rails-ai-context 5.32.1 → 5.32.2

data/lib/rails_ai_context/install/cleanup.rb

@@ -11,49 +11,95 @@ module RailsAiContext
     module Cleanup
       module_function
 
+      # The block SectionMarkerWriter manages inside a root context file.
+      BEGIN_MARKER = "<!-- BEGIN rails-ai-context -->"
+      MANAGED_BLOCK = /#{BEGIN_MARKER}.*?<!-- END rails-ai-context -->(?:\r?\n)?/m
+
+      # The line a split rules file generated whole carries.
+      GENERATED_NOTE = "Auto-generated by rails-ai-context. Do not edit manually."
+      GENERATED_LINE = /^> #{Regexp.escape(GENERATED_NOTE)}\r?$/
+
+      # Removes what this gem generated and nothing the user wrote: the named
+      # rule files inside a rules directory, the managed block inside a root
+      # file, and a file generated whole.
+      #
       # @param tools [Array<Symbol>] the AI tools being dropped
       # @param keeping [Array<Symbol>] the tools still selected, whose files
       #   must survive even when a dropped tool names the same path
       # @param root [String, Pathname] project root
-      # @return [Hash] { removed: [paths], failed: [paths] }, directories
-      #   marked with a trailing slash so callers can print them the way they
-      #   always have. Both rm calls swallow their errors, so a path is only
+      # @return [Hash] { removed: [paths], trimmed: [paths], kept: [paths], failed: [paths] }.
+      #   A directory carries a trailing slash. `trimmed` files lost their
+      #   managed block and kept the user's lines; `kept` files hold nothing
+      #   this gem generated. rm swallows its errors, so a path is only
       #   reported removed once it is gone.
       def remove(tools:, keeping:, root:)
         kept = Array(keeping).flat_map { |key| AiTool.find(key)&.context_paths || [] }.to_set
-        removed = []
-        failed = []
+        outcome = { removed: [], trimmed: [], kept: [], failed: [] }
 
         Array(tools).each do |key|
-          paths = AiTool.find(key)&.context_paths || []
-          paths.each do |relative|
+          tool = AiTool.find(key) or next
+          tool.context_paths.each do |relative|
             next if kept.include?(relative)
 
-            label, gone = remove_path(relative, root)
-            next unless label
-
-            (gone ? removed : failed) << label
+            if File.directory?(File.join(root.to_s, relative))
+              remove_rule_files(tool, relative, root, outcome)
+            else
+              remove_generated(relative, root, outcome)
+            end
           end
         end
 
-        { removed: removed, failed: failed }
+        outcome
       end
 
-      # @return [Array(String, Boolean), nil] the path's label and whether it
-      #   is gone, or nil when there was nothing there to remove. A directory
-      #   whose children went but which itself survives counts as not gone.
-      def remove_path(relative, root)
+      # A symlink is somebody's own arrangement, and writing through one edits
+      # a file this run was not asked about.
+      def remove_rule_files(tool, dir, root, outcome)
+        full = File.join(root.to_s, dir)
+        return if File.symlink?(full)
+
+        names = Array(tool.rule_files) + tool.legacy_paths.select { |path| File.dirname(path) == dir }.map { |path| File.basename(path) }
+        names.each { |name| delete(File.join(dir, name), root, outcome) }
+        return unless Dir.empty?(full)
+
+        Dir.rmdir(full)
+        outcome[:removed] << "#{dir}/"
+      rescue SystemCallError
+        outcome[:failed] << "#{dir}/"
+      end
+      private_class_method :remove_rule_files
+
+      # Bytes in, bytes out: the markers are ASCII, and the user's lines may not be valid UTF-8.
+      def remove_generated(relative, root, outcome)
         full = File.join(root.to_s, relative)
+        return unless File.file?(full) || File.symlink?(full)
+        return outcome[:kept] << relative if File.symlink?(full)
 
