otto 2.9.0 → 2.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0bbfc031ec4ff48d3d0ce373a4a8cbbfac62571f80a07ef54427e71a3fc34444
-  data.tar.gz: 4cf1c8c6171a8af0f18dcc61c8c00b86c9bc829b573e8e3b727b1047ad2ce230
+  metadata.gz: b8303453d265fcf2d5b0fa0754aafdbdb3e24eb89be9dc5a7b5611b4f2bcc699
+  data.tar.gz: 2081706f65a3475f95555d96547841691f906b015f8b012739abc7804923fc76
 SHA512:
-  metadata.gz: c4405b81202ecf23a1f09629ccc8392a70a1fa6d0287c46ba4590517f884e527ecca5d909475b6ff772ad857def5686991c99b9b93dde9489c040d3502662f73
-  data.tar.gz: 155b0b637c48466d3ad68f91f28647c6f7a7a6cf4c60aac343af270c09a0be98f6fa5c1764d94e4886a148ee8d9f226c1567118e865404b3add638dbe50ee2a5
+  metadata.gz: 75c496ee29c9c4ec0b05a8effda77e4e1dafc02080fb341a2320313011437f2b0bc0511ad6ca7d1b53928d6f75130693c974c72ed053aa35e5c6d16f60af0a5e
+  data.tar.gz: 9d9615efa73c7ebafafe7f7e1eb3e098f8c07f3200ac62882c52c39954087c73053fc9574beda1b1e11ecc836e0b9bacb70fe267c90fa92600531ef14fca1b63

data/.github/dependabot.yml

@@ -9,6 +9,11 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    # All action bumps arrive as one PR instead of one per action.
+    groups:
+      github-actions:
+        patterns:
+          - "*"
   - package-ecosystem: "bundler"
     directory: "/" # Location of package manifests
     schedule:

data/.github/workflows/ci.yml

@@ -28,15 +28,18 @@ jobs:
       fail-fast: false
       matrix:
         # Each Ruby runs twice: once against the committed Gemfile.lock
-        # (floor of the declared version range, reproducible) and once
-        # with the lockfile removed so Bundler resolves fresh inside the
-        # gemspec's pessimistic constraints (ceiling, what a downstream
-        # user will actually hit). The unlocked cells catch upstream
-        # releases that satisfy `~> X.Y` but break Otto at load time -
+        # (the reproducible maintainer snapshot) and once with the lockfile
+        # removed so Bundler resolves currently available versions inside the
+        # gemspec constraints. Neither resolution is a patched security floor;
+        # consumers must audit their own lockfiles. The unlocked cells catch
+        # upstream releases that satisfy `~> X.Y` but break Otto at load time -
         # e.g. facets 3.2.0 shipping a self-referential
         # `require_relative 'file/write.rb'` against a file deleted in
         # the same release, the reason 2.0.2 exists.
         include:
+          # Ruby 3.2 is EOL upstream but remains a blocking compatibility
+          # target. Ruby 3.5 and 4.0 remain provisional, non-blocking targets.
+          # See docs/reference/runtime-and-dependency-security.md.
           - ruby: "3.2"
             experimental: false
             lockfile: "locked"
@@ -69,9 +72,9 @@ jobs:
             lockfile: "unlocked"
 
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         continue-on-error: ${{ matrix.experimental }}
         with:
           ruby-version: ${{ matrix.ruby }}
@@ -80,7 +83,7 @@ jobs:
           bundler-cache: ${{ !matrix.experimental && matrix.lockfile == 'locked' }}
 
