rails-ai-context 4.3.2 → 4.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5081505ca1d99874de52ff33fb72ff75877b67ec79984fb9bb9004dbcbf4ea27
-  data.tar.gz: cc6781e87f54708aab290044a33aee7aff3ddb7579fd4fe4f592eb5d3721b310
+  metadata.gz: 6fa4865cb6081dbc1a243371d270db6f80304fd5c3d7ccd8052d2c7c0d672dc6
+  data.tar.gz: 055a0fc1462f6a698e004090fda64703e98478af1d8bd1ca3426d85a5e9b6f69
 SHA512:
-  metadata.gz: '09c0346700785aa79211b6fddf7e52dfedf9989500abd53538fc451ca3b96b0f0450865a2cbad86d6c26ac2aaefd4e19a8dcc66587960674a0adefcc324d34a9'
-  data.tar.gz: dfd9f8d968e87b736d026e9cf3fe98ef08f61527ad4be1a9c96f8abe8a9d8b47b15d0133970df3e9fd0d4f915de87c0d893686f236f9b903a1ef53ef2c406e67
+  metadata.gz: ac7a84cb7f54d6106c2bf33c94208f75871b9b8d25d304e0ddde0e36f73d3bd8e973dbf5f81b0665545548fd740fbdf60726a79195889cfbb9683cc733c80307
+  data.tar.gz: 440e13668f46d1578933bd5f053ea15cbae494938097f55380a0ab78c3a30a0f92dd74b20ad37edf7aed67f4aade37810e02b141e9d25e8963d40e3d63a650b9

