maquina-generators 0.6.0 → 0.7.0

data/lib/generators/maquina/csp_reports/templates/app/views/backstage/security/_csp_violations.html.erb

@@ -0,0 +1,42 @@
+<%# locals: (report:) %>
+<%# Content Security Policy violations browsers reported to /csp-reports
+    (maquina:csp_reports), grouped so each row is one thing to fix. %>
+<%= render "components/card" do %>
+  <%= render "components/card/header" do %>
+    <%= render "components/card/title", text: "Content Security Policy violations" %>
+    <%= render "components/card/description",
+          text: "#{number_with_delimiter(report.total)} reported in the last #{report.window.inspect}, kept for #{Security::CspViolation::RETENTION.inspect}. Most frequent first." %>
+  <% end %>
+  <%= render "components/card/content", spacing: :full do %>
+    <% if report.empty? %>
+      <%= empty_state(title: "No violation was reported.", icon: :check_circle, size: :compact) %>
+    <% else %>
+      <div class="overflow-x-auto">
+        <%= render "components/table", container: false, "aria-label": "Content Security Policy violations" do %>
+          <%= render "components/table/header" do %>
+            <%= render "components/table/row" do %>
+              <%= render "components/table/head", text: "Directive" %>
+              <%= render "components/table/head", text: "Blocked" %>
+              <%= render "components/table/head", text: "Page" %>
+              <%= render "components/table/head", text: "Reports", css_classes: "text-right" %>
+              <%= render "components/table/head", text: "Last seen" %>
+            <% end %>
+          <% end %>
+          <%= render "components/table/body" do %>
+            <% report.top.each do |group| %>
+              <%= render "components/table/row" do %>
+                <%= render "components/table/cell", css_classes: "font-mono", text: group.effective_directive %>
+                <%= render "components/table/cell", css_classes: "font-mono whitespace-normal break-all", text: group.blocked_uri.presence || "—" %>
+                <%= render "components/table/cell", css_classes: "font-mono whitespace-normal break-all", text: group.document_uri.presence || "—" %>
+                <%= render "components/table/cell", css_classes: "text-right tabular-nums", text: number_with_delimiter(group.count) %>
+                <%= render "components/table/cell" do %>
+                  <%= render "backstage/security/utc_time", time: group.last_seen %>
+                <% end %>
+              <% end %>
+            <% end %>
+          <% end %>
+        <% end %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>

data/lib/generators/maquina/csp_reports/templates/db/create_csp_violations.rb.tt

@@ -0,0 +1,23 @@
+# Content Security Policy violation reports (maquina:csp_reports). Lives in the
+# `security` database next to abuse_events; db/security_schema.rb carries the same
+# table for a fresh database, this migration adds it to an existing one.
+class CreateCspViolations < ActiveRecord::Migration<%= migration_version %>
+  def change
+    create_table :csp_violations do |t|
+      t.string :effective_directive, null: false
+      t.string :blocked_uri
+      t.string :document_uri
+      t.string :source_file
+      t.integer :line_number
+      t.integer :column_number
+      t.string :disposition
+      t.string :sample
+      t.string :ip
+      t.string :user_agent
+      t.datetime :created_at, null: false
+    end
+
+    add_index :csp_violations, :created_at
+    add_index :csp_violations, [:effective_directive, :created_at]
+  end
+end

data/lib/maquina_generators/version.rb

@@ -1,3 +1,3 @@
 module MaquinaGenerators
-  VERSION = "0.6.0"
+  VERSION = "0.7.0"
 end

data/test/generators/maquina/clave_generator_test.rb

@@ -181,9 +181,83 @@ class Maquina::Generators::ClaveGeneratorTest < Rails::Generators::TestCase
     end
   end
 
