rails-ai-context 5.32.2 → 5.33.0

data/CHANGELOG.md

@@ -5,6 +5,1293 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.33.0] - 2026-10-11
+
+### Security
+
+- **Redaction filters a secret passed as a flag, set under a dashed header
+  name, or sent after an auth scheme.** Every tool that shows the app's
+  source returned `mysql --password=...`, `-- --token=...` and
+  `redis-server --requirepass=...` with the value in place, since a dash
+  before the name hid it; `{ "X-Api-Key" => "..." }`,
+  `req["X-Api-Key"] = "..."` and `"x-auth-token": "..."`, since the dashes
+  hid the secret word; and `conn.headers["Authorization"] = "Bearer ..."`
+  and `{ "Authorization" => "Basic ..." }`, since "Authorization" is no
+  secret word. A flag's value is now filtered as any `NAME=value` is, with
+  Redis's `requirepass` and `masterauth` among the password names and a
+  regex that names the flag (`/--password=.+/`) left as code; a quoted name
+  joined by dashes reads as the name it spells with underscores, so
+  `"Content-Type"` and `"X-Request-Id"` stay; and the credential after
+  `Bearer`, `Basic` or `Token` goes, the scheme kept, when it is 16 or more
+  letters and digits, both, read past a UUID's dashes and base64's `+`,
+  `/` and `=`, so `Bearer #{token}`, `Bearer YOUR_TOKEN` and
+  `Basic realm=...` stay. `rails_read_logs` kept a `Basic` credential after
+  `Authorization: `, the whole header when it was quoted, a hash or JSON
+  key or `HTTP_AUTHORIZATION`, and a dashed header key's value in a logged
+  hash (`{"X-Api-Key"=>"..."}`); each is filtered now. A Stimulus target,
+  action, controller, outlet or class is read as a descriptor, so
+  `data: { password_visibility_target: "input" }` keeps its value.
+- **Redaction filters the password Postgres, mysql and redis-cli read from
+  the environment, a camel-cased secret name, and a flag's secret given as
+  the next word.** A password word counted only as a part of a name between
+  underscores, a secret word only in snake case, and a flag's value only
+  after `=`, so `PGPASSWORD: ...` in a compose file, `PGPASSWORD=... psql`
+  in a script, `ENV["PGPASSWORD"] = "..."`, `MYSQL_PWD` and
+  `REDISCLI_AUTH`, `const accessToken = "..."`, `{"clientSecret": "..."}`,
+  `secretAccessKey: "..."` and `redis-server --requirepass ...` in a
+  Procfile kept their values, in source and in a log line alike. A long
+  password word that ends a name now reads with a name joined on before it
+  (`PGPASSWORD`, `dbpassword`, `userPassword`; not `ONEPASSWORD_VAULT`),
+  the two client variables as password names, a camel-cased name with
+  `Secret` or `Token` among its words as a secret's (`accessToken`,
+  `jwtSecretKey`), as `apiKey` already was a key's, and the word after a
+  secret-named flag, bare or quoted, as its value when it has a digit. So
+  `the --password option`, `--token TOKEN`, `--password $DB_PASSWORD`, a
+  `--no-password` switch, a path (`--private-key ~/.ssh/id_ed25519`), a
+  file or an id (`--token-file`, `--secret-id`) and BuildKit's
+  `--secret id=...,env=...` stay as written, as do a switch's value
+  (`showPassword=false`) and a value that is its key's own name
+  (`currentPassword: "current_password"`).
+- **Redaction reads a long word in time that grows with its length, not its
+  square.** A call's receiver was tried from every character of a run of
+  letters, digits and dots, so filtering a line holding a 16 KB hex string
+  took 1.5 to 2 seconds on Ruby 3.1 and 3.2 and a 64 KB one over 20; on
+  Ruby 3.3 and later a 1 MB one took 2.5 seconds, past the one second a
+  Rails 8 app gives a regular expression, and the tool answered with that
+  error. A name was split at every underscore of a long word holding a
+  secret word in many of its parts, and a path check retried from every
+  slash. The receiver is now read from where its run starts, a name is taken
+  whole, and a path's first segment at once: each of those lines takes a
+  fraction of a second.
+- **`rails_get_view` filters the secrets in a controller's full listing.**
+  `controller:"posts", detail:"full"` printed each template and partial as
+  written, `<% api_key = "..." %>` and a `render` call's `token: "..."`
+  among them, while the same template read by `path:` and every layout had
+  them filtered. Each file in the listing is now filtered as one read by
+  path is, a mailer's views (`controller:"user_mailer"`) included.
+- **`rails_security_scan` shows a warning's code as the file has it.** At
+  `detail:"full"` the code was Brakeman's own line, which writes the value
+  of each variable and constant it can follow in place of the name: a token
+  assigned to `api_token` on the line above, or to a constant in an
+  initializer, sat in the `system(...)` call as a bare literal, with no name
+  left for the redaction to know it by. The answer now shows the statement
+  the warning names, read from its file and filtered as every other slice of
+  the app's source is: a call written across lines whole, up to 12 lines,
+  and a template's line fenced as the template it is. A warning in a file
+  the tools may not read shows no code.
+- **`rails_search_code` in trace mode checks its `path` like every other
+  mode.** `match_type: "trace"` joined the path to the root unchecked, so
+  `path: "../../elsewhere"` searched outside the app and printed the source
+  it found there.
