v4.4.0: safe editing, task lifecycle, rescue discovery

Add str_replace_editor tool for surgical edits to existing files (exact
unique match semantics). Add shrink guard to repo_write and
repo_write_commit that blocks accidental truncation of tracked files
(>30% size reduction requires force=true). Add STATUS_FAILED,
STATUS_INTERRUPTED, STATUS_CANCELLED to task lifecycle and wire them
into worker death, hard timeout, and cancel paths. Surface rescue
snapshots in health invariants so the agent discovers saved work after
restarts. Classify provider incomplete responses (finish_reason=null)
separately from genuine empty responses. Change default review
enforcement to advisory. Fix progress bubble opacity and duplicate emoji.

Made-with: Cursor

Author: Anton

README.md

@@ -6,7 +6,7 @@
 [![macOS 12+](https://img.shields.io/badge/macOS-12%2B-black.svg)](https://github.com/joi-lab/ouroboros-desktop/releases)
 [![Linux](https://img.shields.io/badge/Linux-x86__64-orange.svg)](https://github.com/joi-lab/ouroboros-desktop/releases)
 [![Windows](https://img.shields.io/badge/Windows-x64-blue.svg)](https://github.com/joi-lab/ouroboros-desktop/releases)
-[![Version 4.3.1](https://img.shields.io/badge/version-4.3.1-green.svg)](VERSION)
+[![Version 4.4.0](https://img.shields.io/badge/version-4.4.0-green.svg)](VERSION)
 
 A self-modifying AI agent that writes its own code, rewrites its own mind, and evolves autonomously. Born February 16, 2026.
 
@@ -238,6 +238,7 @@ Full text: [BIBLE.md](BIBLE.md)
 
 | Version | Date | Description |
 |---------|------|-------------|
+| 4.4.0 | 2026-03-19 | Safe editing release: `str_replace_editor` tool for surgical edits to existing files, `repo_write` shrink guard blocks accidental truncation of tracked files (>30% shrinkage), full task lifecycle statuses (failed/interrupted/cancelled) with honest status tracking, rescue snapshot discoverability via health invariants, `provider_incomplete_response` classification for OpenRouter glitches, default review enforcement changed to advisory, fix progress bubble opacity and duplicate emoji. |
 | 4.3.1 | 2026-03-19 | Fix: remove semi-transparent dimming from progress chat bubbles and remove duplicate `💬` emoji that appeared in both sender label and message text. |
 | 4.3.0 | 2026-03-19 | Reliability and continuity release: remove silent truncation from critical task/memory paths, persist honest subtask lifecycle states and full task results, restore transient chat wake banner, replace local-model hard prompt slicing with explicit non-core compaction plus fail-fast overflow, route Anthropic/OpenRouter calls without hard provider pinning while keeping parameter guarantees, and align async review calls with shared LLM routing/usage observability. |
 | 4.2.0 | 2026-03-16 | Cross-platform hardening release: replace Unix-only file locking in memory/consolidation with Windows-safe locking, refresh default model tiers (Opus main/code, Sonnet light/fallback, task effort `medium`), improve reconnect recovery with heartbeat/watchdog/history resync, switch local model chat format to auto-detect, and sync public docs with the current codebase and BIBLE structure. |

VERSION

@@ -1 +1 @@
-4.3.1
+4.4.0

docs/ARCHITECTURE.md

@@ -1,4 +1,4 @@
-# Ouroboros v4.3.1 — Architecture & Reference
+# Ouroboros v4.4.0 — Architecture & Reference
 
 This document describes every component, page, button, API endpoint, and data flow.
 It is the single source of truth for how the system works. Keep it updated.

ouroboros/agent.py

@@ -291,6 +291,16 @@ def handle_task(self, task: Dict[str, Any]) -> List[Dict[str, Any]]:
                     "traceback": truncate_for_log(tb, 2000),
                 })
                 text = f"⚠️ Error during processing: {type(e).__name__}: {e}"
+                try:
+                    from ouroboros.task_results import STATUS_FAILED, write_task_result
+                    write_task_result(
+                        self.env.drive_root,
+                        str(task.get("id") or ""),
+                        STATUS_FAILED,
+                        result=text,
+                    )
+                except Exception:
+                    pass
 
             if not isinstance(text, str) or not text.strip():
                 text = "⚠️ Model returned an empty response. Try rephrasing your request."