-        if File.directory?(full)
-          FileUtils.rm_rf(full)
-          [ "#{relative}/", !File.exist?(full) ]
-        elsif File.exist?(full)
-          FileUtils.rm_f(full)
-          [ relative, !File.exist?(full) ]
+        content = File.binread(full)
+        rest = content.gsub(MANAGED_BLOCK, "")
+        # The writer puts one blank line under a block it prepends to a file that was already there.
+        rest = rest.sub(/\A\r?\n/, "") if content.start_with?(BEGIN_MARKER)
+        if rest == content
+          content.match?(GENERATED_LINE) ? delete(relative, root, outcome) : outcome[:kept] << relative
+        elsif rest.strip.empty?
+          delete(relative, root, outcome)
+        else
+          File.binwrite(full, rest)
+          outcome[:trimmed] << relative
         end
+      rescue SystemCallError
+        outcome[:failed] << relative
+      end
+      private_class_method :remove_generated
+
+      def delete(relative, root, outcome)
+        full = File.join(root.to_s, relative)
+        return unless File.file?(full) && !File.symlink?(full)
+
+        FileUtils.rm_f(full)
+        (File.exist?(full) ? outcome[:failed] : outcome[:removed]) << relative
       end
-      private_class_method :remove_path
+      private_class_method :delete
     end
   end
 end

data/lib/rails_ai_context/install/program.rb

@@ -113,13 +113,16 @@ module RailsAiContext
 
           outcome = Cleanup.remove(tools: [ key ], keeping: selected.map(&:to_sym), root: root)
           outcome[:removed].each { |path| surface.say "  Removed #{path}", :ok }
+          outcome[:trimmed].each { |path| surface.say "  Removed the generated section from #{path}", :ok }
+          outcome[:kept].each { |path| surface.say "  Kept #{path} (nothing in it was generated by rails-ai-context)", :muted }
           outcome[:failed].each { |path| surface.say "Could not remove #{path} - check its permissions", :warn }
 
           # Merge-safe MCP config cleanup - removes only the rails-ai-context entry
           cleaned = RailsAiContext::McpConfigGenerator.remove(tools: [ key ], output_dir: root.to_s)
           cleaned.each { |f| surface.say "  Removed MCP entry from #{relative_to(f, root)}", :ok }
 
-          surface.say "  #{tool.name} files removed", :ok if tool && outcome[:failed].empty?
+          gone = outcome[:removed].any? || outcome[:trimmed].any? || cleaned.any?
+          surface.say "  #{tool.name} files removed", :ok if tool && gone && outcome[:failed].empty?
         end
       end
 

data/lib/rails_ai_context/install/selection_record.rb

@@ -74,7 +74,7 @@ module RailsAiContext
         recorded.nil? ? nil : !!recorded
       end
 
-      # @return [Symbol] :updated, :inserted, :unchanged or :absent
+      # @return [Symbol] :updated, :inserted, :unchanged, :conflict or :absent
       def write_context_files(value, root:)
         write_config_line(root, "  config.context_files = #{value ? 'true' : 'false'}",
                           CONTEXT_FILES_LINE, /^[ \t]*config\.context_files\s*=.*$/)
@@ -83,7 +83,7 @@ module RailsAiContext
       # Only an uncommented line is rewritten - the generated initializer ships
       # a commented-out default that must stay a comment.
       #
-      # @return [Symbol] :updated, :inserted, :unchanged or :absent
+      # @return [Symbol] :updated, :inserted, :unchanged, :conflict or :absent
       def write_tool_mode(mode, root:)
         write_config_line(root, "  config.tool_mode = :#{mode}",
                           MODE_LINE, /^[ \t]*config\.tool_mode\s*=.*$/)
@@ -134,6 +134,20 @@ module RailsAiContext
         write((read(root: root) || []) | addition, root: root)
       end
 
