okf 1.12.0 → 1.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a83101e62e3b3bc97d7351580d50ecc017be391a5edbde2e8f52388de529111
-  data.tar.gz: 040be5295642da56cbeed342424872469d1c2b15efcb1b477f10076d7c90fafc
+  metadata.gz: 84ee2cefa8e04f2358c9125ca00ccdf9de8a12ab0a78a96315ec846bab8d3e87
+  data.tar.gz: 7a3186c5aa2924b4425a0c0a86c9f0812948427348d4fd3d0cd46852bd6dc575
 SHA512:
-  metadata.gz: 47fb84d8dffc04eee30eb65adfaca756ae43315e2d152e62692084a5bd04c6a7992529d243b2375412a8339a55db891c3ae18d679e171d5709e9426b93686047
-  data.tar.gz: 30390e1eecc1570b28531c374b21200309630aad87f821a7c3f25b631ca5285e03b91baab9048f69127931a09368da1ab38a089fc9bc25473c05da3c0fadfe2b
+  metadata.gz: b0c9f1002b408702c74f73be001eab10b6691419700d33b41e81bd001d21858f1d79289696edbb2ad6e7c6f4a76ccd4c7458cf211e82fded5224f5fcfa6328b4
+  data.tar.gz: 0ed68e0095ab1aa912c5df3b6fd7b9f82e0e07f2cad0c182437cb70021beed8d5ecb054106185204b18d0f138303372bc62202c286aec75ce6c4a43434f2e546