ouroboros/config.py

@@ -59,7 +59,7 @@
     # Pre-commit review: comma-separated list of OpenRouter model IDs
     "OUROBOROS_REVIEW_MODELS": "openai/gpt-5.4,google/gemini-3.1-pro-preview,anthropic/claude-opus-4.6",
     # Pre-commit review enforcement: advisory | blocking
-    "OUROBOROS_REVIEW_ENFORCEMENT": "blocking",
+    "OUROBOROS_REVIEW_ENFORCEMENT": "advisory",
     # Reasoning effort per task type: none | low | medium | high
     # OUROBOROS_INITIAL_REASONING_EFFORT remains a legacy alias for task/chat.
     "OUROBOROS_EFFORT_TASK": "medium",

ouroboros/context.py

@@ -503,7 +503,7 @@ def _append_provider_routing_health_checks(env: Any, checks: List[str]) -> None:
                     continue
                 evt_type = str(ev.get("type") or "")
                 model = str(ev.get("model") or "unknown")
-                if evt_type in {"llm_api_error", "review_model_error", "consciousness_llm_error"}:
+                if evt_type in {"llm_api_error", "review_model_error", "consciousness_llm_error", "provider_incomplete_response"}:
                     llm_error_models[model] += 1
                 elif evt_type == "local_context_overflow":
                     local_overflow_models[model] += 1
@@ -527,6 +527,36 @@ def _append_provider_routing_health_checks(env: Any, checks: List[str]) -> None:
         pass
 
 
+def _append_rescue_snapshot_checks(env: Any, checks: List[str]) -> None:
+    try:
+        import time as _time
+        rescue_dir = env.drive_path("archive/rescue")
+        if not rescue_dir.exists():
+            return
+        now = _time.time()
+        recent = []
+        for entry in sorted(rescue_dir.iterdir(), reverse=True):
+            if not entry.is_dir():
+                continue
+            age_sec = now - entry.stat().st_mtime
+            if age_sec < 7200:
+                meta_path = entry / "rescue_meta.json"
+                file_count = sum(1 for _ in entry.rglob("*") if _.is_file())
+                age_str = f"{int(age_sec // 60)}m ago" if age_sec < 3600 else f"{age_sec / 3600:.1f}h ago"
+                recent.append(f"{entry.name} ({age_str}, {file_count} files)")
+            if len(recent) >= 3:
+                break
+        if recent:
+            checks.append(
+                f"WARNING: RESCUE SNAPSHOT AVAILABLE — {', '.join(recent)}. "
+                "Uncommitted changes were saved before last restart. "
+                "Use data_read to inspect archive/rescue/<dirname>/rescue_meta.json "
+                "and changes.diff to decide if recovery is needed."
+            )
+    except Exception:
+        pass
+
+
 def build_health_invariants(env: Any) -> str:
     """Build health invariants section for LLM-first self-detection.
 
@@ -542,6 +572,7 @@ def build_health_invariants(env: Any) -> str:
     _append_duplicate_processing_checks(env, checks)
     _append_cache_hit_rate_checks(env, checks)
     _append_provider_routing_health_checks(env, checks)
+    _append_rescue_snapshot_checks(env, checks)
     try:
         _append_file_size_budget_checks(env, checks)
     except Exception:

ouroboros/loop_llm_call.py

@@ -110,24 +110,33 @@ def call_llm_with_retry(
             tool_calls = msg.get("tool_calls") or []
             content = msg.get("content")
             if not tool_calls and (not content or not content.strip()):
+                finish_reason = msg.get("finish_reason") or msg.get("stop_reason")
+                is_provider_glitch = finish_reason is None
+                event_type = "provider_incomplete_response" if is_provider_glitch else "llm_empty_response"
+                log_msg = (
+                    "Provider returned incomplete response (finish_reason=null)"
+                    if is_provider_glitch
+                    else "LLM returned empty response (no content, no tool_calls)"
+                )
                 _emit_live_log(event_queue, {
-                    "type": "llm_round_empty",
+                    "type": event_type,
                     "task_id": task_id,
                     "task_type": task_type,
                     "round": round_idx,
                     "attempt": attempt + 1,
                     "model": model,
+                    "finish_reason": finish_reason,
                 })
-                log.warning("LLM returned empty response (no content, no tool_calls), attempt %d/%d", attempt + 1, max_retries)
+                log.warning("%s, attempt %d/%d", log_msg, attempt + 1, max_retries)
 