+      # What to say when a single-value key came back :conflict, nil otherwise.
+      def conflict_message(key, status)
+        return unless status == :conflict
+
+        [ :warn, "#{INITIALIZER} sets config.#{key} in a form this installer does not " \
+                 "rewrite, and it takes precedence - edit it by hand to change it" ]
+      end
+
+      # Whether the app has settled its tool mode, in the record or in an
+      # initializer line of any shape, so no entry asks again.
+      def tool_mode_set?(root:)
+        !tool_mode(root: root).nil? || initializer_content(root).to_s.match?(/^[ \t]*config\.tool_mode\s*=/)
+      end
+
       def initializer_line(tools)
         "  config.ai_tools = %i[#{normalize(tools).join(' ')}]"
       end
@@ -196,6 +210,10 @@ module RailsAiContext
 
           File.write(path, updated)
           :updated
+        elsif content.match?(assignment)
+          # Assigned in a shape this module will not rewrite. A second line
+          # beside it would lose at boot and win on read.
+          :conflict
         elsif content.match?(SELECTION_LINE)
           File.write(path, content.sub(/^([ \t]*config\.ai_tools\s*=[^\n]*)$/) { "#{Regexp.last_match(1)}\n#{line}" })
           :inserted

data/lib/rails_ai_context/serializers/opencode_rules_serializer.rb

@@ -45,7 +45,7 @@ module RailsAiContext
         lines = [
           "# ActiveRecord Models (#{models.size})",
           "",
-          "> Auto-generated by rails-ai-context. Do not edit manually.",
+          "> #{Install::Cleanup::GENERATED_NOTE}",
           "> Check here first for scopes, constants, associations. Read model files for business logic/methods.",
           ""
         ]
@@ -87,7 +87,7 @@ module RailsAiContext
         lines = [
           "# Controllers (#{app_controllers.size})",
           "",
-          "> Auto-generated by rails-ai-context. Do not edit manually.",
+          "> #{Install::Cleanup::GENERATED_NOTE}",
           "> Read controller files directly when editing. Use MCP tools for reference only.",
           ""
         ]

data/lib/rails_ai_context/server.rb

@@ -274,7 +274,7 @@ module RailsAiContext
     end
 
     # Conditionally start live reload based on configuration.
-    # :auto  - try to load `listen`, skip silently with a tip if missing
+    # :auto  - try to load `listen`, print a tip to stderr if missing
     # true   - try to load `listen`, raise if missing
     # false  - skip entirely
     def maybe_start_live_reload(mcp_server)
@@ -291,7 +291,7 @@ module RailsAiContext
           raise LoadError, "Live reload requires the `listen` gem. Add to your Gemfile: gem 'listen', group: :development"
         end
 
-        # :auto mode - skip silently with a tip
+        # :auto mode - skip with a tip
         $stderr.puts "[rails-ai-context] Live reload unavailable (add `listen` gem for auto-refresh)"
       end
     end

data/lib/rails_ai_context/tasks/rails_ai_context.rake

@@ -77,14 +77,19 @@ def prompt_setup
   RailsAiContext::Install::Program.select_setup(install_surface)
 end unless defined?(prompt_setup)
 
+def say_conflict(key, status)
+  _level, text = RailsAiContext::Install::SelectionRecord.conflict_message(key, status)
+  puts "⚠️  #{text}" if text
+end unless defined?(say_conflict)
+
 def save_tool_mode_to_initializer(mode)
-  RailsAiContext::Install::SelectionRecord.write_tool_mode(mode, root: Rails.root)
+  say_conflict(:tool_mode, RailsAiContext::Install::SelectionRecord.write_tool_mode(mode, root: Rails.root))
 rescue => e
   RailsAiContext.debug_fail(e, nil, label: "save_tool_mode_to_initializer")
 end unless defined?(save_tool_mode_to_initializer)
 
 def save_context_files_to_initializer(value)
-  RailsAiContext::Install::SelectionRecord.write_context_files(value, root: Rails.root)
+  say_conflict(:context_files, RailsAiContext::Install::SelectionRecord.write_context_files(value, root: Rails.root))
 rescue => e
   RailsAiContext.debug_fail(e, nil, label: "save_context_files_to_initializer")
 end unless defined?(save_context_files_to_initializer)
@@ -100,7 +105,7 @@ rescue => e
 end unless defined?(ensure_mcp_configs)
 