+- **A directory linked in from outside the app's git repository is not
+  read.** A walk or a pack follows a directory link only into the work tree
+  holding the app (into the app root outside a repository); a pack linked
+  from anywhere, a home directory included, used to be read.
+- **`rails_review_changes` hands git a commit, never the caller's ref.**
+  The ref went to `git diff` and `git log` as an argument, and one that
+  starts with a dash is read as an option: `ref: "--output=<path>"` made
+  the read-only tool write the diff to any path the caller named. A ref now
+  has to name a commit, and git sees that commit's SHA. A ref that starts
+  with a dash is refused, and one that names no commit says so, where it
+  answered "No changes found".
+- **`rails_review_changes` filters the secrets in the diffs it shows, and
+  shows no line of a sensitive file.** Each file's diff was printed as git
+  gave it, so a key, token or password a change added or took out reached
+  the caller whole, as no other tool's source did, and so did every line of
+  a changed `config/database.yml`, `.env` or key file. A diff's lines now go
+  through the same redaction, read as the file they come from, a hunk
+  header's line and a removed validation's included, and a file on
+  `sensitive_patterns` is listed with its line counts alone.
+- **Redaction reads a secret a YAML or JSON file names on another line,
+  and a YAML key written as a symbol.** Heroku's app.json gives a
+  variable's value under its name (`"STRIPE_SECRET_KEY": { "value": "..." }`),
+  render.yaml and a Kubernetes manifest under a sibling (`- key:
+  CLIENT_SECRET` over `value: ...`), and config/sidekiq.yml writes its keys
+  as symbols (`:password: ...`); every tool that shows a file kept each of
+  those values. In a YAML or JSON file read whole, a `value` under a
+  mapping a secret's name names is now filtered, a boolean and the next
+  entry's value kept, and a symbol key reads as its name.
+- **The gems section names a git source without its credentials.** A
+  Gemfile's `git: "https://user:token@host/..."` went into the gems answer,
+  the `rails://gems` resource and `.ai-context.json` as written. The URL now
+  passes through the redaction a source line does, so its userinfo, or a
+  token format in its place, reads `[FILTERED]`.
+- **The context file names a Procfile's commands with their secrets
+  filtered.** Each command went into the DevOps section as written, so
+  `redis-server --requirepass ...` or `DB_PASSWORD=... bundle exec sidekiq`
+  reached `.ai-context.json`, which `rails ai:context` asks the team to
+  commit. A command now passes through the redaction a Procfile line read by
+  any tool does.
+- **`rails_get_edit_context` names an endless method without its body, and
+  looks for `near` in what it shows.** The line above the code quoted the
+  enclosing method's line as written, and an endless method's line is its
+  whole body: `def headers = { "Authorization" => "Bearer ..." }` printed
+  the credential the code under it had filtered. And `near` was looked for
+  in the file as written, so a guess at a secret's start brought back the
+  window where a wrong guess said "not found". The label is now built from
+  the filtered lines, an endless method named alone, and `near` is matched
+  against the lines as they are returned.
+- **`rails_query` never serialises a whole row.** On PostgreSQL,
+  `row_to_json(users.*)`, `to_json(u)`, `u::text`, `array_agg(u)`,
+  `json_agg(u)`, `hstore(u)`, `ROW(u.*)`, `format('%s', u)` and a bare
+  `SELECT u FROM users u` returned every column, password digests and
+  tokens included, since no column name appeared for the checks to catch.
+  A query is now planned first with `EXPLAIN (VERBOSE, FORMAT JSON)` in the
+  same read-only transaction - planning only, nothing runs - and refused
+  when the plan reads a whole row of a table that has a sensitive column,
+  or uses a sensitive column other than as a plain output column. A
+  whole-row read of a table with no sensitive column still works.
+- **A sensitive column cannot leave through an alias, an expression or a
+  view.** `SELECT api_token AS c`, `upper(api_token)`,
+  `json_build_object('t', api_token)` and `(SELECT api_token FROM users
+  LIMIT 1) AS leaked` reached the result under a name the redaction did not
+  recognise. One rule now decides what is sensitive - a configured or
+  built-in redacted name, an `encrypts` column, or the result heuristic,
+  minus `query_allowed_columns` - and a query naming any real sensitive
+  column of the schema is refused before it runs, on every adapter, as is
+  a column-alias list (`t(a, b, c)`) that would rename a wildcard's
+  columns. Rails' own bookkeeping tables are left out of that set, so
+  `ar_internal_metadata.key` does not make the word `key` refused, and on
+  PostgreSQL a name inside a string literal (`LIKE '%secret%'`, a JSON key)
+  is data, allowed only when the query's plan was read and cleared. On PostgreSQL the result is also redacted by where each column
+  comes from, so a view that renames `api_token` to `t` returns
+  `[FILTERED]`, and a sensitive column passed through a materialized CTE, a
+  subquery or a set operation, where its origin cannot be pinned, is
+  refused.
+- **`rails_query` refuses every spelling of UNION.** The check matched
+  only `UNION SELECT` and `UNION ALL SELECT`; MySQL and MariaDB also take
+  `UNION DISTINCT SELECT` and a parenthesised `UNION (SELECT ...)`, and
+  either one returned another table's rows under the first SELECT's
+  column names - a password digest under `posts.user_id` - past the
+  redaction that reads names. Any UNION is refused now, on every adapter,
+  with that reason, where it was called an "SQL injection pattern".