                 append_jsonl(drive_logs / "events.jsonl", {
-                    "ts": utc_now_iso(), "type": "llm_empty_response",
+                    "ts": utc_now_iso(), "type": event_type,
                     "task_id": task_id,
                     "round": round_idx, "attempt": attempt + 1,
                     "model": model,
                     "raw_content": repr(content)[:500] if content else None,
                     "raw_tool_calls": repr(tool_calls)[:500] if tool_calls else None,
-                    "finish_reason": msg.get("finish_reason") or msg.get("stop_reason"),
+                    "finish_reason": finish_reason,
                 })
 
                 if attempt < max_retries - 1:

ouroboros/safety.py

@@ -155,7 +155,6 @@ def check_safety(
             use_local=_use_local_light,
         )
         if usage:
-            update_budget_from_usage(usage)
             model_name = f"{light_model} (local)" if _use_local_light else light_model
             cost = float(usage.get("cost") or 0.0)
             if not _use_local_light and cost == 0.0:
@@ -166,16 +165,18 @@ def check_safety(
                     int(usage.get("cached_tokens") or 0),
                     int(usage.get("cache_write_tokens") or 0),
                 )
-            emit_llm_usage_event(
-                getattr(ctx, "event_queue", None),
-                getattr(ctx, "task_id", "") if ctx is not None else "",
-                model_name,
-                usage,
-                cost,
-                category="safety",
-                provider="local" if _use_local_light else "openrouter",
-                source="safety_light",
-            )
+            _eq = getattr(ctx, "event_queue", None) if ctx is not None else None
+            if _eq is not None:
+                emit_llm_usage_event(
+                    _eq,
+                    getattr(ctx, "task_id", "") if ctx is not None else "",
+                    model_name, usage, cost,
+                    category="safety",
+                    provider="local" if _use_local_light else "openrouter",
+                    source="safety_light",
+                )
+            else:
+                update_budget_from_usage(usage)
 
         result = _parse_safety_response(msg.get("content") or "")
         if result:
@@ -213,7 +214,6 @@ def check_safety(
             use_local=_use_local_code,
         )
         if usage:
-            update_budget_from_usage(usage)
             model_name = f"{heavy_model} (local)" if _use_local_code else heavy_model
             cost = float(usage.get("cost") or 0.0)
             if not _use_local_code and cost == 0.0:
@@ -224,16 +224,18 @@ def check_safety(
                     int(usage.get("cached_tokens") or 0),
                     int(usage.get("cache_write_tokens") or 0),
                 )
-            emit_llm_usage_event(
-                getattr(ctx, "event_queue", None),
-                getattr(ctx, "task_id", "") if ctx is not None else "",
-                model_name,
-                usage,
-                cost,
-                category="safety",
-                provider="local" if _use_local_code else "openrouter",
-                source="safety_deep",
-            )
+            _eq = getattr(ctx, "event_queue", None) if ctx is not None else None
+            if _eq is not None:
+                emit_llm_usage_event(
+                    _eq,
+                    getattr(ctx, "task_id", "") if ctx is not None else "",
+                    model_name, usage, cost,
+                    category="safety",
+                    provider="local" if _use_local_code else "openrouter",
+                    source="safety_deep",
+                )
+            else:
+                update_budget_from_usage(usage)
 
         result = _parse_safety_response(msg.get("content") or "")
         if result is None:

ouroboros/task_results.py

@@ -14,6 +14,9 @@
 STATUS_RUNNING = "running"
 STATUS_COMPLETED = "completed"
 STATUS_REJECTED_DUPLICATE = "rejected_duplicate"
+STATUS_FAILED = "failed"
+STATUS_INTERRUPTED = "interrupted"
+STATUS_CANCELLED = "cancelled"
 
 
 def task_results_dir(drive_root: Any) -> pathlib.Path:

ouroboros/tool_policy.py

@@ -15,7 +15,7 @@
 
 
 CORE_TOOL_NAMES = frozenset({
-    "repo_read", "repo_list", "repo_write", "repo_write_commit", "repo_commit",
+    "repo_read", "repo_list", "repo_write", "repo_write_commit", "repo_commit", "str_replace_editor",
     "data_read", "data_list", "data_write",
     "run_shell", "claude_code_edit",
     "git_status", "git_diff",