+  test "the sign-in code is encrypted at rest and compared in constant time" do
+    run_generator
+
+    assert_file "app/models/email_verification.rb" do |content|
+      assert_match(/encrypts :code/, content)
+      assert_match(/def code_matches\?\(candidate\)/, content)
+      assert_match(/ActiveSupport::SecurityUtils\.secure_compare/, content)
+    end
+    %w[session registration].each do |flow|
+      assert_file "app/controllers/#{flow}/verifications_controller.rb" do |content|
+        assert_match(/unless @verification\.code_matches\?\(params\[:code\]\)/, content)
+        assert_no_match(/@verification\.code !=/, content)
+      end
+    end
+  end
+
+  test "a code dies after five wrong guesses in both verification flows" do
+    run_generator
+
+    assert_file "app/models/email_verification.rb" do |content|
+      assert_match(/MAX_ATTEMPTS = 5/, content)
+      assert_match(/def locked\?\n    attempts >= MAX_ATTEMPTS/, content)
+    end
+    {"session" => "sessions", "registration" => "registrations"}.each do |flow, scope|
+      assert_file "app/controllers/#{flow}/verifications_controller.rb" do |content|
+        assert_match(/if @verification\.locked\?\n      @verification\.update!\(expires_at: Time\.current\)/, content)
+        assert_match(/t\("flash\.#{scope}\.code_locked"\)/, content)
+        assert content.index("@verification.locked?") < content.index("code_matches?"),
+          "the lock is checked before the guess, so a correct sixth guess is refused too"
+      end
+    end
+    %w[en es].each do |locale|
+      assert_file "config/locales/clave.#{locale}.yml" do |content|
+        assert_equal 2, content.scan(/^      code_locked: /).size
+      end
+    end
+  end
+
+  test "writes Active Record encryption keys into the credentials when they are missing" do
+    credentials = create_credentials("secret_key_base: abc\n")
+
+    output = run_generator
+
+    content = credentials.read
+    assert_match(/\Asecret_key_base: abc\n\nactive_record_encryption:\n  primary_key: \w{32}\n  deterministic_key: \w{32}\n  key_derivation_salt: \w{32}\n\z/, content)
+    assert_match(/Added Active Record encryption keys/, output)
+  end
+
+  test "leaves existing encryption keys alone" do
+    existing = "active_record_encryption:\n  primary_key: keep\n"
+    credentials = create_credentials(existing)
+
+    run_generator
+
+    assert_equal existing, credentials.read
+  end
+
+  test "without a master key it explains how to add the encryption keys" do
+    output = run_generator
+
+    assert_no_file "config/credentials.yml.enc"
+    assert_match(/bin\/rails db:encryption:init/, output)
+  end
+
   private
 
   def mkdir_p(path)
     FileUtils.mkdir_p(File.join(destination_root, path))
   end
+
+  def create_credentials(content)
+    key = ActiveSupport::EncryptedConfiguration.generate_key
+    File.write(File.join(destination_root, "config/master.key"), key)
+    ActiveSupport::EncryptedConfiguration.new(
+      config_path: File.join(destination_root, "config/credentials.yml.enc"),
+      key_path: File.join(destination_root, "config/master.key"),
+      env_key: "RAILS_MASTER_KEY_UNUSED", raise_if_missing_key: true
+    ).tap { |credentials| credentials.write(content) }
+  end
 end