       - name: Setup tmate session
-        uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3
+        uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3.24
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
         with:
           detached: true

data/.github/workflows/claude-code-review.yml

@@ -30,13 +30,20 @@ jobs:
     #      CLAUDE_CODE_OAUTH_TOKEN is empty and the action would fail.
     #   3. The event is a freshly opened PR, a 'claude-review' label add, or a push
     #      to a PR that already carries the 'claude-review' label.
+    # A manual workflow_dispatch run bypasses 2 and 3 (it can only be started by a
+    # user with write access, on a branch in this repo) but still skips bots.
     if: ${{
       !endsWith(github.actor, '[bot]') &&
-      !github.event.pull_request.head.repo.fork &&
       (
-        (github.event.action == 'opened') ||
-        (github.event.action == 'labeled' && github.event.label.name == 'claude-review') ||
-        (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'claude-review'))
+        github.event_name == 'workflow_dispatch' ||
+        (
+          !github.event.pull_request.head.repo.fork &&
+          (
+            (github.event.action == 'opened') ||
+            (github.event.action == 'labeled' && github.event.label.name == 'claude-review') ||
+            (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'claude-review'))
+          )
+        )
       )
       }}
 
@@ -48,13 +55,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@19dda84776b3518d98b8798e591daee763049ed3 # v1.0.220
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
@@ -62,11 +69,26 @@ jobs:
           # runs) -> the CLAUDE_MODEL repo variable -> this built-in default.
           # Pinning a current id avoids the action's frozen default, which 404s
           # ("model: claude-sonnet-4-20250514"). Fall back to Sonnet on overload.
-          model: "${{ inputs.model || vars.CLAUDE_MODEL || 'claude-opus-4-6' }}"
-          fallback_model: "${{ vars.CLAUDE_FALLBACK_MODEL || 'claude-sonnet-4-6' }}"
+          # v1 removed the model/fallback_model inputs; both are now CLI flags
+          # passed through claude_args.
+          claude_args: |
+            --model ${{ inputs.model || vars.CLAUDE_MODEL || 'claude-opus-4-6' }}
+            --fallback-model ${{ vars.CLAUDE_FALLBACK_MODEL || 'claude-sonnet-4-6' }}
+
+          # Prompt for automated review (no @claude mention needed).
+          # v1 renamed direct_prompt -> prompt. track_progress restores the
+          # tracking/sticky comment that v0 automation mode posted by default; it
+          # only applies to pull_request/issue events, so a workflow_dispatch run
+          # has no PR to comment on and reports to the job log instead.
+          track_progress: true
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number || 'none (manual run)' }}
+
+            If no PR number is given, use `gh` to find an open pull request whose
+            head is ${{ github.ref_name }}; if there is none, say so and stop.
+            (The checkout is shallow, so compare via the API, not local git.)
 
-          # Direct prompt for automated review (no @claude mention needed)
-          direct_prompt: |
             Please review this pull request and provide feedback on:
             - Code quality and best practices
             - Potential bugs or issues
@@ -80,9 +102,12 @@ jobs:
           use_sticky_comment: true
 
       - name: Remove claude-review label
-        # Remove label whether success or failure - prevents getting stuck
-        if: always() && github.event.action != 'opened'
-        uses: actions/github-script@v9
+        # Remove label whether success or failure - prevents getting stuck.
+        # Only for pull_request events: a workflow_dispatch payload has no
+        # issue number, so context.issue.number would be undefined and the
+        # removeLabel call would fail (silently, below) with the label intact.
+        if: always() && github.event_name == 'pull_request' && github.event.action != 'opened'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             try {

data/.github/workflows/claude.yml

@@ -26,13 +26,13 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@19dda84776b3518d98b8798e591daee763049ed3 # v1.0.220
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
@@ -40,8 +40,11 @@ jobs:
           # editing this file. Pinning a current id avoids the action's frozen
           # default, which 404s ("model: claude-sonnet-4-20250514"). Fall back to
           # Sonnet if the primary is unavailable or overloaded.
-          model: "${{ vars.CLAUDE_MODEL || 'claude-opus-4-6' }}"
-          fallback_model: "${{ vars.CLAUDE_FALLBACK_MODEL || 'claude-sonnet-4-6' }}"
+          # v1 removed the model/fallback_model inputs; both are now CLI flags
+          # passed through claude_args.
+          claude_args: |
+            --model ${{ vars.CLAUDE_MODEL || 'claude-opus-4-6' }}
+            --fallback-model ${{ vars.CLAUDE_FALLBACK_MODEL || 'claude-sonnet-4-6' }}
 
           # This is an optional setting that allows Claude to read CI results on PRs
           additional_permissions: |
@@ -50,7 +53,6 @@ jobs:
           # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
           # prompt: 'Update the pull request description to include a summary of changes.'
 