+- **Session- and server-affecting functions no longer run under the
+  read-only transaction.** `pg_terminate_backend`, `pg_reload_conf`,
+  `pg_stat_reset*`, `pg_advisory_lock*`, `set_config`, `pg_notify`,
+  `txid_current`, the replication and WAL-control functions, and MySQL's
+  `GET_LOCK` / `RELEASE_LOCK` / `IS_FREE_LOCK` passed `SET TRANSACTION READ
+  ONLY` and left their effect - a terminated backend, a held advisory lock -
+  on the pooled connection. A name list refuses the known ones on every
+  adapter, and on PostgreSQL any VOLATILE function outside a short harmless
+  list (`random`, `clock_timestamp`, `gen_random_uuid`, `pg_sleep` and its
+  variants) is refused from the plan, closing the family without a list
+  that has to grow.
+- **The endpoint inside the app refuses outside development and test
+  unless the app opts in.** The mounted engine and `auto_mount` answered
+  every tool to whoever could reach a production or staging app. Both now
+  answer 403 with a JSON-RPC error that names the environment and the
+  setting, and log the refusal once per process;
+  `config.allow_http_in_production = true` lets them answer, for an
+  endpoint behind the app's own authentication. Doctor's "MCP HTTP
+  endpoint" check fails `auto_mount` with it on and warns for the engine.
+- **No walk follows a symlink out of the app.** `rails_get_stimulus`
+  parsed a controller linked in from outside the app and printed its
+  targets and values, and so did the view, layout, partial, helper,
+  JavaScript, locale, environment-file, seed and concern scans and the
+  booted source reads. A file whose real path is outside the app is now
+  neither listed nor read, unless it sits in a directory the app links in,
+  such as a pack.
+- **A log, partial or concern refused on policy is an error result.**
+  `rails_read_logs file:`, `rails_get_partial_interface partial:` and
+  `rails_get_concern name:` answered "not found" for a file that links out
+  of the app, and their lists still offered it. They now answer `Path not
+  allowed: <name>` with `isError: true` (exit 1 on the CLI), no list offers
+  a refused entry, and `rails_diagnose` returns its diagnosis for a refused
+  `file:` as an error result.
+
+### Added
+
+- **`rails-ai-context init` sets up a folder of apps.** Run in a folder that
+  is no app but holds apps one or two levels down - the folder an editor or
+  agent is often opened at - it asks once and sets up every app: each keeps
+  its own `.rails-ai-context.yml` and context files, generated by the install
+  that app's server runs, and the folder's MCP configs get one server per
+  app, `rails-ai-context-<app folder>`, pointed at it with `--app-path`
+  (#429). Paths stay relative so a committed config works on every machine,
+  spelled from `${workspaceFolder}` for Cursor and VS Code, which name the
+  folder their config sits in. Each app keeps its own install form, decided
+  from its own Gemfile.lock, and an in-Gemfile app's entry sets
+  `BUNDLE_GEMFILE` to the Gemfile its bundle reads: its own (a linked one by
+  the link's name), else the shared one its `config/boot.rb` names, else the
+  one `bundle exec` run inside the app would find. A bare
+  `rails-ai-context` entry left in the folder is replaced, a re-run drops
+  the entry of an app whose folder is gone or that the gem renamed, removal
+  and cleanup take every `rails-ai-context-*` entry that runs the gem's
+  server (a hand-made one that does not stays, and so does an entry with no
+  command, an HTTP one, under either name), `--app-path` naming a folder of
+  apps sets that folder up, and `doctor` inside an app finds the folder's
+  config one or two levels up, says when one there does not parse, and
+  checks each Codex env snapshot in it. `init` warns when an app declares a
+  Ruby other than the one the folder runs. See ADR-0005 for what each AI
+  tool does with a server's working directory, and why.
+- **`RAILS_AI_CONTEXT_SERVER_NAME`** names the server, for one process, in
+  place of the default `config.server_name`; a name the app configured wins.
+  A workspace entry sets it to put its app first: VS Code names every tool
+  after the announced name and keeps 13 characters of it, so every app's
+  tools would otherwise start `rails-ai-cont`. An app whose bundle pins an
+  older gem ignores the variable and starts.
+- **CONFIGURATION.md lists the environment variables the gem reads**, among
+  them `RAILS_AI_CONTEXT_BOOT_TIMEOUT`, which appeared only in error
+  messages.
+
+### Fixed
+
+- **`rails_security_scan` echoes a long file or check name shortened.** A
+  100,000-character `files` entry came back whole in "File(s) not found"
+  and in the scope of a clean answer, and a long `checks` entry came back
+  whole in brakeman's "Could not find specified check", from the scan in
+  this process and the one outside the bundle alike. Each now shows its
+  first 80 characters and its length. A check name brakeman does not know
+  is answered the same from either scan - "Brakeman scan failed: Could not
+  find specified check" - where the scan outside the bundle told the caller
+  to add brakeman to the Gemfile - and a `files` path that names nothing is
+  answered before the scan, which on a large app takes minutes, not after it.
+- **A call sees an edit inside a directory the app links in from its
+  repository.** The check each call makes for edits stopped at the link, while
+  the readers walk through it, so with `app/javascript/controllers/shared`
+  linked to a monorepo's shared controllers, `rails_get_stimulus` answered
+  from before an edit there until `cache_ttl` ran out, 60 seconds by
+  default, and `rails_search_code` already read the edit. The check now
+  follows such a link as the readers do: only into the app's repository,
+  never back up over the tree it walks, each linked directory once, so a
+  link that leads round in a circle ends. Where a link leads is asked at
+  every check, so one whose directory appears later is followed too. The
+  fuller check that runs once `cache_ttl` is out follows a linked directory
+  whatever its name, where it asked only a name with no extension
+  (`billing.v2` was passed over).