data/test/generators/maquina/csp_reports_generator_test.rb

@@ -0,0 +1,151 @@
+require "test_helper"
+require "generators/maquina/csp_reports/csp_reports_generator"
+
+class Maquina::Generators::CspReportsGeneratorTest < Rails::Generators::TestCase
+  tests Maquina::Generators::CspReportsGenerator
+  destination File.expand_path("../../tmp", __dir__)
+
+  SECURITY_SCHEMA = <<~RUBY
+    # The `security` database.
+
+    ActiveRecord::Schema[8.1].define(version: 1) do
+      create_table "abuse_events", force: :cascade do |t|
+        t.string "ip", null: false
+      end
+    end
+  RUBY
+
+  CSP_INITIALIZER = <<~RUBY
+    Rails.application.configure do
+      config.content_security_policy do |policy|
+        policy.default_src :self
+      end
+
+      config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+      config.content_security_policy_report_only = true
+    end
+  RUBY
+
+  RACK_ATTACK = <<~RUBY
+    class Rack::Attack
+      def self.counted_ip(req)
+        req.ip unless req.path.start_with?("/assets", "/rails/active_storage")
+      end
+    end
+  RUBY
+
+  SECURITY_PAGE = <<~ERB
+    <div class="py-8 space-y-8">
+      <% if @report.empty? %>
+        empty
+      <% end %>
+    </div>
+  ERB
+
+  setup do
+    prepare_destination
+    write "config/routes.rb", "Rails.application.routes.draw do\nend\n"
+    write "db/security_schema.rb", SECURITY_SCHEMA
+    write "config/initializers/content_security_policy.rb", CSP_INITIALIZER
+    write "config/initializers/rack_attack.rb", RACK_ATTACK
+    write "config/recurring.yml", "production:\n  purge_abuse_events:\n    command: \"x\"\n"
+    write "app/views/backstage/security/show.html.erb", SECURITY_PAGE
+  end
+
+  test "refuses to run without the security database" do
+    File.delete(File.join(destination_root, "db/security_schema.rb"))
+
+    output = capture(:stderr) { run_generator }
+
+    assert_match(/Run `rails g maquina:security --prefix \/admin` first/, output)
+    assert_no_file "app/controllers/csp_reports_controller.rb"
+  end
+
+  test "installs the endpoint, the models and the route" do
+    run_generator
+
+    assert_file "app/controllers/csp_reports_controller.rb", /class CspReportsController < ActionController::API/
+    assert_file "app/models/security/csp_violation.rb", /class Security::CspViolation < Security::Record/
+    assert_file "app/models/security/csp_violation_report.rb", /class Security::CspViolationReport/
+    assert_file "config/routes.rb", %r{post "/csp-reports", to: "csp_reports#create", as: :csp_reports}
+  end
+
+  test "adds the table as a security migration and to the schema" do
+    run_generator
+
+    assert_migration "db/security_migrate/create_csp_violations.rb", /create_table :csp_violations/
+    migration = Dir[File.join(destination_root, "db/security_migrate/*_create_csp_violations.rb")].first
+    version = File.basename(migration).split("_").first
+    assert_file "db/security_schema.rb" do |content|
+      assert_match(/define\(version: #{version.sub(/\A(\d{4})(\d{2})(\d{2})(\d{6})\z/, '\1_\2_\3_\4')}\)/, content)
+      assert_match(/create_table "abuse_events".*create_table "csp_violations"/m, content)
+      assert_match(/\n  end\nend\n\z/, content)
+      assert_no_match(/[ \t]+$/, content, "no trailing whitespace")
+    end
+  end
+
+  test "points the policy at the endpoint and gives anonymous requests a nonce" do
+    run_generator %w[--path /security/csp]
+
+    assert_file "config/initializers/content_security_policy.rb" do |content|
+      assert_match(%r{config\.content_security_policy do \|policy\|\n.*policy\.report_uri "/security/csp"}m, content)
+      assert_no_match(/report_to/, content.gsub(/#.*$/, ""))
+      assert_match(/request\.session\.id\.to_s\.presence \|\| SecureRandom\.base64\(16\)/, content)
+    end
+  end
+
+  test "takes the endpoint out of the general throttle and caps it on its own" do
+    run_generator
+
+    assert_file "config/initializers/rack_attack.rb" do |content|
+      assert_match(%r{start_with\?\("/assets", "/rails/active_storage", "/csp-reports"\)}, content)
+      assert_match(/Rack::Attack\.throttle\("csp\/ip", limit: 100, period: 5\.minutes\)/, content)
+    end
+  end
+
+  test "extends a STATIC_FILE_PREFIXES list when the rules use one" do
+    write "config/initializers/rack_attack.rb", "class Rack::Attack\n  STATIC_FILE_PREFIXES = %w[/assets /u/].freeze\nend\n"
+
+    run_generator
+
+    assert_file "config/initializers/rack_attack.rb", %r{STATIC_FILE_PREFIXES = %w\[/assets /u/ /csp-reports\]}
+  end
+
+  test "purges daily and shows the section on the Security page" do
+    run_generator
+
+    assert_file "config/recurring.yml", /purge_csp_violations:\n    command: "Security::CspViolation\.expired\.delete_all"/
+    assert_file "app/views/backstage/security/_csp_violations.html.erb", /Content Security Policy violations/
+    assert_file "app/views/backstage/security/show.html.erb",
+      %r{<% end %>\n\n  <%= render "backstage/security/csp_violations", report: Security::CspViolationReport\.new %>\n</div>\n\z}
+  end
+
+  test "running twice changes nothing the second time" do
+    run_generator
+    snapshot = %w[db/security_schema.rb config/initializers/rack_attack.rb config/initializers/content_security_policy.rb
+      config/recurring.yml app/views/backstage/security/show.html.erb config/routes.rb].to_h { |f| [f, File.read(File.join(destination_root, f))] }
+
+    run_generator
+
+    snapshot.each { |file, content| assert_equal content, File.read(File.join(destination_root, file)), file }
+    assert_equal 1, Dir[File.join(destination_root, "db/security_migrate/*_create_csp_violations.rb")].size
+  end
+
+  test "lists what it could not place instead of forcing it" do
+    write "config/initializers/content_security_policy.rb", "# Rails.application.configure do\n# end\n"
+    write "config/initializers/rack_attack.rb", "class Rack::Attack\nend\n"
+
+    output = run_generator
+
+    assert_match(%r{policy\.report_uri "/csp-reports"}, output)
+    assert_match(/Exempt \/csp-reports from the general throttle/, output)
+  end
+
+  private
+
+  def write(path, content)
+    full = File.join(destination_root, path)
+    FileUtils.mkdir_p(File.dirname(full))
+    File.write(full, content)
+  end
+end

data/test/tmp/.gitignore

@@ -0,0 +1,5 @@
+/log/*
+/tmp/*
+
+# Ignore database configuration
+config/database.yml

data/test/tmp/.rubocop.yml

@@ -0,0 +1,11 @@
+# standard.rb's runner bridge, not custom RuboCop rules.
+#
+# This is the entry point RuboCop (and editors/LSP) need to run the Standard
+# ruleset — all style comes from the `standard` gem via config/base.yml below.
+# Keep this file even though general guidance says "no .rubocop.yml": for
+# standard.rb this IS the runner config, not a custom rule set.
+require:
+  - standard
+
+inherit_gem:
+  standard: config/base.yml

data/test/tmp/.standard.yml

@@ -0,0 +1 @@
+ruby_version: 3.2

data/test/tmp/Gemfile

@@ -1,3 +1,15 @@
 source "https://rubygems.org"
 
-gem "bcrypt"
+gem "brakeman", group: :development
+
+gem "bundle-audit", group: :development
+
+gem "letter_opener", group: :development
+
+gem "standard", ">= 1.54", group: :development
+
+gem "rails-i18n"
+
+gem "maquina-components"
+
+gem "aws-sdk-s3", group: :production

data/test/tmp/Procfile.dev

@@ -0,0 +1,3 @@
+web: bin/rails server -p 3000
+css: bin/rails tailwindcss:watch
+solid_queue: bin/rails solid_queue:start

