- extractMCPResult: parse isError from MCP response so tool failures
are returned as Go errors and marked isErr=true in the loop
- CallTool: emit isError:true content block instead of bare {"error":...}
so the model sees tool failures as error results, not success
- SetEnv: call os.Setenv so OLLIE_SESSION_ID/OLLIE are in the process
env and inherited by sandboxed subprocesses
- NewAgentCore: inject session env into execute server at creation time,
not only on rename, so tools have OLLIE_SESSION_ID from the first call
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Returns the fully rendered system prompt for the session, so
the 9P server can expose it via s/{id}/systemprompt.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
systemPrompt() now reads all *.md files from DefaultPromptsDir() in
lexical order (00_base.md, 01_foo.md, ...), applies template rendering
to each, and concatenates them with --- separators.
Removes hardcoded eager-loading of skills (reasoning, memory, task,
edit-text) and the skills package dependency. Those now live as numbered
prompt parts alongside the base prompt.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Skills are loaded into the system prompt from the first turn as an
alternative to encoding guidance in MCP schemas.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add TrustedToolsSetter interface and SetTrustedTools to execute.Server
- Add allowed(): trusted tools return true; untrusted with no Confirm
return false (deny by default). Confirm returns true=allow, consistent
with allowed() semantics throughout.
- BuildAgentEnv wires cfg.TrustedTools into the execute server
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
$OLLIE is the ollie root (FUSE mount). Renaming makes it shorter and
cleaner for use in sandboxed code. SetSessionID now resolves and
injects OLLIE into the execute server env so it is always available
regardless of whether the parent process has it set.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
detectLanguage only checked filepath.Base(fields[0]), which returns
"env" for #!/usr/bin/env python3. Every such script was run as bash,
producing syntax errors. Now checks fields[1] when fields[0] is "env".
Also add OLLIE_MEMORY_PATH to default env passthrough.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Physical ollie paths need RWX so tools can read/write/execute
both through the 9P mount and directly to the backing store.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reading from the 9P mount during session creation deadlocked the
server. Use skills.Read() to access the physical files directly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Read ollie/sk/reasoning.md and ollie/sk/memory.md from the 9P mount
and append them to the rendered system prompt. Removes dependency on
the model following a startup instruction.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Remove pkg/tools/file and pkg/tools/reasoning. Both are now implemented
as execute_tool scripts in ollie/t/ with feature parity:
- file_read, file_write, file_edit, file_grep, file_glob
- reasoning_think
isread guard delegated to /tmp/ollie/$OLLIE_SESSION_ID/<hash> markers.
SetSessionID renames the tmpdir on session rename.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Both idx files are now served as live synthetic files by the 9P server.
No physical files are written to disk.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replace {{.Tools}} injection with ollie/t/idx (generated at session
start by rebuildToolsIdx); prompt now instructs grep-based discovery
- Replace {{.Skills}} injection with ollie/sk/idx (rebuildSkillsIdx);
same grep pattern
- Add {{.SessionID}} to system prompt identity line
- Expand filesystem section: full ollie/s/ layout, all session files,
ctl commands, s/idx cooperation pattern
- Fix execute_tool description: use ollie/t instead of physical ToolsPath()
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
awk/sed/jq: exec.Command directly with program as arg — no shell, no escaping.
ed/expect/bc: exec.Command with cmd.Stdin — program piped without escaping.
execute_tool with file args: language switches to "bash" after injectArgs
since the resulting snippet is already a bash command.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
jq: filter as positional arg, file args appended, pipeline-safe.
expect: pipes script via printf '%s' $'...' | expect -.
bc: pipes via printf '%s' $'...' | bc -ql (quiet + math library).
All three use ANSI-C quoting consistently.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
sed: sed -e $'...' inline, file args appended, pipeline-safe.
ed: pipes script via printf '%s' $'...' | ed -s [file].
detectLanguage now parses shebang command basename rather than
using strings.Contains, fixing potential false matches.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Uses gawk -e $'...' (ANSI-C quoting) consistently across Execute() and
pipelines. injectArgs for awk produces a bash snippet with file args
after --. No BEGIN block hacks needed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
toolsSummary() scans OLLIE_TOOLS_PATH for # description: and # Args:
headers and injects the result as {{.Tools}} in the system prompt —
same effect as MCP schema injection but for shell/python tools.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
OLLIE_MEMORY_PATH and OLLIE_PLAN_PATH are user-configured paths that
belong in sandbox yaml overlays, not hardcoded into the built-in
defaults. Remove them from DefaultConfig() and SystemDefaults() env
lists, and remove the hardcoded XDG_DATA_HOME/ollie/memory rw path.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Delegate memory and task to MCP servers (denote-mcp, 9beads-mcp or
equivalents). When no MCP server provides these tools, the model
degrades gracefully — files in ollie/m and ollie/pl remain accessible
via file_* and execute_code. reasoning_think and file_* stay built-in.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add OLLIE_MEMORY_PATH to the env allowlist and both the env-var path and
the XDG default (~/.local/share/ollie/memory) to the RW filesystem list,
so file_* tools can read and write memory files.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- pkg/tools/memory: memory_remember + memory_recall with FlatDirBackend
baked in (no more injectable MemoryBackend abstraction)
- pkg/tools/task: task_plan + task_complete with file-based plan
persistence baked in (no more injectable PlanBackend abstraction)
- pkg/tools/reasoning: stripped to reasoning_think only
- pkg/tools/tools: remove PlanStep/PlanBackend/MemoryBackend interfaces
- pkg/agent: remove dispatchMemoryBackend, dispatchPlanBackend,
WithFallbackPlanBackend; BuildAgentEnv takes no options
Fixes infinite recursion crash: previously dispatchMemoryBackend routed
memory_recall back to the reasoning server that owned it, causing
unbounded mutual recursion and a goroutine stack overflow.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
file_read, file_write, file_edit, file_grep, and file_glob now check
paths against the sandbox config before operating. Same policy that
landrun enforces on execute_code, applied at the application level.
- Add sandbox.LoadMerged: loads base config + named layer, graceful
fallback if layer missing. Replaces duplicated logic in execute.
- Add sandbox.CheckPath: resolves symlinks, expands templates, checks
path against allowed entries (RO/ROX for read, RW/RWX for write).
- file.Server.checkAccess wires the check into every file dispatch.
Bare JSON scalars (0, true, null, "string") and arrays pass
json.Valid() but the Kiro API rejects them in the json field with
ValidationException. Once such a tool result is in session history,
every subsequent request fails, making the session unrecoverable.
Restrict the json path to content starting with '{' so only actual
JSON objects are sent that way; everything else uses the text field.
- Add SetSessionID to Core interface and agentCore implementation
- Renames persisted .json and .compaction.jsonl files on disk
- Propagates OLLIE_SESSION_ID env var to execute server
- Add /kill and /rn to /help output
/backend, /agent, /compact, and /clear now return an error if
the agent loop is active. These commands replace pointers or
mutate session state that the running loop holds by copy or
reference, leading to silent failures or races.
Strip flatfs-specific lifecycle instructions (filenames, sed, mv)
from the reasoning_plan tool description. The abstract tool now
describes only generic state transitions; concrete backends supply
their own instructions via CreatePlan response messages.
Levi Neely
Levi Neely