rails-ai-bridge 3.5.2 → 3.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 87f66a2c3254515e628ba04cac7fcda527bda86254df738f3384f28ccad5fcdf
-  data.tar.gz: 6bc9b66810b8c5bedd1526a3683b13530a46c1c5b61ba7db89288544d61bce20
+  metadata.gz: ecc139c0066902b92342f732a9e9344b5aa5468153f6193708fa95815bbe0535
+  data.tar.gz: 05fe2c9d0ada4aa7a836b1dea1ec70f60ad75a94f87c4b4ff5b29e6c4fe9ca81
 SHA512:
-  metadata.gz: ae624883e2d08b61bd76d178b52d7067aefd611a1fc6e6f760b7f07361b7acbe877b2ce3f5984b2b6c9d0c74b7376c522cc8065fdf25a8cc8c78660a95583c18
-  data.tar.gz: 8cc300bb5f6e4d9669e8de9313eca2c4e5cd0c4a7ce336c2cec7bd5c69665df2580d3864536aef092cc22c16ca775909d26c40c372b5bc065577f567836dc149
+  metadata.gz: 73de5c66876b8b4ca8e7a50e3bdaaf8700984f23f884f492d7ebc880aee3fd3345efd847c4d4252012ac920c8e5450877767e79e48ecdc141f74b0d0d5dc5dd8
+  data.tar.gz: '08b0c68f5f5af762af8c87e937ba5360f5fa6732f07b3543d24bb000e118f5dad55ca4228984f7f88dc471ea70b8f3a75f8ae4b3a3dbd4eacbef205be1683cfa'

data/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [3.6.1] - 2026-08-07
+
+### Security
+
+- **Skill-pack git URL scheme allowlist** (#105/#110) — `DefaultGitRunner#clone_repo` accepts only `https://`, SCP-style `git@host:path`, and `ssh://`. Rejects `file://`, plain `http://`, and empty URLs. Validation `ArgumentError`s do not interpolate the raw URL, so credentials in userinfo cannot leak via exception messages.
+- **SECURITY.md supported-versions table** (#106/#112) — documents 3.6.x / 3.5.x as supported, best-effort for older 3.x, and end-of-life for 1.x / 2.x.
+- **Residual MCP HTTP risk checklist** (#107/#113) — operator checklist in `docs/mcp-security.md` (open HTTP default, CORS `*`, in-memory rate limit) with an install-generator pointer.
+
+### Changed
+
+- **`rubydex` bumped to `~> 0.3.0`** (#103/#111) — was `~> 0.2.9`. Run `bundle update rubydex` in host apps.
+- **Dependency audit (2026-08)** (#99) — `bundle-audit` clean; official `mcp` remains on **0.25.x** (`< 1.0`). Migration to `mcp` 1.x remains open in #104.
+
+## [3.6.0]
+
+### Changed
+
+- **`mcp` minimum version raised to 0.25** (#92) — the gemspec lower bound is now `>= 0.25` (was `>= 0.10`), matching the minimum version the codebase actually requires. The upper bound remains `< 1.0`.
+- **`rubydex` constraint tightened to `~> 0.2.9`** (#92) — was `~> 0.2.4`. This is a **minor breaking change** for users pinned to rubydex 0.2.4–0.2.8; update your lockfile with `bundle update rubydex`.
+- **`simplecov` bumped to 1.0** (#92) — development dependency only; does not affect gem consumers. The test suite filter was migrated from `add_filter '/spec/'` to `skip 'spec'` per the simplecov 1.0 migration guide (`SourceFile#project_filename` no longer includes a leading separator).
+
+### Fixed
+
+- **`Style/ArrayIntersect` lint offense** (#91/#92) — pre-existing rubocop offense in `context_summary.rb` autocorrected to use `Array#intersect?`. No behavior change.
+
+### Added
+
+- **PathResolver architectural documentation** (#90/#91) — class-level docblock documents PathResolver's intentional role as a shared utility (11 introspector callers, high betweenness centrality). Prevents false "god class" flags from future graph analyses.
+- **PathResolver edge-case tests** (#90/#91) — 6 new specs covering the private `SafeRelativePath` (backslash normalization, Windows path rejection, empty path rejection) and `SafeJoin` (valid joins, traversal escape prevention) helper classes.
+
 ## [3.5.2]
 
 ### Security

data/README.md

@@ -10,6 +10,7 @@
 [![CI](https://github.com/igmarin/rails-ai-bridge/actions/workflows/ci.yml/badge.svg)](https://github.com/igmarin/rails-ai-bridge/actions)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 ![CodeRabbit Pull Request Reviews](https://img.shields.io/coderabbit/prs/github/igmarin/rails-ai-bridge?utm_source=oss&utm_medium=github&utm_campaign=igmarin%2Frails-ai-bridge&labelColor=171717&color=FF570A&link=https%3A%2F%2Fcoderabbit.ai&label=CodeRabbit+Reviews)
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/igmarin/rails-ai-bridge)
 
 ---
 
@@ -780,7 +781,7 @@ Bug reports and pull requests: [github.com/igmarin/rails-ai-bridge/issues](https
 
 ## Acknowledgments & Origins
 
-This gem ships as **rails-ai-bridge** (Ruby **`RailsAiBridge`**, version **3.1.0**). Earlier iterations of the same codebase were distributed as `rails-ai-context`.
+This gem ships as **rails-ai-bridge** (Ruby **`RailsAiBridge`**, version **3.6.1**). Earlier iterations of the same codebase were distributed as `rails-ai-context`.
 
 RailsMCP evolved from 
 [crisnahine/rails-ai-context](https://github.com/crisnahine/rails-ai-context),

data/SECURITY.md

@@ -4,10 +4,12 @@
 
 | Version | Supported          |
 |---------|--------------------|
-| 3.0.x   | :white_check_mark: |
-| 2.x     | :white_check_mark: |
-| 1.x     | :white_check_mark: |
-| < 1.0   | :x:                |
+| 3.6.x   | :white_check_mark: |
+| 3.5.x   | :white_check_mark: |
+| 3.0.x–3.4.x | :white_check_mark: (security fixes best-effort) |
+| 2.x     | :x: (end of life — upgrade to 3.x) |
+| 1.x     | :x: |
+| < 1.0   | :x: |
 
 ## Reporting a Vulnerability
 

data/UPGRADING.md

@@ -1,5 +1,40 @@
 # Upgrading rails-ai-bridge
 
+## Upgrading from 3.6.0 to 3.6.1
+
+**One action required if you are pinned to `rubydex` 0.2.x:**
+
+The `rubydex` gem constraint moved from `~> 0.2.9` to `~> 0.3.0`. After upgrading
+rails-ai-bridge:
+
+```bash
+bundle update rubydex
+```
+
+No configuration or application code changes are required for the security and
+documentation updates in 3.6.1. Skill-pack git sources must use `https://`,
+SCP-style `git@host:path`, or `ssh://` (plain `http://` and `file://` are rejected).
+
+---
+
+
+## Upgrading from 3.5.x to 3.6.0
+
+**One action required if you are pinned to an older `rubydex`:**
+
+The `rubydex` gem constraint was tightened from `~> 0.2.4` to `~> 0.2.9`. If your
+lockfile resolves to rubydex 0.2.4–0.2.8, update it after upgrading:
+
+```bash
+bundle update rubydex
+```
+
+No other configuration or code changes are required. The `mcp` lower bound also
+moved from `>= 0.10` to `>= 0.25`, but if you were already on a recent version
+(no earlier than 0.25) this is a no-op.
+
+---
+
 ## Upgrading from 1.x to 2.x
 
 **No configuration changes required.** Every `config.*` attribute from 1.x is still available — `Configuration` now delegates to focused sub-objects but exposes the same flat DSL. See `CHANGELOG.md` for the full list of internal changes.

data/docs/mcp-security.md

@@ -72,3 +72,16 @@ The stdio MCP server has no Bearer layer; anyone who can run the process can use
 
 - [SECURITY.md](../SECURITY.md) — reporting vulnerabilities and design summary
 - [docs/GUIDE.md](GUIDE.md) — full configuration and MCP tool reference
+
+## Residual risk checklist (operators)
+
+Use this before exposing HTTP MCP beyond a single-developer machine:
+
+| Risk | Default | Mitigation |
+|------|---------|------------|
+| Unauthenticated HTTP when no token/resolver/JWT is configured | Open access (local DX) | Set `RAILS_AI_BRIDGE_MCP_TOKEN` or `config.http_mcp_token`, and/or `config.require_http_auth = true` |
+| `cors_origins` includes `*` | CORS disabled unless configured | Prefer exact origins; never combine `*` with browsers on untrusted networks |
+| In-memory rate limit | Per-process only | Use `config.mcp.rate_limiter` / reverse proxy / WAF for multi-worker or multi-host |
+| Information disclosure via tools | Read-only tools still reveal schema/routes/code | Prefer stdio; bind HTTP to `127.0.0.1`; use exclusions/presets for regulated data |
+
+See also [SECURITY.md](../SECURITY.md) for production `auto_mount` requirements and private vulnerability reporting.

data/lib/generators/rails_ai_bridge/install/install_generator.rb

@@ -189,6 +189,7 @@ module RailsAiBridge
             # return 401 unless one of the auth mechanisms above is configured.
             # Default is false for backward compatibility with local development.
             # config.mcp.require_http_auth = true
+            # See docs/mcp-security.md — Residual risk checklist (operators).
             #
             # Timing-safe token comparison is built in, but add rate limiting too
             # (e.g. Rack::Attack throttle on config.http_path) to prevent brute-force.

data/lib/rails_ai_bridge/path_resolver.rb

@@ -3,6 +3,27 @@
 module RailsAiBridge
   # Resolves configured Rails logical paths to filesystem paths without leaking
   # machine-specific absolute paths into generated assistant context.
+  #
+  # == Architectural role: intentional shared utility
+  #
+  # PathResolver is deliberately used by every introspector that needs to
+  # locate files on disk (controller, model, view, stimulus, turbo, auth,
+  # api, config, action_text, activeStorage, nonArModels — 11 callers as of
+  # v3.6.1). It is NOT a god class despite high betweenness centrality in
+  # graph analyses: a foundational path-resolution utility is expected to
+  # sit at the centre of the introspector graph. Splitting it would spread
+  # path-safety logic (traversal guards, safe joins) across multiple files
+  # and weaken the single responsibility it currently holds.
+  #
+  # The three private helper classes — SafeRelativePath, SafeJoin, and
+  # ConfiguredPathsError — are kept nested and private_constant so they
+  # cannot leak into the public API or be referenced by callers. This
+  # keeps the safety surface area small and auditable in one file.
+  #
+  # If a future graph analysis flags this class again, check the
+  # betweenness centrality against the caller count before proposing a
+  # split: a utility with many callers and a single responsibility is
+  # healthy, not smelly.
   class PathResolver
     # Validates user-provided relative paths before filesystem operations.
     class SafeRelativePath

data/lib/rails_ai_bridge/registry/skill_source_resolver.rb

@@ -69,11 +69,22 @@ module RailsAiBridge
       #
       # @param url [String] git repository URL
       # @param dest [String] destination directory path
+      # @raise [ArgumentError] if the URL or destination is unsafe or not allowlisted
       # @raise [RuntimeError] if git clone command fails, returns non-zero, or times out
       # @return [void]
+      # @note Skill-pack clones accept only +https://+, SCP-style
+      #   +git@host:path+, and +ssh://+ remote URLs.
+      ALLOWED_GIT_URL_PATTERN = %r{\A(?:https://|ssh://|git@[A-Za-z0-9._-]+:)}
+
       def clone_repo(url, dest)
-        raise ArgumentError, "Invalid git URL #{url.inspect}: URLs must not start with '-'" if url.start_with?('-')
-        raise ArgumentError, "Invalid destination #{dest.inspect}: paths must not start with '-'" if dest.to_s.start_with?('-')
+        url = url.to_s
+        # Avoid interpolating +url+ into errors: userinfo may contain credentials.
+        raise ArgumentError, "Invalid git URL: URLs must not start with '-'" if url.start_with?('-')
+        raise ArgumentError, "Invalid destination: paths must not start with '-'" if dest.to_s.start_with?('-')
+        unless url.match?(ALLOWED_GIT_URL_PATTERN)
+          raise ArgumentError,
+                'Invalid git URL: scheme is not allowlisted (use https://, git@host:path, or ssh://)'
+        end
 
         with_timeout('git clone') do
           _stdout, stderr, status = Open3.capture3('git', 'clone', '--', url, dest)

data/lib/rails_ai_bridge/serializers/context_summary.rb

@@ -459,7 +459,7 @@ module RailsAiBridge
       private_class_method :sensitive_config_basename?
 
       def sensitive_config_path_segment?(path)
-        path.split('/').any? { |segment| SENSITIVE_CONFIG_SEGMENTS.include?(segment) }
+        path.split('/').intersect?(SENSITIVE_CONFIG_SEGMENTS)
       end
       module_function :sensitive_config_path_segment?
       private_class_method :sensitive_config_path_segment?

data/lib/rails_ai_bridge/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsAiBridge
-  VERSION = '3.5.2'
+  VERSION = '3.6.1'
 end

data/rails-ai-bridge.gemspec

@@ -50,11 +50,11 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   # Core dependencies
-  spec.add_dependency 'mcp', '>= 0.10', '< 1.0' # Official MCP Ruby SDK
+  spec.add_dependency 'mcp', '>= 0.25', '< 1.0' # Official MCP Ruby SDK
   spec.add_dependency 'railties', '>= 7.1', '< 10.0'
   spec.add_dependency 'thor', '>= 1.0', '< 3.0'
   spec.add_dependency 'zeitwerk', '~> 2.6' # Autoloading
 
   # Semantic code analysis via Shopify's rubydex
-  spec.add_dependency 'rubydex', '~> 0.2.4'
+  spec.add_dependency 'rubydex', '~> 0.3.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-ai-bridge
 version: !ruby/object:Gem::Version
-  version: 3.5.2
+  version: 3.6.1
 platform: ruby
 authors:
 - Ismael Marin
@@ -15,7 +15,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.10'
+        version: '0.25'
     - - "<"
       - !ruby/object:Gem::Version
         version: '1.0'
@@ -25,7 +25,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.10'
+        version: '0.25'
     - - "<"
       - !ruby/object:Gem::Version
         version: '1.0'
@@ -89,14 +89,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.4
+        version: 0.3.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.4
+        version: 0.3.0
 description: Rails-AI-Bridge introspects your Rails application and exposes structure
   to AI assistants via static context files and a live Model Context Protocol (MCP)
   server. It classifies Active Record models semantically (Core, Join, Supporting),