data/CHANGELOG.md

@@ -5,6 +5,75 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.4.0] — 2026-04-03
+
+### Added
+- **33 introspector enhancements** — every introspector upgraded with new detection capabilities:
+  - **SchemaIntrospector**: expression indexes, column comments in static parse, `change_column_default`/`change_column_null` in migration replay
+  - **ModelIntrospector**: STI hierarchy detection (parent/children/type column), `attribute` API, enum `_prefix:`/`_suffix:`, `after_commit on:` parsing, inline `private def` exclusion
+  - **RouteIntrospector**: route parameter extraction, root route detection, RESTful action flag
+  - **JobIntrospector**: SolidQueue recurring job config, Sidekiq config (concurrency/queues), job callbacks (`before_perform`, `around_enqueue`, etc.)
+  - **GemIntrospector**: path/git gems from Gemfile, gem group extraction (dev/test/prod)
+  - **ConventionDetector**: multi-tenant (Apartment/ActsAsTenant), feature flags (Flipper/LaunchDarkly), error monitoring (Sentry/Bugsnag/Honeybadger), event-driven (Kafka/RabbitMQ/SNS), Zeitwerk detection, STI with type column verification
+  - **ControllerIntrospector**: `rate_limit` parsed into structured data (to/within/only), inline `private def` exclusion
+  - **StimulusIntrospector**: lifecycle hooks (connect/disconnect/initialize), outlet controller type mapping, action bindings from views (`data-action` parsing)
+  - **ViewIntrospector**: `yield`/`content_for` extraction from layouts, conditional layout detection with only/except
+  - **TurboIntrospector**: stream action semantics (append/update/remove counts), frame `src` URL extraction
+  - **I18nIntrospector**: locale fallback chain detection, locale coverage % per locale
+  - **ConfigIntrospector**: cache store options, error monitoring gem detection, job processor config (Sidekiq queues/concurrency)
+  - **ActiveStorageIntrospector**: attachment validations (content_type/size), variant definitions
+  - **ActionTextIntrospector**: Trix editor customization detection (toolbar/attachment/events)
+  - **AuthIntrospector**: OmniAuth provider detection, Devise settings (timeout/lockout/password_length)
+  - **ApiIntrospector**: GraphQL resolvers/subscriptions/dataloaders, API pagination strategy detection
+  - **TestIntrospector**: shared examples/contexts detection, database cleaner strategy
+  - **RakeTaskIntrospector**: task dependencies (`=> :prerequisite`), task arguments (`[:arg1, :arg2]`)
+  - **AssetPipelineIntrospector**: Bun bundler, Foundation CSS, PostCSS standalone detection
+  - **DevOpsIntrospector**: Fly.io/Render/Railway deployment detection, `docker-compose.yaml` support
+  - **ActionMailboxIntrospector**: mailbox callback detection (before/after/around_processing)
+  - **MigrationIntrospector**: `change_column_default`, `change_column_null`, `add_check_constraint` action detection
+  - **SeedsIntrospector**: CSV loader detection, seed ordering detection
+  - **MiddlewareIntrospector**: middleware added via initializers (`config.middleware.use/insert_before`)
+  - **EngineIntrospector**: route count + model count inside discovered engines
+  - **MultiDatabaseIntrospector**: shard names/keys/count from `connects_to`, improved YAML parsing for nested multi-db configs
+  - **ComponentIntrospector**: `**kwargs` splat prop detection
+  - **AccessibilityIntrospector**: heading hierarchy (h1-h6), skip link detection, `aria-live` regions, form input analysis (required/types)
+  - **PerformanceIntrospector**: polymorphic association compound index detection (`[type, id]`)
+  - **FrontendFrameworkIntrospector**: API client detection (Axios/Apollo/SWR/etc.), component library detection (MUI/Radix/shadcn/etc.)
+  - **DatabaseStatsIntrospector**: MySQL + SQLite support (was PostgreSQL-only), PostgreSQL dead row counts
+  - **ViewTemplateIntrospector**: slot reference detection
+  - **DesignTokenIntrospector**: Tailwind arbitrary value extraction
+
+### Fixed
+- **Security: SQLite SQL injection** — `database_stats_introspector` used string interpolation for table names in COUNT queries; now uses `conn.quote_table_name`
+- **Security: query column redaction bypass** — `SELECT password AS pwd` bypassed redaction; now also matches columns ending in `password`, `secret`, `token`, `key`, `digest`, `hash`
+- **Security: log redaction gaps** — added AWS access key (`AKIA...`), JWT token (`eyJ...`), and SSH/TLS private key header patterns
+- **Security: HTTP bind wildcard** — non-loopback warning now catches `0.0.0.0` and `::` (was only checking 3 specific addresses)
+- **Thread safety: `app_size()` race condition** — `SHARED_CACHE[:context]` read without mutex; now wrapped in `SHARED_CACHE[:mutex].synchronize`
+- **Crash: nil callback filter** — `model_introspector` `cb.filter.to_s` crashed on nil filters; added `cb.filter.nil?` guard
+- **Crash: fingerprinter TOCTOU** — `File.mtime` after `File.exist?` could raise `Errno::ENOENT` if file deleted between calls; added rescue
+- **Crash: tool_runner bounds** — `args[i+1]` access without bounds check; added `i + 1 < args.size` guard
+- **Bug: server logs wrong tool list** — logged all 39 `TOOLS` instead of filtered `active_tools` after `skip_tools`; now shows correct count and names
+- **Bug: STI false positive** — convention detector flagged `Admin < User` as STI even without `type` column; now verifies parent's table has `type` column via schema.rb
+- **Bug: resources bare raise** — `raise "Unknown resource"` changed to `raise RailsAiContext::Error`
+- **Config validation** — `http_port` (1-65535), `cache_ttl` (> 0), `max_tool_response_chars` (> 0), `query_row_limit` (1-1000) now validated on assignment
+
+### Changed
+- Test count: 1529 (unchanged — all new features tested via integration test against sample app)
+
+## [4.3.3] — 2026-04-02
+
+### Fixed
+- **100 bare rescue statements across 46 files** — all replaced with `rescue => e` + conditional debug logging (`$stderr.puts ... if ENV["DEBUG"]`); errors are now visible instead of silently swallowed
+- **database_stats introspector orphaned** — `DatabaseStatsIntrospector` was unreachable (not in any preset); added to `:full` preset (32 → 33 introspectors)
+- **CHANGELOG date errors** — v4.0.0 corrected from 2026-03-26 to 2026-03-27, v4.2.0 from 2026-03-26 to 2026-03-30 (verified against git commit timestamps)
+- **CHANGELOG missing v3.0.1 entry** — added (RubyGems republish, no code changes)
+- **CHANGELOG date separator inconsistency** — normalized all 61 version entries to em dash (`—`)
+- **Documentation preset counts** — CLAUDE.md, README, GUIDE all corrected: `:full` 32→33, `:standard` 14→19 (turbo, auth, accessibility, performance, i18n were added in v4.3.1 but docs not updated)
+- **GUIDE.md standard preset table** — added 5 missing introspectors (turbo, auth, accessibility, performance, i18n) to match `configuration.rb`
+
+### Changed
+- Full preset: 32 → 33 introspectors (added :database_stats)
+
 ## [4.3.2] — 2026-04-02
 