 def tool_mode_configured?
-  !RailsAiContext::Install::SelectionRecord.tool_mode(root: Rails.root).nil?
+  RailsAiContext::Install::SelectionRecord.tool_mode_set?(root: Rails.root)
 rescue => e
   RailsAiContext.debug_fail(e, false, label: "tool_mode_configured?")
 end unless defined?(tool_mode_configured?)
@@ -295,7 +300,10 @@ namespace :ai do
   end
 
   namespace :context do
-    per_tool = RailsAiContext::Install::AiTool.all.to_h { |tool| [ tool.key, tool.files ] }
+    # The MCP config a tool's file list names is the installer's to write, not this task's.
+    per_tool = RailsAiContext::Install::AiTool.all.to_h { |tool|
+      [ tool.key, tool.files.split(" + ").reject { |file| file == tool.mcp_config[:path] }.join(" + ") ]
+    }
     per_tool.merge(json: ".ai-context.json").each do |fmt, file|
       desc "Generate #{file} context file"
       task fmt => :environment do

data/lib/rails_ai_context/test_helper.rb

@@ -4,6 +4,8 @@
 # Bundler.require never loads it in the test environment, so this file is
 # often the first (and only) entry point required from a test suite.
 require_relative "../rails_ai_context"
+# A custom tool subclasses MCP::Tool, and nothing else has loaded the SDK yet.
+require "mcp"
 
 module RailsAiContext
   # Reusable test helper for verifying MCP tools - both built-in and custom.

data/lib/rails_ai_context/tools/base_tool.rb

@@ -371,7 +371,9 @@ module RailsAiContext
         # the composers do not index into `content` themselves.
         def response_text(response)
           first = response.content.first
-          first.is_a?(Hash) ? first[:text].to_s : ""
+          text = first.is_a?(Hash) ? first[:text].to_s : ""
+          # The composing tool's own response carries the tier banner, once.
+          (banner = static_tier_banner) ? text.gsub(banner, "") : text
         end
 
         # One-line banner listing introspectors that failed during context

data/lib/rails_ai_context/tools/dependency_graph.rb

@@ -4,8 +4,8 @@ module RailsAiContext
   module Tools
     class DependencyGraph < BaseTool
       tool_name "rails_dependency_graph"
-      description "Generates a dependency graph showing how models, services, and controllers " \
-        "connect. Output as Mermaid diagram syntax or plain text. " \
+      description "Generates a dependency graph showing how models connect through their " \
+        "associations. Output as Mermaid diagram syntax or plain text. " \
         "Use when: understanding feature architecture, tracing data flow, planning refactors. " \
         "Key params: model (center graph on model), depth (1-3), format (mermaid/text)."
 

data/lib/rails_ai_context/tools/get_concern.rb

@@ -18,7 +18,7 @@ module RailsAiContext
             type: "string",
             description: "Filter by concern type, the name each section heading of the listing prints: model for app/models/concerns/, mailer for app/mailers/concerns/, and for a concern outside every concerns directory the root it lives in (service for app/services, lib for lib). other: app/concerns itself, or a configured directory. all: everything (default)."
           },
-          detail: RailsAiContext::DetailLevel.schema("Detail level. summary: concern names only. standard: names + method signatures (default). full: method signatures with source code.")
+          detail: RailsAiContext::DetailLevel.schema("Detail level, read when `name` is given. summary and standard (default): method signatures. full: method signatures with source code.")
         }
       )
 

data/lib/rails_ai_context/tools/get_env.rb

@@ -426,7 +426,7 @@ module RailsAiContext
       end
 
       private_class_method def self.scan_env_example(root)
-        # Only read .env.example or .env.sample - NEVER .env or .env.local
+        # Only the example files - NEVER .env or .env.local
         candidates = %w[.env.example .env.sample .env.template]
         vars = []
 

data/lib/rails_ai_context/tools/get_gems.rb

@@ -4,7 +4,7 @@ module RailsAiContext
   module Tools
     class GetGems < BaseTool
       tool_name "rails_get_gems"
-      description "Get notable gems from Gemfile.lock grouped by category: auth, jobs, frontend, API, database, testing, deploy. " \
+      description "Get notable gems from Gemfile.lock grouped by category (auth, jobs, frontend, API, database, testing, deploy and more). " \
         "Use when: checking what libraries are available before adding a dependency, or understanding the tech stack. " \
         "Filter with category:\"auth\" or category:\"database\". Omit for all categories."
 