data/CHANGELOG.md

@@ -5,6 +5,105 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.13.0] - 2026-08-07
+
+### Added
+
+- **`Bundle#directories`** — the bundle's own answer to "does this bundle have
+  directory X?", public because every surface now asks it (the CLI's concept
+  views, `okf-mcp`'s `dir` refusal) and the API this version's minor bump
+  exists for. Introduced by, and argued in, the `root` fix under Fixed below.
+
+### Changed
+
+- **The repository became a monorepo, and the gem moved into `okf/`.** Nothing
+  about the published gem changes in kind — same name, same library, same `v*` tag
+  series, same image, byte-identical in size to a pre-move build — but a checkout is laid out differently: one
+  directory per gem, named for the gem it ships, so `okf-mcp/` and the rest can
+  land beside the baseline without reshaping anything. `plugin/`,
+  `.claude-plugin/`, `.okf/` and the `Dockerfile` stay at the root; the last of
+  those because its build context must be the repo root, where the `.git` the
+  gemspec's `git ls-files` needs lives. From a checkout it is `cd okf` for
+  everything about the gem, and plain `rake` at the root to run every gem's suite
+  or to validate this repo's own bundle.
+- **`CODE_OF_CONDUCT.md` no longer ships in the gem** (70 files, from 71). It is
+  a repository document and was packaged only because nothing rejected it. The
+  gem now carries **its own README** instead of the project's — which also fixes
+  a long-standing wart, since the project README opens with images under
+  `.github/` that the gemspec has never packaged, so the page on rubygems.org has
+  been rendering a broken hero.
+- `changelog_uri` points at `okf/CHANGELOG.md`, where this file now lives.
+
+### Fixed
+
+- **A directory really named `root` is nameable again.** `--dir` and `--area`
+  accept `root` as a spelling of the bundle root, which is worth a shell quote
+  right up until a bundle actually has a `root/` directory — and then the alias
+  made it unaddressable, answering for the bundle root instead: the wrong
+  concepts, exit 0, nothing said. The alias now yields to a real directory,
+  since a convenience is worth less than a directory being reachable at all;
+  where no such directory exists nothing changes, which is every bundle that
+  has ever relied on the spelling. `okf dirs` carried the same fold into its
+  `subtree` column, where it computed the `root` row's subtree against the
+  bundle root — so the number on the row disagreed with what `--dir` on that
+  row returns, the one thing it promises never to do.
+
+  "Does this bundle have a `root` directory?" is now asked of the bundle
+  (`Bundle#directories`, under Added above) rather than of whichever list a view
+  had to hand. The concept views were reading it off the *catalog*, which knows
+  only directories holding concepts, so a `root/` carrying nothing but an
+  `index.md` stayed folded in `catalog`/`files`/`tags`/`types`/`search` while
+  `dirs` and `index` named it correctly — two answers to one question about one
+  bundle. And a multi-bundle `okf search @a @b --dir root` resolved per bundle
+  inside the loop, so one flag meant the `root/` subtree in the bundle that has
+  one and the bundle root in the bundle that does not, merged into a single
+  ranking with nothing in the output saying so; the served set resolves it once.
+
+  `Bundle#directories` counts every file kind that makes a directory real —
+  concepts, an `index.md`, and now a scoped `log.md`, which the first cut left
+  out: a `root/` holding only its history was invisible to the set, so the
+  alias won again for exactly the shape the fix was named after, one file kind
+  over. The same seed feeds `directory_index`, so `dirs`, `index` and `stats`
+  count a log-only directory too, and every surface answers "does this bundle
+  have directory X?" from one list.
+- **`filter_entries` regained its 1.12.0 arity.** The dirs-source fix above
+  added a required third parameter to a helper on `CLI::Command` — the base
+  every verb inherits, plugin gems' verbs included — so an out-of-tree verb
+  calling the released two-argument shape raised `ArgumentError` at runtime.
+  The parameter defaults now, and the default is 1.12.0's resolution — the
+  helper is handed rows, not the folder, so it has nothing to resolve a real
+  `root/` against, and the `root` alias folds exactly as it did; the plugin
+  suite drives a 1.12.0-era verb through the two-argument shape to pin it.
+  Its sibling `filter_ids` makes the opposite choice on purpose: it *is*
+  handed the folder, and its two-argument shape resolves through `dir_scope`,
+  because the unconditional fold there was the bug this entry fixes, not a
+  contract — an old caller gets the corrected answer rather than the familiar
+  wrong one. In-tree callers pass
+  the set through `dir_scope`, which also derives it only when a `--dir` or
+  `--area` flag will actually consult it — a plain listing no longer pays a
+  per-path ancestor walk for a set nothing reads (and `Bundle#directories` is
+  memoized, so the verbs that ask twice pay once).
+- **Coverage stopped measuring the plugin's curation hook** for one commit, and
+  said so by going *up*: SimpleCov's root defaults to the working directory, so
+  moving the gem down a level dropped ~100 tested lines out of the report and
+  line coverage read 98.63% against 98.47%. Its root is the repository now, with
+  the report still written inside the gem.
+
+### Security
+
+- **A symlinked file in a bundle can no longer read past the bundle root.** The
+  traversal guard `Path.join_under!` was lexical — it expands the path string,
+  and `File.expand_path` does not resolve a symlink — so a link whose name sat
+  inside the root but whose target did not passed the check, and the read
+  followed it. Every read now realpath-resolves and re-checks against the real
+  root: `Path.under?` is the shared pure predicate, `Bundle::Reader` quarantines
+  an escaping file into the unparseable bucket (a planted symlink is one bad
+  file, not grounds to fail the whole bundle read, which would hand any writer of
+  a served directory a denial of service), and `Concept::File` guards its own
+  read. A symlink that stays inside the bundle still resolves as before. The gap
+  reached every reader; serving a bundle's contents to an agent — as `okf-mcp`
+  does — is what surfaced it.
+
 ## [1.12.0] - 2026-07-24
 
 ### Added
@@ -1223,6 +1322,8 @@ Initial release.
 
 - Runs on Ruby >= 2.4 with two runtime dependencies: rack and webrick.
 
+[1.13.0]: https://github.com/serradura/okf-gem/compare/v1.12.0...v1.13.0
+[1.12.0]: https://github.com/serradura/okf-gem/compare/v1.11.0...v1.12.0
 [1.11.0]: https://github.com/serradura/okf-gem/compare/v1.10.0...v1.11.0
 [1.10.0]: https://github.com/serradura/okf-gem/compare/v1.9.0...v1.10.0
 [1.9.0]: https://github.com/serradura/okf-gem/compare/v1.8.0...v1.9.0