+- **The pre-commit hook no longer stops a commit for JavaScript the app's
+  own toolchain compiles.** `rails_validate` failed a Flow file
+  (`Typed.js:3:21: SyntaxError: Unexpected token ':'`), a MobX store's
+  decorators (`Invalid or unexpected token`) and any syntax a Babel config
+  adds, since node parses none of them. A decorator is now skipped as JSX
+  is, naming its line. A file that declares Flow (`// @flow`), or one Babel
+  compiles - a `babel.config.*` or `.babelrc*` file, or a `"babel"` key in
+  `package.json`, in its folder or one above it up to the top of the
+  repository - is skipped with node's error named beside it, since that may
+  be the toolchain's syntax or the file's own mistake. Type annotations in a
+  `.js` file nothing compiles, and a plain syntax error, still fail.
+- **A `doctor` fix typed in a folder inside the app runs there too.** From
+  `blog/app/models` the fixes were the ones for the app's root:
+  `bin/rails db:prepare` was no file there, and `git rm --cached .env`
+  matched nothing. A command now goes to the root first - `cd ../.. &&
+  bin/rails db:prepare`, `git -C ../.. rm --cached .env`, `rails-ai-context
+  --app-path ../.. init` - and a `.gitignore` to edit, a config to make
+  valid and the engine a task runs in are named from where `doctor` was
+  typed; the report still names the app's files from its root. The binary
+  tells the bundle's copy it hands the run to where it was typed, and
+  `rails ai:doctor` reads it from the shell's `PWD`, since Rails' `rails`
+  command and rake move up to the root before the task runs.
+- **`doctor` gives the edit by hand the install gives for a config the
+  install leaves as it is.** For a `.vscode/mcp.json` holding comments it
+  said to run the install, which left the file as it was and said to add
+  the entry by hand, and `doctor` then said to run the install again. It
+  now names the entry to add, as the install writes it (`Add
+  {"servers":{...}} to .vscode/mcp.json by hand`), for VS Code's and
+  OpenCode's configs, a workspace's included. For a Codex entry kept as an
+  inline table or with dotted keys, a stale env snapshot in one included,
+  it names the table to write by hand, where an entry the install had to
+  rewrite sent the reader back to the install too; and it asks for a JSON
+  config that is not UTF-8 to be saved as UTF-8 before the install runs,
+  as the install now does too, where it said to add the entry by hand to a
+  file JSON still could not read.
+- **On Windows the MCP configs start the server through `cmd /c`, and
+  `doctor` reads a config for the platform it runs on.** A gem's executables
+  on Windows are batch files (`bundle.bat`, `rails-ai-context.bat`), which
+  Claude Code, Codex and the other clients that start their server without a
+  shell do not run, so no entry the install wrote started there. Each entry
+  is now `cmd /c bundle exec rails-ai-context serve` (`cmd /c
+  rails-ai-context serve` standalone) on Windows - `cmd.exe` is a program
+  every client starts, and it runs the batch file - and stays as it was on
+  macOS and Linux. A config may be committed, so `doctor` fails a `cmd /c` entry on
+  macOS and Linux, where there is no `cmd`, and on Windows warns about a
+  bare entry whose command PATH finds only as a `.bat` or `.cmd`; running
+  the install again rewrites either for the machine it runs on. A team on
+  both keeps the MCP configs out of git, or runs the install on each machine.
+- **The pre-commit hook is written with plain newlines on Windows**, where
+  the generator wrote it in text mode, so each line ended in CRLF and the sh
+  that Git for Windows runs a hook with read the CR as part of every
+  command. The stdio server ends each JSON-RPC frame with a plain newline
+  there too, rather than the CRLF a text-mode stdout writes.
+- **`doctor` reads PATH on Windows**, where the variable is named `Path`:
+  the copy of the environment it reads from before Bundler's changes is a
+  plain Hash, which asked for `PATH` found nothing, so every MCP config's
+  command read as not on PATH there.
+- **`doctor` and `search_code` find ripgrep on Windows**, which has no
+  `which` to ask, so ripgrep read as missing there and every search took the
+  slower Ruby path. PATH is searched in Ruby now, with Windows' `PATHEXT`
+  extensions, and `doctor`'s fix names `winget install
+  BurntSushi.ripgrep.MSVC`. ripgrep is told to separate paths with `/`, since
+  on Windows it joins the files it finds with backslashes, which neither the
+  app root nor the sensitive patterns that keep a file out of the answer
+  (`config/database.yml`) would match.
+- **A Windows path that starts with a drive is read as absolute.** Every
+  check for an absolute path looked for a leading `/`, so on Windows
+  `C:/...` passed as relative: the context the app commits could carry a
+  path under the developer's home directory, an engine or code root outside
+  the app was looked for inside it, and a tool handed `C:/Windows/win.ini`
+  did not refuse it as the absolute path it is. A failing tool's `At:` line
+  split its frame at the drive letter's colon and so named the file by its
+  whole path, and `doctor` named an absolute SQLite path from database.yml
+  as though it were relative to the app.