data/test/tmp/README.md

@@ -0,0 +1,89 @@
+# Tmp
+
+Built with [maquina.app](https://maquina.app) — production-tested tools for developers who ship alone.
+
+## Getting Started
+
+### Prerequisites
+
+- Ruby 3.2+
+- Rails 8+
+- PostgreSQL (or SQLite for development)
+
+### Setup
+
+```bash
+bin/setup    # Install dependencies and prepare databases
+bin/dev      # Start all processes (web, css, solid_queue)
+```
+
+Your app will be running at **http://localhost:3000**.
+
+## What's Included
+
+| Feature | Description |
+|---------|-------------|
+| **Background Jobs** | Solid Queue with Mission Control Jobs dashboard |
+| **Error Tracking** | Solid Errors with custom UI |
+| **Rate Limiting** | Rack::Attack with sensible defaults |
+| **UI Components** | Maquina Components (ERB partials + Tailwind + Stimulus) |
+| **Caching** | Solid Cache |
+| **WebSockets** | Solid Cable |
+| **Rich Text** | Action Text |
+| **File Storage** | Active Storage (S3-ready in production) |
+| **Multi-database** | Separate databases for queue, cache, cable, errors, and security |
+
+## Development URLs
+
+| URL | Description |
+|-----|-------------|
+| http://localhost:3000 | Application |
+| http://localhost:3000/admin | Admin overview |
+| http://localhost:3000/admin/errors | Errors dashboard |
+| http://localhost:3000/admin/jobs | Jobs dashboard |
+| http://localhost:3000/admin/security | Security dashboard |
+
+## Scripts
+
+- `bin/setup` — Install dependencies and prepare databases
+- `bin/dev` — Start all processes (web, css, solid_queue)
+
+## Credentials
+
+Edit credentials with:
+
+```bash
+bin/rails credentials:edit
+```
+
+Add backstage credentials for the admin dashboards (overview, errors, jobs, security):
+
+```yaml
+backstage:
+  username: your_user
+  password: your_password
+```
+
+## Maquina Ecosystem
+
+### UI Components
+
+[Maquina Components](https://maquina.app/documentation/components/) — a library of ERB partials, Tailwind CSS styles, and Stimulus controllers for building consistent, accessible UIs in Rails.
+
+### AI Tools
+
+Maquina provides a suite of AI-powered tools to accelerate your Rails development:
+
+- **Rails MCP Server** — Model Context Protocol server for Rails applications
+- **Rails Simplifier** — simplify and refine Rails code following 37signals patterns
+- **Rails Upgrade Assistant** — comprehensive Rails upgrade reports and migration guides
+- **Maquina UI Standards** — build consistent UIs using maquina_components
+- **Neovim MCP Server** — MCP server for Neovim integration
+
+Learn more at [maquina.app/documentation/ai-tools](https://maquina.app/documentation/ai-tools/).
+
+## Learn More
+
+Visit [maquina.app](https://maquina.app) for full documentation.
+
+Maquina is built for the one-person framework philosophy: production-first, standard Rails, designed to scale with a small team.

data/test/tmp/app/controllers/home_controller.rb

@@ -0,0 +1,6 @@
+class HomeController < ApplicationController
+  allow_unauthenticated_access if respond_to?(:allow_unauthenticated_access)
+
+  def index
+  end
+end

