mcp_authorization 0.5.1 → 0.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7365a5b287722edcac66ce63fa3ef411f6a6761e17ebb12cdfaf982e1e71c03d
-  data.tar.gz: 01cbce16f56b0ca80523014d20caee64a90cd4b82e478c9ebbf85e0cb255397a
+  metadata.gz: 003724dd47fae4de46be5fc319fb0b72f7154fff97f491dcca2251abadf81f32
+  data.tar.gz: 4df5f0cc01cb38310a3c2d1a27e3beedcb8c6bb3538a2dd109702fa7a8d9c261
 SHA512:
-  metadata.gz: 374d094408606c87c9c7886d3e5bb22f05794076d001054d703431e604740fb914596d2c75dbb4bc7a07eb0461f3ac660ea121d134c850b0439d18f0fe7f9542
-  data.tar.gz: 793eca82f7a52d56e65134366ed300d07d07bb9331daa49f566294e9f14af46d40ada269ebd4efcfd0a8f65733ee8981a0cbc039d3520eec4f4c43c500e3421c
+  metadata.gz: 96ec8e376316d4fd63ed9cb1350b730138c233152f54dd1fea15ff8608dada5679efbefb0d698bb32eaa6d843a1b15f62d54e5a342f425aaba6dd50cab71c1e7
+  data.tar.gz: 7215cf662c1bf0a87aab6887fbc88cb59cd5cac24f48d96dc7f490fd99acf7835a813bc9f621b36904a09c1ac9639cf2a66330ff189b1dee0350e57f45cc50fb

data/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to this gem are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project
 adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.5.3] - 2026-06-03
+
+### Fixed
+- **`#` comments inside an RBS record type no longer break schema compilation.** ([#20](https://github.com/onboardiq/mcp_authorization/issues/20))
+
+  A comment line inside a record body — whether in an inline `# @rbs type` annotation or an imported `sig/shared/*.rbs` alias — raised `ArgumentError: invalid field name token`. The line-based readers (`find_raw_type_body`, `parse_type_aliases`, `parse_rbs_file`) concatenate record-body lines without a newline separator, so a comment folded into the next field name (`"# a note describing the fields belowid"`). Comments are valid anywhere in RBS — the official lexer discards `#`-to-end-of-line everywhere — so the readers now strip line comments before splitting fields, via a new `strip_rbs_comment` helper that leaves `#` inside string literals and bracketed annotation values (e.g. `@desc(...)`) untouched.
+
+  **Impact:** because `tools/list` maps `to_mcp_definition` over every tool in a domain, a single tool with an in-record comment took down discovery for the entire domain — and the offending comment could live far away in a shared `.rbs` alias that several tools import.
+
+- **Narrowed `rbs` require set now loads under `rbs` 4.x.** The 0.5.2 narrowing (16-file subset instead of `require "rbs"`) was validated against `rbs` 3.x but raised `NameError: uninitialized constant RBS::AST::Ruby` on a fresh install resolving `rbs` 4.x — the same 4.x that 0.5.2's loosened `>= 3.0` constraint explicitly allows. `rbs` 4.x's C extension references the new `RBS::AST::Ruby::*` namespace and its `parser_aux` references `Pathname` at load time. The require block now loads `pathname` and the `rbs/ast/ruby/*` files when present (guarded by `rescue LoadError` so `rbs` 3.x, which lacks them, is unaffected). Verified against `rbs` 3.10 and 4.0.
+
+### Added
+- **CI workflow** (`.github/workflows/ci.yml`) running `bundle exec rake test` across Ruby 3.1–3.4 on push and pull request, plus a `sentinel check` job that fails if the committed `sig/generated/*.rbs` drift from the inline `#:` annotations. `rbs-sentinel` is now pinned as a development dependency so the signature formatting CI checks against is reproducible.
+
+## [0.5.2] - 2026-05-28
+
+### Changed
+- **Narrowed the `rbs` require set.** `require "rbs"` pulled in ~144 files (CLI, environment loader, definition builder, prototype generators, stdlib type signatures, validator, resolver, ...) — none of which this gem touches. Replaced with a 16-file subset covering only `RBS::Parser.parse_type` and the `RBS::Types::*` AST classes the schema visitor actually visits. Measured against this gem's load path: ~1.2 MB RSS vs ~15 MB, 18 files loaded vs 144. No behavior change — same parser, same AST.
+- **Loosened the `rbs` version constraint** from `>= 3.0, < 4.0` to `>= 3.0`. The upper bound locked consumers out of `rbs 4.x` even though `RBS::Parser.parse_type` is part of rbs's stable surface. Consumers who already depend on `rbs 4` for their own Steep / type-check toolchain can now use this gem without a downgrade. If a future rbs major actually breaks our parser-API usage, we'll add the upper bound back at that point — not preemptively.
+
 ## [0.5.1] - 2026-05-27
 