@@ -12,7 +12,7 @@ module RailsAiContext
         properties: {
           category: {
             type: "string",
-            enum: %w[auth jobs frontend api database files testing deploy all],
+            enum: Introspectors::GemIntrospector::NOTABLE_GEMS.values.map { |gem| gem[:category].to_s }.uniq + %w[all],
             description: "Filter by category. Default: all."
           },
           offset: {

data/lib/rails_ai_context/tools/query.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "strscan"
+
 module RailsAiContext
   module Tools
     class Query < BaseTool
@@ -173,12 +175,17 @@ module RailsAiContext
         end
 
         # ── Layer 1: SQL validation ─────────────────────────────────
-        valid, error = validate_sql(sql)
+        mysql = mysql_dialect?
+        valid, error = validate_sql(sql, mysql: mysql)
         return error_response(error) unless valid
 
+        # Run the text the validator read, never the raw input: whatever the
+        # scanner and the database disagree on, nothing unread reaches the database.
+        sql = comment_free(sql, mysql: mysql)
+
         # ── EXPLAIN mode ────────────────────────────────────────────
         if explain
-          return execute_explain(sql.strip, config.query_timeout)
+          return execute_explain(sql, config.query_timeout)
         end
 
         # Resolve row limit
@@ -187,11 +194,11 @@ module RailsAiContext
         timeout_seconds = config.query_timeout
 
         # ── Layers 2-3: Execute with DB-level safety + row limit ────
-        result = execute_safely(sql.strip, row_limit, timeout_seconds)
+        result = execute_safely(sql, row_limit, timeout_seconds)
 
         # ── Layer 4: Redact sensitive columns ───────────────────────
         # Skip for SHOW/DESCRIBE/EXPLAIN - see SCHEMA_METADATA_PREFIX.
-        redacted = sql.strip.match?(SCHEMA_METADATA_PREFIX) ? result : redact_results(result)
+        redacted = sql.match?(SCHEMA_METADATA_PREFIX) ? result : redact_results(result)
 
         # ── Format output ───────────────────────────────────────────
         output = case format
@@ -227,36 +234,73 @@ module RailsAiContext
       end
 