data/test/tmp/app/javascript/application.js

@@ -0,0 +1 @@
+// Entry point for the build script

data/test/tmp/app/views/home/index.html.erb

@@ -0,0 +1,204 @@
+
+<section class="bg-primary/5 border-b border-border">
+  <div class="max-w-5xl mx-auto px-5 py-20 sm:py-28">
+    <h1 class="text-4xl sm:text-5xl font-bold tracking-tight text-foreground mb-5">
+      Tools for Rails developers<br class="hidden sm:block"> who ship alone
+    </h1>
+    <p class="text-lg text-muted-foreground leading-relaxed max-w-2xl mb-8">
+      Maquina is a growing collection of open-source tools extracted from production Rails applications.
+      UI components, background jobs, error tracking, and authentication — configured and ready to go.
+    </p>
+
+
+  </div>
+</section>
+
+
+
+
+<section class="max-w-5xl mx-auto px-5 py-12">
+  <p class="text-sm font-semibold uppercase tracking-wider text-primary mb-6">What's Included</p>
+  <div class="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
+
+
+
+    <%= render "components/card" do %>
+      <%= render "components/card/header" do %>
+        <%= render "components/card/title", text: "Background Jobs" %>
+      <% end %>
+      <%= render "components/card/content" do %>
+        <p class="text-sm text-muted-foreground">Solid Queue backed by SQLite. Includes Mission Control dashboard for monitoring and managing jobs.</p>
+      <% end %>
+    <% end %>
+
+    <%= render "components/card" do %>
+      <%= render "components/card/header" do %>
+        <%= render "components/card/title", text: "Error Tracking" %>
+      <% end %>
+      <%= render "components/card/content" do %>
+        <p class="text-sm text-muted-foreground">Solid Errors captures exceptions automatically. Browse, resolve, and clean up — no external service needed.</p>
+      <% end %>
+    <% end %>
+
+    <%= render "components/card" do %>
+      <%= render "components/card/header" do %>
+        <%= render "components/card/title", text: "Rate Limiting" %>
+      <% end %>
+      <%= render "components/card/content" do %>
+        <p class="text-sm text-muted-foreground">Rack::Attack bans scanners and floods and throttles sign-in. Every refusal shows on the Security dashboard.</p>
+      <% end %>
+    <% end %>
+
+    <%= render "components/card" do %>
+      <%= render "components/card/header" do %>
+        <%= render "components/card/title", text: "Caching" %>
+      <% end %>
+      <%= render "components/card/content" do %>
+        <p class="text-sm text-muted-foreground">Solid Cache with SQLite backend. No Redis or Memcached to manage.</p>
+      <% end %>
+    <% end %>
+
+    <%= render "components/card" do %>
+      <%= render "components/card/header" do %>
+        <%= render "components/card/title", text: "Real-time" %>
+      <% end %>
+      <%= render "components/card/content" do %>
+        <p class="text-sm text-muted-foreground">Solid Cable for WebSocket support. Action Cable backed by SQLite — zero external dependencies.</p>
+      <% end %>
+    <% end %>
+
+    <%= render "components/card" do %>
+      <%= render "components/card/header" do %>
+        <%= render "components/card/title", text: "UI Components" %>
+      <% end %>
+      <%= render "components/card/content" do %>
+        <p class="text-sm text-muted-foreground">maquina_components — ERB partials styled with Tailwind CSS and Stimulus controllers. No React, no build step.</p>
+      <% end %>
+    <% end %>
+
+    <%= render "components/card" do %>
+      <%= render "components/card/header" do %>
+        <%= render "components/card/title", text: "Standard Rails" %>
+      <% end %>
+      <%= render "components/card/content" do %>
+        <p class="text-sm text-muted-foreground">Importmaps, Turbo, Stimulus. No webpack, no bundler, no extra frameworks to learn.</p>
+      <% end %>
+    <% end %>
+
+  </div>
+</section>
+
+
+<section class="max-w-5xl mx-auto px-5 pb-12">
+  <%= render "components/card" do %>
+    <%= render "components/card/header" do %>
+      <%= render "components/card/title", text: "Maquina Components" %>
+      <%= render "components/card/description", text: "UI components for Rails — ERB partials styled with Tailwind CSS 4.0 and Stimulus controllers. Inspired by shadcn/ui, built for the Rails way." %>
+    <% end %>
+    <%= render "components/card/content" do %>
+      <div class="flex flex-wrap gap-2">