+- **A file whose lines end in CRLF, as a Windows checkout's do, is read and
+  written in them.** `search_code` ends a line before its CRLF, so `end$`
+  finds a line that ends `end` (it matched no line of such a file) and
+  `\s$` no longer matches every one. The initializer's `config.ai_tools`
+  line was not found or inserted in a CRLF initializer; a context file's
+  managed block was written in LF beside CRLF text, leaving a blank line
+  under its END marker on every run; and the CRLF pre-commit hook an
+  earlier version wrote on Windows, which sh cannot run, read as changed by
+  hand, so the install never rewrote it.
+- **On Windows the stdio server keeps its stdout across Bundler's re-exec.**
+  Windows has no `exec`: Ruby starts the new image as a child that inherits
+  the standard handles and no other, so the descriptor the server saved its
+  real stdout on was lost, and a server whose app pins another Bundler
+  answered its client nothing. An exec inside the boot now puts the real
+  stdout back first.
+- **On Windows `security_scan` stops a run that does not end**, where
+  sending it TERM raised `EINVAL`; the run is stopped with KILL alone there.
+  A `search_code` pattern longer than Windows takes on a command line (about
+  32,000 characters) is searched in Ruby, where the error answered with the
+  whole command line, pattern and all.
+- **On Windows an app whose `app/` is a directory link holds source.** The
+  check for Ruby files under `app/`, which decides that a tree with no
+  `config/` is an app to read from source (an engine's root, a command run
+  with `--no-boot`), walked in through a trailing separator. That follows a
+  link on macOS and Linux; Windows' `lstat` answers for the link itself, so
+  the walk found nothing there and the command said no Rails app was found.
+- **"No Rails app found in" names an `--app-path` as it was typed**, as the
+  hint under it does, where it named the folder through any symlink on the
+  way (`/private/var/...` for `/var/...` on macOS). The warning that an app
+  boots against another bundle under `bundle exec` is printed only where
+  there is an app to boot.
+- **A stdio server whose app hangs while booting answers its client within
+  about 21 seconds, from the static tier.** A stdio client waits about 30
+  seconds for `initialize` (Claude Code, the MCP Inspector) and `serve` gave
+  the boot 60, so an initializer blocked on a service that was down never
+  reached the static tier for a real client. `serve` over stdio and
+  `rails ai:serve` now give the boot 20 seconds unless
+  `RAILS_AI_CONTEXT_BOOT_TIMEOUT` says otherwise; `rails ai:serve`, which
+  has no static tier, exits with the boot's error while the client still
+  listens. Other commands keep 60.
+- **A call sees every edit made before it, with live reload or without.**
+  Inside `cache_ttl` the cache was served without asking whether files had
+  moved, relying on live reload - which needs the `listen` gem a new Rails 8
+  app does not bundle, and even then delivers an edit only after its
+  1.5-second debounce. An agent that edited a model and asked about it at
+  once was answered from before the edit: a new association missing, a
+  syntax error unreported; without live reload an association added to a
+  model never appeared until a restart. Every server, the endpoints mounted
+  in the app included, now checks the app's files at the start of each tool
+  call and resource read and, when they moved, reloads the app's code and
+  resets the caches. A call shares only a check that began after it arrived,
+  so calls one after another each see an edit made between them. The check
+  costs about a millisecond on a small app and about 30 ms at 10,000 files.
+  Live reload now only tells clients that files changed.
+- **Reading pending migrations writes nothing to the database.** The pending
+  list came from `MigrationContext#open`, which creates `schema_migrations`
+  and `ar_internal_metadata` in a database that lacks them. Pending is now
+  the migration files minus the versions `schema_migrations` holds. A SQLite
+  database whose file is not there is reported missing without connecting,
+  since connecting created an empty file that `db:prepare` then migrated
+  from nothing instead of loading the schema and seeds.
+- **`doctor`'s secrets check asks git.** Inside a git repository every
+  ignore rule counts: any `.gitignore` up to the repository root,
+  `.git/info/exclude` and the global excludes. A tracked secret fails as
+  committed, with `git rm --cached` and rotating it as the fix. Outside git,
+  the app's `.gitignore` is read as before.
+- **`rails_security_scan` runs a brakeman installed outside the app's
+  bundle.** It runs the gem's own `bin/brakeman` with the app's Ruby, where
+  the scan produced no report while `doctor` passed it. `doctor` runs that
+  script's `--version` the same way and warns when it does not answer.
+- **`rails_validate` reads ERB trim tags as Rails does.** `<%-` and `-%>`
+  were compiled as a unary minus, so every template using them failed, and
+  the installed pre-commit hook blocked the commit. An `if` left open and an
+  extra `end` still fail.
+- **An ERB syntax error names the template line it is on.** Errors were
+  reported a line low, two with a `frozen_string_literal` comment. A keyword
+  left unpaired was blamed on a line past the template's end; it is now
+  reported on its own line, and a bracket left open at the end of the
+  template.
+- **`rails_validate` says why a path is refused.** `app/models/../models/x.rb`
+  and absolute paths were refused as "outside Rails root"; the message now
+  names the `..` or the absolute path. A directory is called a directory,
+  and only a file other than the input is suggested.
+- **`level:"rails"` stops reporting columns that macros declare.**
+  `has_secure_password`, its confirmation and challenge, `has_one_attached`,
+  `has_many_attached` and `has_rich_text` were each reported as a missing
+  column with a migration to add it, in `validates` and in `permit` lists.
+- **`level:"rails"` knows route helpers that are not rows of the route
+  table.** Helpers in app/helpers, `helper_method` names, `direct` routes
+  and Rails' own routes such as `rails_blob_url` are no longer reported as
+  missing.
+- **An ivar set by an ancestor's or a concern's `before_action` is not
+  reported as unset.** The view check now reads the controller, its
+  ancestors and the modules they include.
+- **No warning asks for a `.turbo_stream.erb` beside a `turbo_stream_from`
+  view.** Nothing renders such a template.
+- **`rails_review_changes` with a ref diffs from the merge base.** A
+  validation the ref added after the branch left it no longer reads as one
+  the branch removed, and an edited `validates` line is not reported as
+  removed.
+- **`rails_review_changes` reviews an app in a subfolder of its repository
+  on its own.** Files are named from the app root, with their diffs and the
+  right type; another app's files and commits are left out.
+- **`rails_review_changes` reads a migration's table however the call is
+  written.** `change_table "orders"` and
+  `add_column("orders", :coupon_id, :integer)` now get the "Affects tables"
+  line and the missing-index warning. The line reads every schema method
+  that takes a table, through Rails 8.1: `remove_columns :users, :name`
+  names users, as do `rename_index`, the comment, constraint and index
+  methods; `drop_table` names each table it drops, `rename_table` the new
+  name too, and `create_join_table :users, :roles` the join table it makes,
+  roles_users, and both tables. A call on a `change_table` block's table
+  (`t.remove_index :number`) or a commented-out line names no table.
+- **The pre-commit hook no longer blocks every commit when the app cannot
+  boot, and shows why validation failed.** It validates through
+  `bundle exec rails-ai-context tool validate`, which checks from source
+  when the boot fails, and its stderr is shown. Re-running the generator
+  upgrades an unchanged earlier hook.
+- **The pre-commit hook checks staged `.js`, `.mjs` and `.cjs` files.** A
+  broken Stimulus controller is now blocked.
+- **A file saved mid-edit no longer crashes the server.** With web-console
+  in the bundle, saving two files that did not compile made the next
+  `rails_get_model_details` segfault in about half the runs: Ruby crashed
+  compiling them under web-console's raise hook. A file Prism finds a
+  syntax error in is no longer required while introspecting, nor when a
+  tool looks a class up by name - the receiver or the exception class
+  `rails_diagnose` is given, a mixin `rails_get_concern` checks, a model
+  `rails_validate` asks about a callback - nor is one whose class body
+  names its constant (a subclass of a broken `ApplicationRecord`). The
+  answer gives the error, and the log names each file once.
+- **`rails_get_controllers` names a controller whose file does not
+  compile.** A controller left unloaded by a syntax error in its file, or in
+  a file its class body needs (its parent controller), was listed with the
+  actions and filters its source read as, with no word that Rails cannot
+  load it. Its entry now gives the error, in every listing and in its own
+  answer, as `rails_get_model_details` does for a model, and so do the
+  `controllers/{name}` and `controllers/{name}/{action}` resources, where
+  an action read built its answer from the broken source.
+- **A tool call that raises a `SyntaxError` or a `LoadError` answers with an
+  error and leaves the server running.** The rescue that turns a tool's
+  failure into an error result caught `StandardError` only, so a
+  `ScriptError` out of an app file a tool reached went past it and past
+  the MCP SDK, and ended a stdio server with every tool in it. It is now
+  that call's `Tool ... failed: SyntaxError: ...` answer.
+- **Live reload loads no app code on the watching thread.** Listen's
+  callback only marks a reload as pending; the next tool call reloads on its
+  own thread. `watch` reloads and regenerates on its main thread and keeps
+  going past an error from the app's code.
+- **A server that cannot reload code says so once the code changed.** Under
+  `RAILS_ENV=test`, or production with eager loading, every answer ends with
+  a note naming the changed files, since what reflection reads (associations,
+  enums) is as of boot, and a JSON answer or resource body carries it under
+  `_stale_code`. The server instructions no longer promise that reflection
+  follows edits there.
+- **A resource read from the static tier says so**, under `_static_tier` in
+  its JSON body, as a tool's JSON answer does.
+- **A Ruby file saved twice within one second at the same size is named in
+  every answer.** Bootsnap's compile cache knows a file by its size and the
+  second of its mtime, so the reload such a save sets off got the code of
+  the earlier save, and an answer showing the earlier save's associations
+  read as current. Bootsnap has no way to drop one entry, so a server that
+  reloads now ends every answer with a note naming the file until it is
+  saved in another second, and COMPATIBILITY.md lists the limit and
+  `DISABLE_BOOTSNAP_COMPILE_CACHE=1`.
+- **`rails_query` runs a read-only query that names a write keyword only
+  inside a string.** `WHERE title LIKE '%update%'`, `= 'put into box'` and
+  the `replace()` string function were refused as writes; a keyword or
+  `INTO` is now judged outside string literals, and `SELECT ... INTO`,
+  `REPLACE INTO`, `INTO OUTFILE` and writes inside a CTE are still refused.
+- **`rails_query` runs `SHOW CREATE TABLE` and `SHOW CREATE VIEW`** on
+  MySQL and MariaDB, showing the whole definition, with credentials in it
+  redacted.
+  `SHOW CREATE USER`, `SHOW CREATE DATABASE` and `SHOW GRANTS` stay refused.