       # ── SQL comment stripping ───────────────────────────────────────
-      def self.strip_sql_comments(sql)
-        sql
-          # MySQL version-conditional comments `/*! ... */` / `/*!12345 ... */`
-          # are NOT comments - MySQL executes their content. Unwrap them first
-          # so the validator sees the inner SQL (e.g. `LOAD_FILE`) instead of
-          # stripping it alongside regular block comments, which would let
-          # `SELECT /*!50000 LOAD_FILE('/etc/passwd') */` slip past
-          # BLOCKED_FUNCTIONS. PostgreSQL and SQLite treat `/*! ... */` as
-          # a normal comment, so unwrapping is MySQL-safe: the content is
-          # ignored by those engines anyway.
-          .gsub(/\/\*!\d*\s*(.*?)\*\//m) { " #{Regexp.last_match(1)} " }
-          .gsub(/\/\*.*?\*\//m, " ")   # Block comments: /* ... */
-          .gsub(/--[^\n]*/, " ")        # Line comments: -- ...
-          .gsub(/^\s*#[^\n]*/m, " ")   # MySQL-style comments: # at line start only
-          .squeeze(" ").strip
+      def self.strip_sql_comments(sql, mysql: false)
+        comment_free(sql, mysql: mysql).squeeze(" ")
+      end
+
+      QUOTED = /'[^']*'?|"[^"]*"?|`[^`]*`?/m
+      # A backslash escapes the next character: every MySQL string, and a PostgreSQL E'...' one.
+      ESCAPED_STRING = /'(?:\\.|[^'\\])*'?/m
+      MYSQL_QUOTED = /#{ESCAPED_STRING}|"(?:\\.|[^"\\])*"?|`[^`]*`?/m
+      DOLLAR_QUOTED = /(?<![\p{Word}$])\$(\p{Word}*)\$.*?\$\1\$/m
+      UNQUOTED = /[^'"`$\/\-#*]+/
+
+      # Comments out, everything else as written: this is the text that runs.
+      # A quoted span is copied whole, so a comment marker inside one is data.
+      # Only MySQL has a hash comment, a `--` that needs a space after it, and
+      # `/*! ... */` content it runs. PostgreSQL has dollar quoting.
+      def self.comment_free(sql, mysql: false)
+        # fixed_anchor, so the dollar quote's lookbehind sees the text before the pointer.
+        scanner = StringScanner.new(sql, fixed_anchor: true)
+        line_comment = mysql ? /--(?=\s|\z)[^\n]*|#[^\n]*/ : /--[^\n]*/
+        out = +""
+        executable = false
+
+        until scanner.eos?
+          quoted = if mysql then MYSQL_QUOTED
+          elsif out.match?(/(?<![\p{Word}$])[eE]\z/) && scanner.check(/'/) then ESCAPED_STRING
+          else QUOTED
+          end
+
+          if (span = scanner.scan(quoted) || (!mysql && scanner.scan(DOLLAR_QUOTED)) || scanner.scan(UNQUOTED))
+            out << span
+          elsif mysql && scanner.scan(/\/\*!\d*/)
+            # Its content stays in the text for the checks to read, e.g. the
+            # `LOAD_FILE` in `SELECT /*!50000 LOAD_FILE('/etc/passwd') */`.
+            executable = true
+            out << " "
+          elsif executable && scanner.scan(/\*\//)
+            executable = false
+            out << " "
+          elsif scanner.scan(/\/\*.*?(?:\*\/|\z)/m) || scanner.scan(line_comment)
+            out << " "
+          else
+            out << scanner.getch
+          end
+        end
+
+        out.strip
+      end
+
+      private_class_method def self.mysql_dialect?
+        ActiveRecord::Base.connection_db_config.adapter.to_s.match?(MYSQL_ADAPTER)
+      rescue ActiveRecord::ActiveRecordError
+        false
       end
 
       # ── SQL validation (Layer 1) ────────────────────────────────────
-      def self.validate_sql(sql)
+      def self.validate_sql(sql, mysql: false)
         return [ false, "SQL query is required." ] if sql.nil? || sql.strip.empty?
 
         # Belt-and-suspenders: run BLOCKED_FUNCTIONS against the RAW sql before
-        # stripping comments. If the unwrap logic in strip_sql_comments is ever
+        # stripping comments. If the unwrap logic in comment_free is ever
         # defeated by a novel MySQL comment variant, this still catches the
         # dangerous primitives (pg_read_file, LOAD_FILE, dblink, ...).
         if (m = sql.match(BLOCKED_FUNCTIONS))
           return [ false, "Blocked: dangerous function #{m[0]} (filesystem/network primitive)" ]
         end
 
-        cleaned = strip_sql_comments(sql)
+        cleaned = strip_sql_comments(sql, mysql: mysql)
 
         # Check multi-statement and clause patterns first - they provide more
         # specific error messages than the generic keyword blocker.
@@ -332,7 +376,7 @@ module RailsAiContext
 
         limited_sql = apply_row_limit(sql, row_limit)
 
-        run_guarded(conn, adapter, limited_sql, timeout_seconds)
+        cap_rows(run_guarded(conn, adapter, limited_sql, timeout_seconds), sql, row_limit)
       end
 
       # EXPLAIN goes through the adapter wrappers too (READ ONLY, timeout): EXPLAIN ANALYZE runs
@@ -364,7 +408,7 @@ module RailsAiContext
 
       private_class_method def self.execute_mysql(conn, sql, timeout)
         # Inject MAX_EXECUTION_TIME hint for per-query timeout
-        hinted_sql = if sql.match?(/\ASELECT/i) && !sql.match?(/\/\*\+/)
+        hinted_sql = if sql.match?(/\ASELECT/i)
           sql.sub(/\ASELECT/i, "SELECT /*+ MAX_EXECUTION_TIME(#{(timeout * 1000).to_i}) */")
         else
           sql
@@ -499,8 +543,7 @@ module RailsAiContext
 
       # ── EXPLAIN execution ────────────────────────────────────────────
       private_class_method def self.execute_explain(sql, timeout)
-        cleaned = strip_sql_comments(sql)
-        unless cleaned.match?(/\A\s*(SELECT|WITH)\b/i)
+        unless sql.match?(/\A\s*(SELECT|WITH)\b/i)
           return text_response("EXPLAIN only supports SELECT queries.")
         end
 
@@ -659,26 +702,51 @@ module RailsAiContext
       end
 
       # ── Row limit enforcement (Layer 3) ─────────────────────────────
+      # The query's own limit ends the statement. A LIMIT anywhere else belongs
+      # to a subquery or a string literal and is left as written.
+      TRAILING_LIMIT = /\bLIMIT\s+(?:(\d+)\s*,\s*)?(\d+)(\s+OFFSET\s+\d+)?\s*;?\s*\z/i
+      TRAILING_FETCH = /\bFETCH\s+(FIRST|NEXT)\s+(\d+)(\s+ROWS?\s+ONLY)\s*;?\s*\z/i
+
       private_class_method def self.apply_row_limit(sql, limit)
         return sql if sql.match?(SCHEMA_METADATA_PREFIX)
 
-        effective_limit = [ limit, HARD_ROW_CAP ].min
+        cap = [ limit, HARD_ROW_CAP ].min
 
-        if sql.match?(/\bLIMIT\s+(\d+)/i)
-          sql.sub(/\bLIMIT\s+(\d+)/i) do
-            user_limit = $1.to_i
-            "LIMIT #{[ user_limit, effective_limit ].min}"
-          end
-        elsif sql.match?(/\bFETCH\s+FIRST\s+(\d+)/i)
-          sql.sub(/\bFETCH\s+FIRST\s+(\d+)/i) do
-            user_limit = $1.to_i
-            "FETCH FIRST #{[ user_limit, effective_limit ].min}"
-          end
+        if sql.match?(TRAILING_LIMIT)
+          sql.sub(TRAILING_LIMIT) { "LIMIT #{"#{$1}, " if $1}#{[ $2.to_i, cap ].min}#{$3}" }
+        elsif sql.match?(TRAILING_FETCH)
+          sql.sub(TRAILING_FETCH) { "FETCH #{$1} #{[ $2.to_i, cap ].min}#{$3}" }
+        elsif own_limit?(sql)
+          # A limit in a spelling this does not rewrite (`LIMIT 1+1`, `WITH TIES`).
+          # A second one would be a syntax error, so it runs as written and cap_rows holds the cap.
+          sql
         else
-          "#{sql.chomp.chomp(';')} LIMIT #{effective_limit}"
+          # On its own line, so nothing the database reads as a line comment takes it.
+          "#{sql.sub(/;\s*\z/, "")}\nLIMIT #{cap}"
         end
       end
 