 ### Fixed
@@ -113,7 +182,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 - Test count: 983 → 998
 
-## [4.2.0] — 2026-03-26
+## [4.2.0] — 2026-03-30
 
 ### Added
 - New `rails_search_docs` tool: bundled topic index with weighted keyword search, on-demand GitHub fetch for Rails documentation
@@ -169,7 +238,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Test count: 817 → 893
 - Install generator always writes `config.ai_tools` and `config.tool_mode` uncommented for re-install detection
 
-## [4.0.0] — 2026-03-26
+## [4.0.0] — 2026-03-27
 
 ### Added
 
@@ -207,7 +276,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Test count: 681 → 806 examples
 - Combustion test app expanded with Stimulus controllers, ViewComponents, accessible views, factories
 
-## [3.1.0] - 2026-03-26
+## [3.1.0] — 2026-03-26
 
 ### Fixed
 
@@ -223,7 +292,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **File path suggestions in validate** — `files=["cook.rb"]` now suggests `app/models/cook.rb` when the file isn't found at the given path.
 - **Empty parameter validation** — `edit_context` now returns friendly messages for empty `file` or `near` parameters instead of hard errors.
 
-## [3.0.0] - 2026-03-26
+## [3.0.1] — 2026-03-26
+
+### Changed
+- Patch for RubyGems publish — no code changes from v3.0.0.
+
+## [3.0.0] — 2026-03-26
 
 ### Removed
 
@@ -250,14 +324,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - All CLI examples use zsh-safe quoting: `rails 'ai:tool[X]'` (brackets are glob patterns in zsh).
 - README rewritten with real-world workflow examples, categorized tool table, MCP vs CLI showcase.
 
-## [2.0.5] - 2026-03-25
+## [2.0.5] — 2026-03-25
 
 ### Changed
 
 - **Task-based MCP tool instructions** — all 6 serializers (Claude, Cursor, Copilot, Windsurf, OpenCode) rewritten from tool-first to task-first: "What are you trying to do?" → exact tool call. 7 task categories: understand a feature, trace a method, add a field, fix a controller, build a view, write tests, find code. Every AI agent now understands which tool to use for any task.
 - **Concern detail:"full" bug fix** — `\b` after `?`/`!` prevented 13 of 15 method bodies from being extracted. All methods now show source code.
 
-## [2.0.4] - 2026-03-25
+## [2.0.4] — 2026-03-25
 
 ### Added
 
@@ -268,14 +342,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **analyze_feature: service test gaps** — checks services for missing test files, not just models/controllers/jobs.
 - **All 6 serializers updated** — Claude, Cursor, Copilot, Windsurf, OpenCode all document trace mode, concern source, orphaned tables, inherited filters.
 
-## [2.0.3] - 2026-03-25
+## [2.0.3] — 2026-03-25
 
 ### Added
 
 - **Trace mode 100%** — `match_type:"trace"` now shows 7 sections: definition with class/module context, source code, internal calls, sibling methods (same file), app callers with route chain hints, and test coverage (separated from app code). Zero follow-up calls needed.
 - **README rewrite** — neuro marketing techniques: loss aversion hook, measured token savings table, trace output inline, architecture diagram. 456→261 lines.
 
-## [2.0.2] - 2026-03-25
+## [2.0.2] — 2026-03-25
 
 ### Added
 
@@ -293,7 +367,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Documentation audit** — fixed max_tool_response_chars reference (120K→200K), added missing search_code params to GUIDE, added config.ai_tools to config reference.
 
-## [2.0.1] - 2026-03-25
+## [2.0.1] — 2026-03-25
 
 ### Fixed
 
@@ -304,7 +378,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Issue #14** — `multi_db[:databases].keys` crash on Array fixed.
 - **Search code NON_CODE_GLOBS** — excludes lock files, docs, CI configs, generated context from all searches.
 
-## [2.0.0] - 2026-03-24
+## [2.0.0] — 2026-03-24
 
 ### Added
 
@@ -349,14 +423,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **JS fallback validator false-positives** — escaped backslashes before string-closing quotes (`"path\\"`) no longer cause false bracket mismatch errors. Replaced `prev_char` check with proper `escaped` toggle flag.
 
-## [1.3.1] - 2026-03-23
+## [1.3.1] — 2026-03-23
 
 ### Fixed
 
 - **Documentation audit** — updated tool count from 14 to 15 across README, GUIDE, CONTRIBUTING, server.json. Added `rails_get_design_system` documentation section to GUIDE.md. Updated SECURITY.md supported versions. Fixed spec count in CLAUDE.md. Added `rails_get_design_system` to README tool table. Updated `rails_analyze_feature` description to reflect full-stack discovery (services, jobs, views, Stimulus, tests, related models, env deps).
 - **analyze_feature crash on complex models** — added type guards (`is_a?(Hash)`, `is_a?(Array)`) to all data access points preventing `no implicit conversion of Symbol into Integer` errors on models with many associations or complex data.
 
-## [1.3.0] - 2026-03-23
+## [1.3.0] — 2026-03-23
 
 ### Added
 
@@ -378,7 +452,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Rules serializer methods cap raised to 20** (RS1) — uses introspector's pre-filtered methods directly instead of redundant re-filtering
 - **oklch token noise filtered** (DS21) — complex color values (oklch, calc, var) hidden from summary, only shown in `detail:"full"`
 
-## [1.2.1] - 2026-03-23
+## [1.2.1] — 2026-03-23
 
 ### Fixed
 
@@ -392,7 +466,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Column defaults shown in generated rules** — columns with non-nil defaults now show `(=value)` inline.
 - **`analyze_feature` matches models by table name and underscore form** — `feature:"share"` now finds `CookShare` (via `cook_shares` table and `cook_share` underscore form), not just exact model name substring.
 
-## [1.2.0] - 2026-03-23
+## [1.2.0] — 2026-03-23
 
 ### Added
 
@@ -406,7 +480,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **"UI Patterns" section renamed to "Design System"** — richer content with color palette, typography, components, spacing conventions, interactive states, and design rules.
 - **Design tokens consumed for the first time** — `context[:design_tokens]` data was previously extracted but never rendered. Now merged into design system output in all serializers and the new MCP tool.
 
-## [1.1.1] - 2026-03-23
+## [1.1.1] — 2026-03-23
 
 ### Added
 
@@ -417,13 +491,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Tool count corrected from 13 to 14** across all serializers to reflect `rails_analyze_feature` added in v1.0.0.
 
-## [1.1.0] - 2026-03-23
+## [1.1.0] — 2026-03-23
 
 ### Changed
 
 - **Default preset changed to `:full`** — all 28 introspectors now run by default, giving AI assistants richer context out of the box. Introspectors that don't find relevant data return empty hashes with zero overhead. Use `config.preset = :standard` for the previous 13-core default.
 
-## [1.0.0] - 2026-03-23
+## [1.0.0] — 2026-03-23
 
 ### Added
 
@@ -436,25 +510,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **LLM-optimized tool descriptions (all 14 tools)** — every description now follows "what it does / Use when: / key params" format so AI agents pick the right tool on first try.
 
-## [0.15.10] - 2026-03-23
+## [0.15.10] — 2026-03-23
 
 ### Changed
 
 - **Gemspec description rewritten** — repositioned from feature list to value proposition: mental model, semantic validation, cross-file error detection.
 
-## [0.15.9] - 2026-03-23
+## [0.15.9] — 2026-03-23
 
 ### Added
 
 - **Deep diagnostic checks in `rails ai:doctor`** — upgraded from 13 shallow file-existence checks to 20 deep checks: pending migrations, context file freshness, .mcp.json validation, introspector health (dry-runs each one), preset coverage (detects features not in preset), .env/.master.key gitignore check, auto_mount production warning, schema/view size vs limits.
 
-## [0.15.8] - 2026-03-23
+## [0.15.8] — 2026-03-23
 
 ### Added
 
 - **Semantic validation (`level:"rails"`)** — `rails_validate` now supports `level:"rails"` for deep semantic checks beyond syntax: partial existence, route helper validity, column references vs schema, strong params vs schema columns, callback method existence, route-action consistency, `has_many` dependent options, missing FK indexes, and Stimulus controller file existence.
 
-## [0.15.7] - 2026-03-22
+## [0.15.7] — 2026-03-22
 
 ### Improved
 
@@ -466,7 +540,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Concern test lookup** — `rails_get_test_info(model:"PlanLimitable")` searches concern test paths.
 - **Controller flexible matching** — underscore-based normalization handles CamelCase, snake_case, and slash notation consistently.
 
-## [0.15.6] - 2026-03-22
+## [0.15.6] — 2026-03-22
 
 ### Added
 
@@ -482,7 +556,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Concern methods inline** — shows public methods from concern source files (e.g. `PlanLimitable — can_cook?, increment_cook_count!`).
 - **MCP tool error messages** — all tools now show available values on error/not-found for AI self-correction.
 
-## [0.15.5] - 2026-03-22
+## [0.15.5] — 2026-03-22
 
 ### Fixed
 
@@ -495,7 +569,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Namespace test lookup** — supports `bonus/crises` format and flat test directories.
 - **Empty inputs** — `near:""` in edit_context and `pattern:""` in search return helpful errors.
 
-## [0.15.4] - 2026-03-22
+## [0.15.4] — 2026-03-22
 
 ### Fixed
 
@@ -512,7 +586,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Pagination on models, controllers, stimulus** — `limit`/`offset` params (default 50) with "end of results" hints. Prevents token bombs on large apps.
 
-## [0.15.3] - 2026-03-22
+## [0.15.3] — 2026-03-22
 
 ### Fixed
 
@@ -523,20 +597,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Documentation** — updated all docs (README, CLAUDE.md, GUIDE.md, SECURITY.md, CHANGELOG, server.json, install generator) to match v0.15.x codebase. Fixed spec counts, file counts, preset counts, config options, and supported versions.
 
-## [0.15.2] - 2026-03-22
+## [0.15.2] — 2026-03-22
 
 ### Fixed
 
 - **Test command detection** — Serializers now use detected test framework (minitest → `rails test`, rspec → `bundle exec rspec`) instead of hardcoding `bundle exec rspec`. Default is `rails test` (the Rails default). Contributed by @curi (PR #13).
 
-## [0.15.1] - 2026-03-22
+## [0.15.1] — 2026-03-22
 
 ### Fixed
 
 - **Copilot serializer** — Show all model associations (not capped at 3), use human-readable architecture/pattern labels.
 - **OpenCode rules serializer** — Filter framework controllers (Devise) from AGENTS.md output, show all associations, match `before_action` with `!`/`?` suffixes.
 
-## [0.15.0] - 2026-03-22
+## [0.15.0] — 2026-03-22
 
 ### Security
 
@@ -577,7 +651,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Strong params body** — Action detail now shows the actual `permit(...)` call.
 - **AR-generated methods** — Filter `build_*`, `*_ids=`, etc. from model instance methods.
 
-## [0.14.0] - 2026-03-20
+## [0.14.0] — 2026-03-20
 
 ### Fixed
 
@@ -595,7 +669,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Stimulus dash/underscore normalization** — Both `weekly-chart` and `weekly_chart` work for controller lookup. Output shows HTML `data-controller` attribute.
 - **Model public method signatures** — `rails_get_model_details(model: "Cook")` shows method names with params from source, stopping at private boundary.
 
-## [0.13.1] - 2026-03-20
+## [0.13.1] — 2026-03-20
 
 ### Changed
 
@@ -603,7 +677,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Model details** — shows method signatures (name + parameters) instead of just method names.
 - Removed unused demo files; fixed GUIDE.md preset tables.
 
-## [0.13.0] - 2026-03-20
+## [0.13.0] — 2026-03-20
 
 ### Added
 
@@ -624,7 +698,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - ERB validation was broken due to shell quoting bug (backticks + nested quotes). Replaced with `Open3.capture2e("ruby", "-e", script, ARGV[0])`.
 - Rubocop offenses in validate.rb (18 spacing issues auto-corrected).
 
-## [0.12.0] - 2026-03-20
+## [0.12.0] — 2026-03-20
 
 ### Added
 
@@ -657,7 +731,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Progress bars misclassified as badges.
 - Input detection picking up alert divs instead of actual inputs.
 
-## [0.11.0] - 2026-03-20
+## [0.11.0] — 2026-03-20
 
 ### Added
 
@@ -665,20 +739,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **View partial structure** — `rails_get_view(detail: "standard")` shows model fields and helper methods used by each partial.
 - **Schema column names** — `.claude/rules/rails-schema.md` shows key column names with types, foreign keys, indexes, and enum values. Keeps polymorphic `_type`, STI `type`, and soft-delete `deleted_at` columns.
 
-## [0.10.2] - 2026-03-20
+## [0.10.2] — 2026-03-20
 
 ### Security
 
 - **ReDoS protection** — added regex timeout and converted greedy quantifiers to non-greedy across all pattern matching.
 - **File size limits** — added size caps on parsed files to prevent memory exhaustion from oversized inputs.
 