 ### Fixed

data/lib/mcp_authorization/rbs_schema_compiler.rb

@@ -1,4 +1,44 @@
-require "rbs"
+# Narrow require set: we use only RBS::Parser.parse_type and a handful of
+# RBS::Types::* AST classes. Avoid `require "rbs"`, which pulls in ~144
+# files (CLI, environment loader, definition builder, prototype generators,
+# stdlib type signatures, ...) we never touch — ~15 MB RSS vs ~1.2 MB for
+# the subset below. Load order matters: location_aux uses the C-defined
+# RBS::Location, and rbs_extension assumes RBS::AST::* namespaces exist.
+require "pathname" # rbs 4.x's parser_aux references Pathname at load time
+require "rbs/version"
+require "rbs/errors"
+require "rbs/buffer"
+require "rbs/namespace"
+require "rbs/type_name"
+require "rbs/types"
+require "rbs/method_type"
+require "rbs/ast/type_param"
+require "rbs/ast/directives"
+require "rbs/ast/declarations"
+require "rbs/ast/members"
+require "rbs/ast/annotation"
+require "rbs/ast/comment"
+# rbs 4.x's C extension (rbs_extension) references the RBS::AST::Ruby::*
+# namespace, which did not exist on rbs 3.x. Require those files when the
+# installed rbs ships them so the narrow load path stays correct across
+# the gemspec's supported range (rbs >= 3.0); ignore on versions that
+# predate the namespace, where rbs_extension does not need it.
+%w[
+  rbs/ast/ruby/helpers/constant_helper
+  rbs/ast/ruby/helpers/location_helper
+  rbs/ast/ruby/annotations
+  rbs/ast/ruby/comment_block
+  rbs/ast/ruby/declarations
+  rbs/ast/ruby/members
+].each do |feature|
+  require feature
+rescue LoadError
+  # rbs < 4: file absent and rbs_extension does not reference it.
+end
+require "rbs_extension"
+require "rbs/location_aux"
+require "rbs/parser_aux"
+
 require_relative "diagnostics"
 
 module McpAuthorization
@@ -1054,7 +1094,7 @@ module McpAuthorization
           elsif stripped =~ /\Atype (\w+) = "([^"]+)"/
             aliases[$1.to_s] = parse_rbs_string_union($2.to_s, line, content)
           elsif current_name
-            current_body << stripped
+            current_body << strip_rbs_comment(stripped)
             if brace_balanced?(current_body)
               aliases[current_name] = current_body
               current_name = nil
@@ -1116,7 +1156,7 @@ module McpAuthorization
           if line =~ /# @rbs type #{pattern} = \{/
             body = "{"
             rest.each do |next_line|
-              stripped = next_line.strip.sub(/^#\s*/, "")
+              stripped = strip_rbs_comment(next_line.strip.sub(/^#\s*/, ""))
               body << stripped
               return { kind: :record, body: body } if brace_balanced?(body)
             end
@@ -1165,7 +1205,7 @@ module McpAuthorization
           elsif line =~ /# @rbs type (\w+) = "([^"]+)"/
             aliases[$1.to_s] = parse_string_union($2.to_s, line, content)
           elsif current_name
-            stripped = line.strip.sub(/^#\s*/, "")
+            stripped = strip_rbs_comment(line.strip.sub(/^#\s*/, ""))
             current_body << stripped
             if brace_balanced?(current_body)
               aliases[current_name] = current_body
@@ -1302,6 +1342,42 @@ module McpAuthorization
       # which silently dropped any field whose type string contained a
       # comma — or worse, split that field at the comma.
       #
+      # Strip an RBS line comment (+#+ to end-of-line) from a single line.
+      #
+      # RBS treats +#+ as a comment marker everywhere outside string
+      # literals — the official lexer discards it before parsing. The
+      # line-based readers here (+find_raw_type_body+, +parse_type_aliases+,
+      # +parse_rbs_file+) concatenate record-body lines *without* a newline
+      # separator, so a comment authored inside a record body
+      # (+{ # note\n id: String }+) would otherwise fold into the next
+      # field name and blow up +parse_field_name+ (issue #20).
+      #
+      # We scan character by character so a +#+ inside a string literal or
+      # inside a bracketed annotation value (e.g. +@desc(a # b)+) is left
+      # untouched; only a +#+ at bracket depth 0 outside any string starts
+      # a comment.
+      #: (String) -> String
+      def strip_rbs_comment(line)
+        depth = 0
+        in_string = nil #: String?
+
+        line.each_char.with_index do |ch, i|
+          if in_string
+            in_string = nil if ch == in_string
+          elsif ch == '"' || ch == "'"
+            in_string = ch
+          elsif ch == "(" || ch == "[" || ch == "{"
+            depth += 1
+          elsif ch == ")" || ch == "]" || ch == "}"
+            depth -= 1
+          elsif ch == "#" && depth <= 0
+            return line[0...i].to_s.rstrip
+          end
+        end
+
+        line
+      end
+
       #: (String) { (String, String) -> void } -> void
       def each_field_in_record(body)
         inner = body.strip.sub(/\A\{/, "").sub(/\}\z/, "").strip

data/lib/mcp_authorization/version.rb

@@ -1,3 +1,3 @@
 module McpAuthorization
-  VERSION = "0.5.1"
+  VERSION = "0.5.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mcp_authorization
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.5.3
 platform: ruby
 authors:
 - AndyGauge
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-27 00:00:00.000000000 Z
+date: 2026-06-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -45,9 +45,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '3.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -55,9 +52,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '3.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement