Add Ruby as a supported output language

[jarsh921]

Follows the exact same pattern as python/javascript/typescript:

• New prompt partial (prompts/partials/_language_ruby.md): uses net/http and json - both part of Ruby's standard library, so no gem/Bundler dependency is needed at all, no project/dependency file of any kind. Calls out that net/http has no built-in cookie jar (unlike some other languages' HTTP clients), so cookie-based auth needs manual Set-Cookie capture and replay. Same auth-hardcoding/ refresh guidance as the other languages otherwise.
• base_engineer.py: added "ruby" to _OUTPUT_LANGUAGE_EXTENSIONS (.rb) and _get_language_name() ("Ruby"). _get_run_command() uses the full path rather than a bare relative "ruby api_client.rb" - the same working-directory fix already applied to Go/Java/C#/PHP, applied proactively here too since ruby has the identical shape (the agent's cwd is scripts_dir.parent.parent, not scripts_dir where the script is actually saved).
• cli.py: added Ruby to the interactive output_language config picker.
• Updated the three docstrings/comments that listed the language set (config.py, engineer.py, prompts/init.py) and README.md's output language line.
• Tests: mirrored the existing per-language test pattern in test_base_engineer.py (extension, run command, prompt content) and test_prompts.py (partial loading) for Ruby.

Checked the partial for the literal-brace str.format_map() bug caught in the Java PR - no literal {/} anywhere in the new file.

Full test suite passes (49/49, run 3x) except the same pre-existing flaky test noted on the other language PRs
(test_existing_client_language_falls_back_to_newest_file - a mtime-resolution race condition, unrelated to this change). ruff check is clean on every file this touches (8 pre-existing lint errors elsewhere on main, none in the touched lines).

---

Summary by cubic

Adds Ruby as a supported output language for generated API clients. Uses stdlib net/http and json, runs via a shell-quoted absolute-path ruby command, and adds per-origin connection reuse plus a cookie jar with domain/path/secure and expiration/deletion handling.

• New Features

  • Ruby prompt partial with per-origin connection reuse and a cookie jar that enforces domain/path/secure scope, Expires/Max-Age, and deletion; includes token refresh guidance.
  • BaseEngineer: .rb extension, language name, and ruby <absolute path to api_client.rb> using shlex.quote.
  • CLI adds Ruby; README/CHANGELOG and language docs/comments updated; tests cover extension mapping, prompt/partial loading, metacharacter-safe command, and absolute-path resolution.

• Bug Fixes

  • Ruby run command quotes and resolves the script path to prevent command substitution and cwd-related path errors.

^{Written for commit 916f68d. Summary will update on new commits.}

Greptile Summary

This PR adds Ruby as a supported generated-client language. The main changes are:

• Ruby prompt guidance based on net/http and json.
• Ruby extension, display-name, and run-command support.
• Ruby selection in CLI settings.
• Documentation and tests for the new language.

Confidence Score: 4/5

The remaining cookie behavior should be fixed before merging.

• Connection reuse is now separated by origin.
• Ruby execution uses a quoted absolute path.
• Cookie expiration and deletion can leave stale session state in generated clients.

src/reverse_api/prompts/partials/_language_ruby.md

Security Review

The cookie guidance can retain and replay credentials after a server expires or deletes them.

Important Files Changed

Filename	Overview
src/reverse_api/prompts/partials/_language_ruby.md	Adds Ruby generation guidance and scopes connections per origin, but cookie expiration and deletion remain unhandled.
src/reverse_api/base_engineer.py	Adds Ruby filename, display-name, and shell-quoted absolute run-command support.
src/reverse_api/cli.py	Adds Ruby to the interactive output-language choices.
tests/test_base_engineer.py	Adds Ruby coverage for extensions, prompts, path resolution, and shell quoting.
tests/test_prompts.py	Adds coverage for loading the Ruby prompt partial.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
src/reverse_api/prompts/partials/_language_ruby.md:11
**Handle cookie expiration too**

This instruction still omits `Expires` and `Max-Age`. When a refresh or logout response expires a cookie with `Max-Age=0`, generated code can retain and replay the old session value instead of deleting it. This can leave the script authenticated as the wrong session or cause later requests to fail. Require the cookie store to process expiration and deletion, with entries keyed by name, domain, and path.

```suggestion
- `net/http` has no built-in cookie jar, unlike some other languages' HTTP clients — if the API uses cookies, store each `Set-Cookie` header by name, domain, and path; enforce its secure, `Expires`, and `Max-Age` attributes; remove expired or deleted entries; and send back only cookies matching the request's origin and path in the `Cookie` header (a multi-origin trace can otherwise leak a session cookie to the wrong host or send an invalid header)
```

_{Reviews (2): Last reviewed commit: "Resolve scripts_dir to an absolute path ..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[cubic-dev-ai]

All reported issues were addressed across 10 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[kind-agent]

⚠️ Error — The test run failed unexpectedly.

Snapshot kind-sandbox is inactive

This is likely a transient issue. You can re-trigger a run from the dashboard.

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[kalil0321]

@greptile review

[greptile-apps]

Handle cookie expiration too

This instruction still omits Expires and Max-Age. When a refresh or logout response expires a cookie with Max-Age=0, generated code can retain and replay the old session value instead of deleting it. This can leave the script authenticated as the wrong session or cause later requests to fail. Require the cookie store to process expiration and deletion, with entries keyed by name, domain, and path.

Suggested change

- `net/http` has no built-in cookie jar, unlike some other languages' HTTP clients — if the API uses cookies, capture each `Set-Cookie` header's name/value and its domain, path, and secure attributes, and send back only the cookies matching a given request's origin and path in the `Cookie` header, rather than replaying every captured cookie on every request (a multi-origin trace can otherwise leak a session cookie to the wrong host or send an invalid header)

- `net/http` has no built-in cookie jar, unlike some other languages' HTTP clients — if the API uses cookies, store each `Set-Cookie` header by name, domain, and path; enforce its secure, `Expires`, and `Max-Age` attributes; remove expired or deleted entries; and send back only cookies matching the request's origin and path in the `Cookie` header (a multi-origin trace can otherwise leak a session cookie to the wrong host or send an invalid header)

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/reverse_api/prompts/partials/_language_ruby.md
Line: 11

Comment:
**Handle cookie expiration too**

This instruction still omits `Expires` and `Max-Age`. When a refresh or logout response expires a cookie with `Max-Age=0`, generated code can retain and replay the old session value instead of deleting it. This can leave the script authenticated as the wrong session or cause later requests to fail. Require the cookie store to process expiration and deletion, with entries keyed by name, domain, and path.

```suggestion
- `net/http` has no built-in cookie jar, unlike some other languages' HTTP clients — if the API uses cookies, store each `Set-Cookie` header by name, domain, and path; enforce its secure, `Expires`, and `Max-Age` attributes; remove expired or deleted entries; and send back only cookies matching the request's origin and path in the `Cookie` header (a multi-origin trace can otherwise leak a session cookie to the wrong host or send an invalid header)
```

How can I resolve this? If you propose a fix, please make it concise.