-## [0.10.1] - 2026-03-19
+## [0.10.1] — 2026-03-19
 
 ### Changed
 
 - Patch release for RubyGems republish (no code changes).
 
-## [0.10.0] - 2026-03-19
+## [0.10.0] — 2026-03-19
 
 ### Added
 
@@ -689,7 +763,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **ViewTemplateIntrospector** — new introspector that reads view file contents and extracts partial references and Stimulus data attributes.
 - **Stimulus and view_templates in standard preset** — both introspectors now in `:standard` preset (11 introspectors, was 10).
 
-## [0.9.0] - 2026-03-19
+## [0.9.0] — 2026-03-19
 
 ### Added
 
@@ -702,7 +776,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Removed `.cursorrules` root file** — Cursor officially deprecated `.cursorrules` in favor of `.cursor/rules/`. The `:cursor` format now generates only `.cursor/rules/*.mdc` split rules. The `rails-project.mdc` split rule (with `alwaysApply: true`) already provides the project overview.
 - **License changed from AGPL-3.0 to MIT** — removes the copyleft blocker for SaaS and commercial projects.
 
-## [0.8.5] - 2026-03-19
+## [0.8.5] — 2026-03-19
 
 ### Fixed
 
@@ -715,27 +789,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Standalone CLI documented** — the `rails-ai-context` executable (serve, context, inspect, watch, doctor, version) is now documented in README, GUIDE, and CLAUDE.md.
 
-## [0.8.4] - 2026-03-19
+## [0.8.4] — 2026-03-19
 
 ### Added
 
 - **`structure.sql` support** — the schema introspector now parses `db/structure.sql` when no `db/schema.rb` exists and no database connection is available. Extracts tables, columns (with SQL type normalization), indexes, and foreign keys from PostgreSQL dump format. Prefers `schema.rb` when both exist.
 - **Fingerprinter watches `db/structure.sql`** — file changes to `structure.sql` now trigger cache invalidation and live reload.
 
-## [0.8.3] - 2026-03-19
+## [0.8.3] — 2026-03-19
 
 ### Changed
 
 - **License published to RubyGems** — v0.8.2 changed the license from MIT to AGPL-3.0 but the gem was not republished. This release ensures the AGPL-3.0 license is reflected on RubyGems.
 
-## [0.8.2] - 2026-03-19
+## [0.8.2] — 2026-03-19
 
 ### Changed
 
 - **License** — changed from MIT to AGPL-3.0 to protect against unauthorized clones and ensure derivative works remain open source.
 - **CI: auto-publish to MCP Registry** — the release workflow now automatically publishes to the MCP Registry via `mcp-publisher` with GitHub OIDC auth. No manual `mcp-publisher login` + `publish` needed.
 
-## [0.8.1] - 2026-03-19
+## [0.8.1] — 2026-03-19
 
 ### Added
 
@@ -746,14 +820,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Live reload LoadError in HTTP mode** — when `live_reload = true` and the `listen` gem was missing, the `start_http` method's rescue block (for rackup fallback) swallowed the live reload error, producing a confusing rack error instead of the correct "listen gem required" message. The rescue is now scoped to the rackup require only.
 - **Dangling @live_reload reference** — `@live_reload` was assigned before `start` was called. If `start` raised LoadError, the instance variable pointed to a non-functional object. Now only assigned after successful start.
 
-## [0.8.0] - 2026-03-19
+## [0.8.0] — 2026-03-19
 
 ### Added
 
 - **MCP Live Reload** — when running `rails ai:serve`, file changes automatically invalidate tool caches and send MCP notifications (`notifications/resources/list_changed`) to connected AI clients. The AI's context stays fresh without manual re-querying. Requires the `listen` gem (enabled by default when available). Configurable via `config.live_reload` (`:auto`, `true`, `false`) and `config.live_reload_debounce` (default: 1.5s).
 - **Live reload doctor check** — `rails ai:doctor` now warns when the `listen` gem is not installed.
 
-## [0.7.1] - 2026-03-19
+## [0.7.1] — 2026-03-19
 
 ### Added
 
@@ -765,7 +839,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Schema version parsing** — versions with underscores (e.g. `2024_01_15_123456`) were truncated to the first digit group. Now captures the full version string.
 - **Documentation** — updated README (detail levels, pagination, generated file tree, config options), SECURITY.md (supported versions), CONTRIBUTING.md (project structure), gemspec (post-install message), demo_script.sh (all 17 generated files).
 
