it?" +When the user uses a term that conflicts with the existing language in `CONTEXT.md`, call it out immediately. "Your glossary defines 'cancellation' as X, but you seem to mean Y. Which is it?" ### Sharpen fuzzy language -When the user uses vague or overloaded terms, propose a precise canonical term. "You're saying 'account' โ€” do you mean the Customer or the User? Those are different things." +When the user uses vague or overloaded terms, propose a precise canonical term. "You're saying 'account': do you mean the Customer or the User? Those are different things." ### Discuss concrete scenarios @@ -55,11 +55,11 @@ When domain relationships are being discussed, stress-test them with specific sc ### Cross-reference with code -When the user states how something works, check whether the code agrees. If you find a contradiction, surface it: "Your code cancels entire Orders, but you just said partial cancellation is possible โ€” which is right?" +When the user states how something works, check whether the code agrees. If you find a contradiction, surface it: "Your code cancels entire Orders, but you just said partial cancellation is possible. Which is right?" ### Update CONTEXT.md inline -When a term is resolved, update `CONTEXT.md` right there. Don't batch these up โ€” capture them as they happen. Use the format in [CONTEXT-FORMAT.md](./CONTEXT-FORMAT.md). +When a term is resolved, update `CONTEXT.md` right there. Don't batch these up: capture them as they happen. Use the format in [CONTEXT-FORMAT.md](./CONTEXT-FORMAT.md). `CONTEXT.md` should be totally devoid of implementation details. Do not treat `CONTEXT.md` as a spec, a scratch pad, or a repository for implementation decisions. It is a glossary and nothing else. @@ -67,8 +67,8 @@ When a term is resolved, update `CONTEXT.md` right there. Don't batch these up Only offer to create an ADR when all three are true: -1. **Hard to reverse** โ€” the cost of changing your mind later is meaningful -2. **Surprising without context** โ€” a future reader will wonder "why did they do it this way?" -3. **The result of a real trade-off** โ€” there were genuine alternatives and you picked one for specific reasons +1. **Hard to reverse**: the cost of changing your mind later is meaningful +2. **Surprising without context**: a future reader will wonder "why did they do it this way?" +3. **The result of a real trade-off**: there were genuine alternatives and you picked one for specific reasons If any of the three is missing, skip the ADR. Use the format in [ADR-FORMAT.md](./ADR-FORMAT.md). diff --git a/.agents/skills/git-guardrails-claude-code/SKILL.md b/.agents/skills/git-guardrails-claude-code/SKILL.md new file mode 100644 index 0000000..58bcdd8 --- /dev/null +++ b/.agents/skills/git-guardrails-claude-code/SKILL.md @@ -0,0 +1,95 @@ +--- +name: git-guardrails-claude-code +description: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code. +--- + +# Setup Git Guardrails + +Sets up a PreToolUse hook that intercepts and blocks dangerous git commands before Claude executes them. + +## What Gets Blocked + +- `git push` (all variants including `--force`) +- `git reset --hard` +- `git clean -f` / `git clean -fd` +- `git branch -D` +- `git checkout .` / `git restore .` + +When blocked, Claude sees a message telling it that it does not have authority to access these commands. + +## Steps + +### 1. Ask scope + +Ask the user: install for **this project only** (`.claude/settings.json`) or **all projects** (`~/.claude/settings.json`)? + +### 2. Copy the hook script + +The bundled script is at: [scripts/block-dangerous-git.sh](scripts/block-dangerous-git.sh) + +Copy it to the target location based on scope: + +- **Project**: `.claude/hooks/block-dangerous-git.sh` +- **Global**: `~/.claude/hooks/block-dangerous-git.sh` + +Make it executable with `chmod +x`. + +### 3. Add hook to settings + +Add to the appropriate settings file: + +**Project** (`.claude/settings.json`): + +```json +{ + "hooks": { + "PreToolUse": [ + { + "matcher": "Bash", + "hooks": [ + { + "type": "command", + "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous-git.sh" + } + ] + } + ] + } +} +``` + +**Global** (`~/.claude/settings.json`): + +```json +{ + "hooks": { + "PreToolUse": [ + { + "matcher": "Bash", + "hooks": [ + { + "type": "command", + "command": "~/.claude/hooks/block-dangerous-git.sh" + } + ] + } + ] + } +} +``` + +If the settings file already exists, merge the hook into the existing `hooks.PreToolUse` array. Don't overwrite other settings. + +### 4. Ask about customization + +Ask if user wants to add or remove any patterns from the blocked list. Edit the copied script accordingly. + +### 5. Verify + +Run a quick test: + +```bash +echo '{"tool_input":{"command":"git push origin main"}}' | +``` + +Should exit with code 2 and print a BLOCKED message to stderr. diff --git a/.agents/skills/git-guardrails-claude-code/agents/openai.yaml b/.agents/skills/git-guardrails-claude-code/agents/openai.yaml new file mode 100644 index 0000000..3f5d756 --- /dev/null +++ b/.agents/skills/git-guardrails-claude-code/agents/openai.yaml @@ -0,0 +1,3 @@ +interface: + display_name: "Git Guardrails for Claude Code" + short_description: "Block dangerous git commands" diff --git a/.agents/skills/git-guardrails-claude-code/scripts/block-dangerous-git.sh b/.agents/skills/git-guardrails-claude-code/scripts/block-dangerous-git.sh new file mode 100755 index 0000000..c40b59c --- /dev/null +++ b/.agents/skills/git-guardrails-claude-code/scripts/block-dangerous-git.sh @@ -0,0 +1,25 @@ +#!