+- **Every command a `doctor` fix gives runs where `doctor` was typed.**
+  Typed in an app's parent folder with `--app-path blog`, as `init`'s
+  folder-of-apps summary suggests, the fixes did nothing or the wrong thing
+  there: `bin/rails db:migrate` was no file, `rails-ai-context init` set up
+  every app in the folder, `git rm --cached` found no repository, and a
+  `.gitignore` line spelled from the parent folder (`blog/.env.local`)
+  ignored nothing in blog's own `.gitignore`. The binary's commands now
+  carry `--app-path blog`, the app's other commands run after `cd blog &&`,
+  git runs as `git -C blog`, and a `.gitignore` line names `blog/.gitignore`
+  with the pattern as that file reads it (`.env.local`).
+- **The install finds a Codex server however its name is spelled, and never
+  declares it twice.** A quoted table (`[mcp_servers."rails-ai-context"]`),
+  an inline table or dotted keys went unseen: a second table was appended,
+  and Codex refused the whole file ("duplicate key") while re-runs said
+  "(unchanged)" and `doctor` passed it. A quoted table is now replaced where
+  it stands, and two tables become one. An entry of the gem's in another
+  form is left as it is, with what to do by hand. `doctor` fails a server
+  declared twice and warns about an entry the install does not rewrite.
+- **An MCP config with trailing commas is read as VS Code reads it** (json
+  2.9 or later). Every run left `.vscode/mcp.json` as it was, kept asking
+  for the entry by hand after it had been added, and `doctor` failed the
+  file.
+- **`init` in a folder holding one app names the folder's files as the
+  folder's.** It printed `backend/.mcp.json` for the folder's `.mcp.json`.
+  Each app's `.gitignore` is now named by its app, and an app's legacy-file
+  `rm -f` line works when pasted where `init` ran.
+- **Removing one of two dropped tools keeps the file the other still
+  uses.** Removing OpenCode's files while also dropping, but keeping, Codex
+  CLI's deleted `AGENTS.md`.
+- **An MCP config is read the way its client reads it.** Claude Code reads
+  `.mcp.json` as plain JSON, so a hand-edited one with a trailing comma or a
+  comment loaded no server while the install called it "(unchanged)" and
+  `doctor` passed it. Such a file is now reported, by the install and by
+  `doctor`, as one Claude Code cannot read; Cursor's `.cursor/mcp.json` is
+  held to plain JSON too. VS Code's `.vscode/mcp.json` and OpenCode's
+  `opencode.json`, which read JSONC, keep taking comments and trailing
+  commas.
+- **A Codex config with a byte that is not UTF-8 in a quoted server name no
+  longer stops `init`, or drops `doctor`'s MCP and Codex rows.** Codex
+  refuses a config that is not UTF-8 at all, so the install says so and
+  `doctor` fails the file.
+- **A directory the app links in from its own repository is read as the
+  app's own.** With `app/javascript/controllers` linked to a monorepo
+  package every Stimulus controller was missing; the code, view and
+  JavaScript walks now follow such a link as Zeitwerk, the view resolver and
+  the bundlers do, and an edit inside one refreshes the cache.
+- **A path through a linked-in pack is accepted by every tool that takes a
+  path.** `rails_get_edit_context`, `rails_validate` and `rails_search_code`
+  refused `packs/billing/app/models/invoice.rb`, which
+  `rails_get_model_details` named, and a search of the app never read the
+  pack.
+- **`rails_get_partial_interface` names a linked-in pack's partial as the
+  app spells it**, finds its render sites, and points at a `rails_get_view`
+  path that resolves.
+- **A link that resolves nowhere is never offered back as the file to try**,
+  nor listed as a Stimulus controller or a view.
+- **Every tool refuses a path in the same words, and echoes a long one
+  shortened.** `Path not allowed: <path>`, with `(sensitive file)` when the
+  name is the reason, where some tools said "Access denied" or "outside
+  Rails root"; a 100 KB path came back as a 100 KB refusal.
+- **The mounted engine keeps its MCP sessions across a code reload.** Every
+  edit in development dropped them (404 "Session not found") and left one
+  more session-reaper thread running.
+- **The mounted engine (`mount RailsAiContext::Engine`) no longer deadlocks
+  when clients call it while app code reloads in development.** Since 5.16.1
+  it answered on a thread `ActionController::Live` starts, which needs a
+  share of the lock Rails reloads code under. Once an edit had a reload
+  waiting, no new share was granted, and the reload waited for the request,
+  which waited for its Live thread: with six clients calling while a file
+  changed every 0.3 seconds, every call hung and `rails server` ignored
+  SIGTERM, in every run on Rails 8.1 and in three of four longer runs on
+  7.0. The Live thread also kept the database connection a call had used, so
+  from Rails 8.0 each call after an edit sat out the reload's ten-second
+  wait for it: 10.3 seconds a call, where it now takes 0.4. The engine now
+  runs each call on the request's own thread and sends the answer whole; the
+  same runs answer every call and stop on SIGTERM. The cost is streaming:
+  what a custom tool sends during a call, such as progress or log
+  notifications, arrives with its answer, and a request a tool makes of the
+  client mid-call (sampling, elicitation, roots) fails at once, saying why,
+  where it could only have waited out its timeout. `subscriptions/listen`,
+  whose notification stream an answer sent whole cannot keep open, is
+  answered as a method the engine does not have. stdio and the standalone
+  HTTP server still stream.