+        <%= render "components/badge", variant: :outline, size: :sm do %>Card<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Badge<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Table<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Sidebar<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Calendar<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Combobox<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Date Picker<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Toast<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Dropdown Menu<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Toggle Group<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Pagination<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Breadcrumbs<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Alert<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Empty State<% end %>
+        <%= render "components/badge", variant: :outline, size: :sm do %>Forms<% end %>
+      </div>
+    <% end %>
+    <%= render "components/card/footer" do %>
+      <%= link_to "Browse Components", "https://maquina.app/documentation/components/", target: "_blank", rel: "noopener noreferrer", data: { component: "button", variant: "primary" } %>
+    <% end %>
+  <% end %>
+</section>
+
+<div class="max-w-5xl mx-auto px-5">
+  <%= render "components/separator" %>
+</div>
+
+
+<section class="max-w-5xl mx-auto px-5 py-12">
+  <p class="text-sm font-semibold uppercase tracking-wider text-primary mb-6">Ecosystem</p>
+  <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+
+    <%= render "components/card" do %>
+      <%= render "components/card/header" do %>
+        <%= render "components/card/title", text: "Rails MCP Server" %>
+      <% end %>
+      <%= render "components/card/content" do %>
+        <p class="text-sm text-muted-foreground">A Model Context Protocol server for Rails projects. Analyze models, routes, schemas, and execute read-only Ruby code in your Rails context.</p>
+      <% end %>
+    <% end %>
+
+    <%= render "components/card" do %>
+      <%= render "components/card/header" do %>
+        <%= render "components/card/title", text: "Neovim MCP Server" %>
+      <% end %>
+      <%= render "components/card/content" do %>
+        <p class="text-sm text-muted-foreground">MCP server for Neovim integration. Read and update buffers, coordinate file changes across your editor and AI assistants.</p>
+      <% end %>
+    <% end %>
+
+    <%= render "components/card" do %>
+      <%= render "components/card/header" do %>
+        <%= render "components/card/title", text: "Rails Upgrade Assistant" %>
+      <% end %>
+      <%= render "components/card/content" do %>
+        <p class="text-sm text-muted-foreground">A Claude Skill that analyzes Rails applications and generates upgrade guides. Covers Rails 7.0 through 8.1 with breaking changes and migration steps.</p>
+      <% end %>
+    <% end %>
+
+    <%= render "components/card" do %>
+      <%= render "components/card/header" do %>
+        <%= render "components/card/title", text: "Rails Simplifier" %>
+      <% end %>
+      <%= render "components/card/content" do %>
+        <p class="text-sm text-muted-foreground">Code simplification following 37signals patterns and the One Person Framework philosophy.</p>
+      <% end %>
+    <% end %>
+
+  </div>
+  <div class="mt-6 text-center">
+    <%= link_to "Explore All Tools", "https://maquina.app/", target: "_blank", rel: "noopener noreferrer", data: { component: "button", variant: "outline" } %>
+  </div>
+</section>
+
+<div class="max-w-5xl mx-auto px-5">
+  <%= render "components/separator" %>
+</div>
+
+
+<section class="max-w-5xl mx-auto px-5 py-12">
+  <p class="text-sm font-semibold uppercase tracking-wider text-primary mb-8 text-center">Philosophy</p>
+  <div class="grid grid-cols-1 sm:grid-cols-3 gap-10">
+    <div>
+      <h3 class="font-bold text-lg text-foreground mb-2">Production First</h3>
+      <p class="text-sm text-muted-foreground leading-relaxed">Every tool starts in a real application. No theoretical exercises — only code that has shipped.</p>
+    </div>
+    <div>
+      <h3 class="font-bold text-lg text-foreground mb-2">Standard Rails</h3>
+      <p class="text-sm text-muted-foreground leading-relaxed">ERB, Tailwind, Stimulus. No new paradigms to learn, no complex build pipelines.</p>
+    </div>
+    <div>
+      <h3 class="font-bold text-lg text-foreground mb-2">One Person Scale</h3>
+      <p class="text-sm text-muted-foreground leading-relaxed">Built for developers who ship alone. Simple tools that stay out of your way.</p>
+    </div>
+  </div>
+</section>
+
+
+<section class="bg-primary/5 border-t border-border">
+  <div class="max-w-5xl mx-auto px-5 py-16 text-center">
+    <h2 class="text-2xl font-bold text-foreground mb-4">Start building today</h2>
+    <p class="text-muted-foreground mb-6">Visit maquina.app to explore the full ecosystem.</p>
+    <%= link_to "Visit maquina.app", "https://maquina.app/", target: "_blank", rel: "noopener noreferrer", data: { component: "button", variant: "primary" } %>
+  </div>
+</section>