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://docs.anthropic.com/en/docs/claude-code/sdk#command-line for available options
-          # claude_args: '--model claude-opus-4-1-20250805 --allowed-tools Bash(gh pr:*)'
+          # More claude_args options (tool allowlists, --max-turns, --mcp-config):
+          # https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://docs.anthropic.com/en/docs/claude-code/sdk#command-line

data/.github/workflows/code-smells.yml

@@ -21,10 +21,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: 3.4
 
@@ -71,7 +71,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload Reek report as artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: reek-report
@@ -88,10 +88,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: 3.4
           bundler-cache: true

data/.github/workflows/release-gem.yml

@@ -139,7 +139,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           bundler-cache: true
           # Pinned to 3.3 (oldest non-experimental Ruby in the CI matrix).
@@ -169,4 +169,4 @@ jobs:
           echo "Releasing otto ${gem_version} from tag ${RELEASE_TAG}"
 
       - name: Build and push gem to RubyGems
-        uses: rubygems/release-gem@052cc82692552de3ef2b81fd670e41d13cba8092 # v1.4.0
+        uses: rubygems/release-gem@7f9650160c1a4e7989fdc9855807bdbd421d8b6b # v1.4.1

data/.github/workflows/ruby-lint.yml

@@ -44,15 +44,15 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
 
       - name: Setup tmate session
-        uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3
+        uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3.24
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
         with:
           detached: true

data/.github/workflows/yardoc.yml

@@ -42,12 +42,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Ruby environment
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '3.4'
           bundler-cache: true
@@ -82,10 +82,10 @@ jobs:
           echo "::endgroup::"
 
       - name: Setup GitHub Pages configuration
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Upload documentation artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: './doc'
 
@@ -102,7 +102,7 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
 
   notify-completion:
     timeout-minutes: 5

data/.gitignore

@@ -1,19 +1,14 @@
 .DS_Store
 .bundle
-.byebug*
 .history
 .devcontainer
 .vscode
 *.env
 *.log
-*.md
 *.txt
 .*.json
 !LICENSE.txt
 !spec/fixtures/*.txt
-!examples/**/*.md
-!README.md
-!CLAUDE.md
 .ruby-version
 appendonlydir
 data/
@@ -27,3 +22,4 @@ vendor
 .mcp.json
 .claude
 .serena
+.yardoc

data/.rubocop_todo.yml

@@ -296,15 +296,11 @@ Lint/DuplicateMethods:
   Exclude:
     - 'lib/otto/privacy/geo_resolver.rb'
 
-# Offense count: 5
+# Offense count: 1
 # Configuration parameters: AllowedParentClasses.
 Lint/MissingSuper:
   Exclude:
     - 'lib/otto/mcp/rate_limiting.rb'
-    - 'lib/otto/security/authentication/strategies/api_key_strategy.rb'
-    - 'lib/otto/security/authentication/strategies/permission_strategy.rb'
-    - 'lib/otto/security/authentication/strategies/role_strategy.rb'
-    - 'lib/otto/security/authentication/strategies/session_strategy.rb'
 