+      # Whether the last LIMIT or FETCH is the statement's own: nothing after
+      # it closes a parenthesis or a quote that opened before it.
+      private_class_method def self.own_limit?(sql)
+        start = sql.rindex(/\b(?:LIMIT|FETCH\s+(?:FIRST|NEXT))\b/i) or return false
+        tail = sql[start..]
+        depth = 0
+        tail.each_char do |char|
+          depth += { "(" => 1, ")" => -1 }.fetch(char, 0)
+          return false if depth.negative?
+        end
+        [ "'", '"', "`" ].all? { |quote| tail.count(quote).even? }
+      end
+
+      # The text carries the limit. This holds it whatever the database made of that text.
+      private_class_method def self.cap_rows(result, sql, limit)
+        cap = [ limit, HARD_ROW_CAP ].min
+        return result if sql.match?(SCHEMA_METADATA_PREFIX) || result.rows.size <= cap
+
+        ResultProxy.new(result.columns, result.rows.first(cap), result.respond_to?(:unbounded) && result.unbounded)
+      end
+
       # ── Column redaction (Layer 4) ──────────────────────────────────
       private_class_method def self.redact_results(result)
         allowed = allowed_columns
@@ -701,7 +769,7 @@ module RailsAiContext
           col_down = col.downcase
           i if encrypted_cols.include?(col_down) || redacted_cols.include?(col_down) ||
                (!allowed.include?(col_down) &&
-                sensitive_suffixes.any? { |suffix| col_down.end_with?(suffix) || col_down.include?("password") || col_down.include?("secret") || col_down.include?("token") })
+                (col_down.end_with?(*sensitive_suffixes) || col_down.match?(/password|secret|token/)))
         }
 
         return result if redacted_indices.empty?

data/lib/rails_ai_context/tools/search_code.rb

@@ -684,8 +684,7 @@ module RailsAiContext
               # below reads, and `match?` sets none.
               controller_match = file.match(%r{app/controllers/(.+)_controller\.rb})
               if category == "Controller" && controller_match
-                route_actions = extract_controller_actions_from_matches(matches)
-                routes = find_routes_for_controller(controller_match[1], route_actions, root, ctx)
+                routes = find_routes_for_controller(controller_match[1], enclosing_actions(file, matches, root), ctx)
                 route_hint = " → #{routes}" if routes
               end
 
@@ -759,24 +758,29 @@ module RailsAiContext
       end
 
       # Extract which action a controller caller is in
-      private_class_method def self.extract_controller_actions_from_matches(matches)
-        actions = []
-        matches.each do |m|
-          # Match standard RESTful action names from the content
-          if (match = m[:content].match(/\b(index|show|new|create|edit|update|destroy)\b/))
-            actions << match[1]
-          end
-        end
-        actions.uniq.first(3)
+      # The actions a controller file's matches sit in: the public instance
+      # methods of the first class it declares. A call from a macro line, a
+      # private method, a class method, a module or a nested class sits in none.
+      private_class_method def self.enclosing_actions(file, matches, root)
+        source = RailsAiContext::SafeFile.read(File.join(root, file)) || ""
+        controller = Introspectors::DeclaredConstant.declared_names(source).first or return []
+        actions = Introspectors::ActionResolver.own_methods_in(source, controller).select { |d|
+          d[:end_location] && d[:scope] == :instance && d[:visibility] == :public
+        }
+        matches.filter_map { |m|
+          actions.find { |d| (d[:location]..d[:end_location]).cover?(m[:line_number]) }&.dig(:name)
+        }.uniq
+      rescue => e
+        RailsAiContext.debug_fail(e, [], label: "enclosing_actions")
       end
 
-      # Find routes for a controller
-      private_class_method def self.find_routes_for_controller(ctrl_path, _actions, _root, ctx)
+      # Routes of the actions the callers sit in, so the hint never names a
+      # route that does not reach the call.
+      private_class_method def self.find_routes_for_controller(ctrl_path, actions, ctx)
         routes = ctx[:routes]
         return nil unless routes
-        ctrl_routes = RouteCoverage.all_by_controller(routes)[ctrl_path]
-        return nil unless ctrl_routes&.any?
-        # Show the first 2 routes as hints
+        ctrl_routes = Array(RouteCoverage.all_by_controller(routes)[ctrl_path]).select { |r| actions.include?(r[:action].to_s) }
+        return nil unless ctrl_routes.any?
         ctrl_routes.first(2).map { |r| "`#{r[:verb]} #{r[:path]}`" }.join(", ")
       rescue => e
         RailsAiContext.debug_fail(e, nil, label: "find_routes_for_controller")

data/lib/rails_ai_context/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsAiContext
-  VERSION = "5.32.1"
+  VERSION = "5.32.2"
 end