/bin/bash + +INPUT=$(cat) +COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command') + +DANGEROUS_PATTERNS=( + "git push" + "git reset --hard" + "git clean -fd" + "git clean -f" + "git branch -D" + "git checkout \." + "git restore \." + "push --force" + "reset --hard" +) + +for pattern in "${DANGEROUS_PATTERNS[@]}"; do + if echo "$COMMAND" | grep -qE "$pattern"; then + echo "BLOCKED: '$COMMAND' matches dangerous pattern '$pattern'. The user has prevented you from doing this." >&2 + exit 2 + fi +done + +exit 0 diff --git a/.agents/skills/grill-me/SKILL.md b/.agents/skills/grill-me/SKILL.md index 9470cfc..3947ff9 100644 --- a/.agents/skills/grill-me/SKILL.md +++ b/.agents/skills/grill-me/SKILL.md @@ -4,4 +4,4 @@ description: A relentless interview to sharpen a plan or design. disable-model-invocation: true --- -Run a `/grilling` session. +Call the Skill tool with "grilling". diff --git a/.agents/skills/grill-with-docs/SKILL.md b/.agents/skills/grill-with-docs/SKILL.md index bed05d2..62b9efb 100644 --- a/.agents/skills/grill-with-docs/SKILL.md +++ b/.agents/skills/grill-with-docs/SKILL.md @@ -4,4 +4,4 @@ description: A relentless interview to sharpen a plan or design, which also crea disable-model-invocation: true --- -Run a `/grilling` session, using the `/domain-modeling` skill. +Call the Skill tool twice, for "grilling" and "domain-modeling". diff --git a/.agents/skills/grilling/SKILL.md b/.agents/skills/grilling/SKILL.md index 52d8eb3..8ca78c6 100644 --- a/.agents/skills/grilling/SKILL.md +++ b/.agents/skills/grilling/SKILL.md @@ -3,10 +3,26 @@ name: grilling description: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases. --- -Interview me relentlessly about every aspect of this until we reach a shared understanding. Walk down each branch of the decision tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer. +Interview the user relentlessly until you reach a shared understanding. Map this as a **design tree**: every decision branches into the decisions that hang off it. -Ask the questions one at a time, waiting for feedback on each question before continuing. Asking multiple questions at once is bewildering. +Work the tree in **rounds**. The **frontier** is every decision whose prerequisites are already settled: the questions you can ask _now_ without guessing at answers you haven't heard yet. Ask the whole frontier in one round: number each question and give your recommended answer. Then wait for the user's answers before the next round. -If a *fact* can be found by exploring the environment (filesystem, tools, etc.), look it up rather than asking me. The *decisions*, though, are mine โ€” put each one to me and wait for my answer. +Format a round like so: -Do not act on it until I confirm we have reached a shared understanding. +``` +โ“ **Q1** - ****: + +โžก๏ธ + +--- + +โ“ **Q2** - ****: + +โžก๏ธ +``` + +Each round the user answers reshapes the tree: settled decisions push the frontier outward and unblock questions that depended on them. Recompute the frontier and ask the next round. A question whose answer depends on another question still open in this round belongs to a _later_ round, not this one. + +Finding _facts_ is your job, never the user's. When a frontier question needs a fact from the environment (filesystem, tools, etc.), dispatch a sub-agent to find it; don't ask the user for anything you could look up yourself. Don't block on it: a running exploration is an unsettled prerequisite, so only the questions downstream of it wait for the sub-agent to report; ask the rest of the frontier now. The _decisions_ are the user's: put each to them and wait. + +The session is done when the frontier is empty: every branch of the design tree visited, nothing left silently assumed. Do not act on it until the user confirms you have reached a shared understanding. diff --git a/.agents/skills/grilling/agents/openai.yaml b/.agents/skills/grilling/agents/openai.yaml index 85b1260..ddbdb96 100644 --- a/.agents/skills/grilling/agents/openai.yaml +++ b/.agents/skills/grilling/agents/openai.yaml @@ -1,3 +1,3 @@ interface: display_name: "Grilling" - short_description: "Stress-test thinking one question at a time" + short_description: "Stress-test thinking a round of questions at a time" diff --git a/.agents/skills/handoff/SKILL.md b/.agents/skills/handoff/SKILL.md index 043d9e1..2eb98a5 100644 --- a/.agents/skills/handoff/SKILL.md +++ b/.agents/skills/handoff/SKILL.md @@ -7,7 +7,7 @@ disable-model-invocation: true Write a handoff document summarising the current conversation so a fresh agent can continue the work. Save to the temporary directory of the user's OS - not the current workspace. -Include a "suggested skills" section in the document, which suggests skills that the agent should invoke. +Include a "suggested skills" section in the document, naming which skills the next agent should call the Skill tool for. Do not duplicate content already captured in other artifacts (specs, plans, ADRs, issues, commits, diffs). Reference them by path or URL instead. diff --git a/.agents/skills/implement-spec/SKILL.md b/.agents/skills/implement-spec/SKILL.md new file mode 100644 index 0000000..d5097f8 --- /dev/null +++ b/.agents/skills/implement-spec/SKILL.md @@ -0,0 +1,35 @@ +--- +name: implement-spec +description: "Implement a specification in code." +disable-model-invocation: true +--- + +You have been provided a spec. This spec should have tickets associated with it, describing how to implement the spec. + +The goal is a PR which implements the entire spec on a single branch. + +The tickets are not a list of steps. They are a **task graph** with blocking relationships between them. This means there is always a **frontier** of tickets which are ready to be grabbed. + +Communication to and from subagents should be sparse. Communicate primarily through **context pointers**: to the spec, tickets, research notes, and previous commits. Don't duplicate information already available via pointers. + +**Implementer subagents** should be run in the background where possible for **maximum concurrency**. + +## Steps + +1. Read the spec and tickets. Read enough to understand the task graph. + +2. (optional) Use an **exploration subagent** to conduct any exploration required by the tickets - relevant codebase files or external documentation. Ensure the exploration subagent can save files - it should save its markdown notes in a directory outside the repo, accessible by all future subagents. This lets **implementer subagents** focus on implementation rather than exploration. + +3. Create a branch, and a draft PR. The PR should be marked as 'closing' the spec issue and tickets. + +4. Use **implementer subagents** to implement each ticket. Each implementer subagent should work in its own worktree, on its own branch. + +5. Once an **implementer subagent** completes, merge its work to the PR branch with a **merger subagent**. + +6. If this changes the **frontier** of available tickets, kick off more **implementer subagents** to work on the new tickets. This allows for maximum concurrency. + +7. Once all tickets are complete, run /code-review on the PR branch. Fix all issues raised by the code review in a single **implementer subagent**. + +8. Mark the PR as ready for review. + +9. Clean up all **implementer subagent** worktrees. diff --git a/.agents/skills/implement-spec/agents/openai.yaml b/.agents/skills/implement-spec/agents/openai.yaml new file mode 100644 index 0000000..043f27f --- /dev/null +++ b/.agents/skills/implement-spec/agents/openai.yaml @@ -0,0 +1,5 @@ +interface: + display_name: "Implement Spec" + short_description: "Implement a whole spec as one PR" +policy: + allow_implicit_invocation: false diff --git a/.agents/skills/improve-codebase-architecture/HTML-REPORT.md b/.agents/skills/improve-codebase-architecture/HTML-REPORT.md index 17f6d2c..e39e825 100644 --- a/.agents/skills/improve-codebase-architecture/HTML-REPORT.md +++ b/.agents/skills/improve-codebase-architecture/HTML-REPORT.md @@ -1,6 +1,6 @@ # HTML Report Format -The architectural review is rendered as a single self-contained HTML file in the OS temp directory. Tailwind and Mermaid both come from CDNs. Mermaid handles graph-shaped diagrams reliably; hand-built divs and inline SVG handle the more editorial visuals (mass diagrams, cross-sections). Mix the two โ€” don't lean on Mermaid for everything, it'll start to look generic. +The architectural review is rendered as a single self-contained HTML file in the OS temp directory. Tailwind and Mermaid both come from CDNs. Mermaid handles graph-shaped diagrams reliably; hand-built divs and inline SVG handle the more editorial visuals (mass diagrams, cross-sections). Mix the two: don't lean on Mermaid for everything, it'll start to look generic. ## Scaffold @@ -9,7 +9,7 @@ The architectural review is rendered as a single self-contained HTML file in the - Architecture review โ€” {{repo name}} + Architecture review for {{repo name}}