 # Offense count: 12
 # This cop supports unsafe autocorrection (--autocorrect-all).
@@ -601,6 +597,9 @@ RSpec/DescribeMethod:
     - 'spec/otto/initialization_spec.rb'
     - 'spec/otto/locale_config_spec.rb'
     - 'spec/otto/mcp/rate_limiting_spec.rb'
+    - 'spec/otto/mcp/protocol_spec.rb'
+    - 'spec/otto/mcp/registry_spec.rb'
+    - 'spec/otto/mcp/route_parser_spec.rb'
     - 'spec/otto/mcp_route_parsing_spec.rb'
     - 'spec/otto/rate_limiting_spec.rb'
     - 'spec/otto/response_integration_spec.rb'
@@ -860,9 +859,13 @@ RSpec/SpecFilePathFormat:
     - 'spec/otto/enhanced_routing_spec.rb'
     - 'spec/otto/error_handler_registration_spec.rb'
     - 'spec/otto/error_handling_spec.rb'
+    - 'spec/otto/fallback_response_isolation_spec.rb'
     - 'spec/otto/file_safety_spec.rb'
     - 'spec/otto/locale_config_spec.rb'
     - 'spec/otto/mcp/rate_limiting_spec.rb'
+    - 'spec/otto/mcp/protocol_spec.rb'
+    - 'spec/otto/mcp/registry_spec.rb'
+    - 'spec/otto/mcp/route_parser_spec.rb'
     - 'spec/otto/mcp/token_auth_spec.rb'
     - 'spec/otto/mcp_route_parsing_spec.rb'
     - 'spec/otto/rate_limiting_spec.rb'

data/AGENTS.md

@@ -2,6 +2,27 @@
 
 This file provides essential guidance to AI agents when working with Otto.
 
+## Project claims and source authority
+
+### Attribution
+
+Do not infer project terminology or guarantees from repetition. Before attributing a claim to the project, locate an authoritative primary source and provide its exact wording. Treat delivery notes, commit messages, agent output, and documents created or modified during the current task as leads, not evidence. If the wording is absent, call it an interpretation or proposal. Never place paraphrases in quotation marks.
+
+### Authoritative sources
+
+Authoritative sources must be identified explicitly; repository presence alone does not confer authority. Accepted specifications and ADRs may establish project claims only within their stated scope. Delivery notes, commit messages, issue discussions, summaries, and agent-authored text are non-authoritative unless an authoritative source incorporates them explicitly.
+
+### Normative claims
+
+For normative claims concerning security, privacy, compatibility, persistence, or data loss:
+
+1. Cite the authoritative source and its exact wording.
+2. Distinguish quotations, paraphrases, interpretations, and proposals.
+3. Do not use material created or modified during the current task to validate that task’s claims.
+4. If no authoritative wording exists, report the claim as unsupported.
+
+
+
 ## Error Handler Registration
 
 Register handlers for expected business logic errors to avoid logging them as 500 errors:
@@ -48,6 +69,24 @@ Helper modules should avoid overriding these methods inherited from Rack::Reques
 
 No runtime validation is performed for performance reasons. Overriding these methods will cause undefined behavior.
 
+## Static File Registration
+
+Files under the `public:` directory are served without registration. Use
+`mount_static` to bind a URL prefix to a directory outside it, or to verify a
+required asset directory at boot:
+
+```ruby
+otto = Otto.new('routes.txt', public: 'public')
+otto.mount_static('/assets', root: 'build/assets')
+```
+
+- Roots are canonicalized at registration; a missing or unsafe root raises `ArgumentError`
+- Precedence is fixed: literal routes, then mounts (longest prefix first), then `public:`, then dynamic routes
+- Must be registered before first request (before configuration freezing)
+- `add_static_path` was removed in v2.10.0 and has no shim
+
+See `docs/guides/routing.md` for the full contract.
+
 ## Authentication Architecture
 
 Authentication is handled by `RouteAuthWrapper` at the handler level, NOT by middleware.
@@ -56,7 +95,7 @@ Authentication is handled by `RouteAuthWrapper` at the handler level, NOT by mid
 
 ```ruby
 otto.add_auth_strategy('session', SessionStrategy.new)
-otto.add_auth_strategy('apikey', APIKeyStrategy.new)
+otto.add_auth_strategy('apikey', APIKeyStrategy.new(api_keys: ENV.fetch('API_KEYS').split(',')))
 ```
 
 - Strategy names must be unique