-## [0.7.0] - 2026-03-19
+## [0.7.0] — 2026-03-19
 
 ### Added
 
@@ -788,7 +862,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - All tools return pagination hints when results are truncated.
 - `.windsurfrules` now uses dedicated `WindsurfSerializer` instead of sharing `RulesSerializer` with Cursor.
 
-## [0.6.0] - 2026-03-18
+## [0.6.0] — 2026-03-18
 
 ### Added
 
@@ -809,7 +883,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Doctor checks expanded from 11 to 12
 - Static MCP resources expanded from 7 to 9
 
-## [0.5.2] - 2026-03-18
+## [0.5.2] — 2026-03-18
 
 ### Fixed
 
@@ -817,14 +891,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Zeitwerk dependency** — Changed from open-ended `>= 2.6` to pessimistic `~> 2.6` per RubyGems best practices
 - **Documentation** — Updated CONTRIBUTING.md, CHANGELOG.md, and CLAUDE.md to reflect Zeitwerk autoloading, introspector presets, and `.mcp.json` auto-discovery changes
 
-## [0.5.1] - 2026-03-18
+## [0.5.1] — 2026-03-18
 
 ### Fixed
 
 - Documentation updates and animated demo GIF added to README.
 - Zeitwerk autoloading fixes for edge cases.
 
-## [0.5.0] - 2026-03-18
+## [0.5.0] — 2026-03-18
 
 ### Added
 
@@ -845,7 +919,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Default introspectors reduced from 21 to 8 (`:standard` preset) for faster boot; use `config.preset = :full` for all 21
 - New files auto-loaded by Zeitwerk — no manual `require_relative` needed when adding introspectors or tools
 
-## [0.4.0] - 2026-03-18
+## [0.4.0] — 2026-03-18
 
 ### Added
 
@@ -882,7 +956,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Doctor checks expanded from 7 to 11
 - Test suite expanded from 149 to 247 examples with exact value assertions
 
-## [0.3.0] - 2026-03-18
+## [0.3.0] — 2026-03-18
 
 ### Added
 
@@ -907,7 +981,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `generate_context` now returns `{ written: [], skipped: [] }` instead of flat array
 - Default introspectors now include `:stimulus`
 
-## [0.2.0] - 2026-03-18
+## [0.2.0] — 2026-03-18
 
 ### Added
 
@@ -921,7 +995,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `rails ai:context_for[claude]` failing in zsh due to bracket glob interpretation
 - Double introspection in `ai:context` and `ai:context_for` tasks (removed unused `RailsAiContext.introspect` calls)
 
-## [0.1.0] - 2026-03-18
+## [0.1.0] — 2026-03-18
 
 ### Added
 

data/CLAUDE.md

@@ -34,7 +34,7 @@ structure to AI assistants via the Model Context Protocol (MCP).
 7. **Diff-aware** — context regeneration skips unchanged files
 8. **Per-assistant serializers** — each AI tool gets tailored output format
 9. **Zeitwerk autoloading** — files loaded on-demand, not all upfront
-10. **Introspector presets** — `:full` (32) default, `:standard` (14 core) for lightweight usage
+10. **Introspector presets** — `:full` (33) default, `:standard` (19) for lightweight usage
 11. **MCP auto-discovery** — `.mcp.json` generated by install generator
 12. **Compact by default** — context files ≤150 lines, MCP tools use `detail` parameter (summary/standard/full)
 13. **Per-tool split rules** — `.claude/rules/`, `.cursor/rules/`, `.github/instructions/`
@@ -56,6 +56,8 @@ structure to AI assistants via the Model Context Protocol (MCP).
 29. **Docs search** — bundled topic index with weighted keyword search, on-demand GitHub fetch
 30. **Safe SQL queries** — defense-in-depth: regex pre-filter + SET TRANSACTION READ ONLY + timeout
 31. **Log reading** — reverse file tail with level filtering and sensitive data redaction
+32. **Config validation** — `http_port`, `cache_ttl`, `max_tool_response_chars`, `query_row_limit` validated on assignment with clear error messages
+33. **Sensitive column redaction** — query tool redacts columns by name AND by suffix pattern (password, secret, token, key, digest, hash) to prevent alias bypass
 
 ## Testing