+- **The engine and `auto_mount` answer the hosts the app's `config.hosts`
+  allows.** The MCP SDK answered only loopback names, so
+  `allow_http_in_production` could not serve an app by its own name, and
+  `myapp.localhost` was refused in development. Rails' host authorization
+  judges the Host now; a cross-origin request is still refused.
+- **A stdio message over 4 MiB is answered, named on stderr, and ends the
+  server with status 1**, where it exited 0 with nothing said.
+- **Email addresses in any script are redacted from log lines**
+  (`jürgen@example.com`, `anna@münchen.de`).
+- **A missing view, an unknown resource URI and an unknown tool are
+  answered with what exists**, in `data.available` and, for a tool, the
+  nearest names in the message.
+- **A generated length test sets a value the validation rejects.** A length
+  validation with no maximum was tested with `""`, so
+  `length: { minimum: 10 }, allow_blank: true` got the one value it allows
+  and the test failed on a valid record. The value is now one past the
+  maximum (or the `is:` or range end), else one short of the minimum; `""`
+  is used only for a minimum of 1 that does not allow blanks.
+- **Generated tests call `FactoryBot.create` where the suite does not
+  include FactoryBot's methods.** A bare `create(:article)` works only where
+  rails_helper, a support file or test_helper includes
+  `FactoryBot::Syntax::Methods`; without it every generated example failed
+  with "undefined method `create'".
+- **A controller whose base class inherits `ActionController::API` is an
+  API controller with the app unbooted too.**
+  `Api::V1::PostsController < BaseController < ActionController::API` read
+  as an ordinary controller under `--no-boot`.
+- **`rails_get_partial_interface` reads `render "comments/form"` as the
+  comments form.** `posts/_form` took the comment form's call in
+  `posts/show`, and its `comment` local.
+- **`rails 'ai:tool[...]'` keeps an argument that contains a bracket.**
+  `pattern=params\[:id\]` was dropped, and the answer was "Pattern is
+  required".
+- **The stack overview counts the databases it does not name.**
+  "Databases: 5 (primary, analytics, cache)" read as the whole list; it now
+  ends "...2 more".
+- **A filtered `rails_get_turbo_map` judges each stream against the whole
+  app.** A `controller:` filter called a stream unheard, and warned about
+  it, when its subscribers were in another controller's views.
+- **`rails_session_context` keeps a conversation's latest 200 queries, each
+  long param shortened, and says how many it dropped.** One client could
+  grow the server's memory without limit, and an answer echoed a 100 KB
+  argument back in full.
+- **Source a tool shows has its secrets filtered, as search results did.**
+  `rails_search_code` and `rails_get_edit_context` filtered a literal key
+  from the lines they showed, while an action's source in
+  `rails_get_controllers` (and the methods and params methods it calls), a
+  concern's methods, a callback's body, a template in `rails_get_view` and
+  `rails_get_partial_interface`, a test file in `rails_get_test_info`, a
+  job's guard clauses, a `rails_security_scan` code line and the
+  `controllers/{name}/{action}` and `views/{path}` resources showed the same
+  line as written.
+- **`rails_get_controllers` and the `controllers/{name}/{action}` resource
+  find an action a concern or a parent controller gives.** Rails counts
+  every public method of an `ApplicationController` concern among each
+  controller's actions; the action list takes one only where a route names
+  it, so a lookup by name of an unrouted one answered "not found". The
+  answer now reads it from the file that defines it and names the parent
+  controller (`inherited_from` in the resource). A callback, a predicate, a
+  method that takes an argument, or one a private def lower down hides is
+  still not an action. Under `--no-boot` the action list also takes a routed
+  method of a parent's concern, as the booted list did.
+- **An action a concern or a parent controller defines shows its source.**
+  `rails_get_controllers(controller:, action:)` read only the controller's
+  own file, so an action from an included concern (namespaced ones too) or
+  from a base controller answered "Could not extract source code" with an
+  absolute path. It now follows Ruby's lookup through the app's modules and
+  parent controllers and names the file the source came from, in both
+  tiers. The `rails-ai-context://controllers/{name}/{action}` resource,
+  described as the action's source and metadata, never carried the source;
+  it now has `file`, `lines` and `source`.
+- **A Rails 8 controller's concerns no longer list the route helpers Rails
+  mixes in.** `Rails::Engine::LazyRouteSet::MountedHelpers` appeared as a
+  concern of every controller in the booted `controllers` payload (the
+  `rails://controllers` resource and `.ai-context.json`), and not in the
+  static tier's.
+- **`tool --json` and `JSON=1 rails 'ai:tool[...]'` print the envelope and
+  nothing else.** Sidekiq's "connecting to Redis" line, and on the rake task
+  an initializer's `puts`, landed on stdout ahead of it. What the app prints
+  while it boots or a tool runs now goes to stderr, as under `serve`.
+- **An invalid tool argument is reported as one when the app's locale files
+  do not load.** With a locale file that did not parse, every invalid
+  argument came back as a JSON-RPC internal error with an I18n backtrace on
+  stderr, over stdio and HTTP. An exception that still escapes a tool is
+  named in one stderr line, its backtrace under `DEBUG`.
+- **A preset prints each tool's header above that tool's answer, on
+  stdout**, from the binary and the rake task; the headers went to stderr,
+  so a redirect of both streams put them out of order.
+- **A tool `skip_tools` turned off says so** on the CLI, the rake task and
+  the MCP server, which answered "Unknown tool" and "Tool not found".
+- **Every command answers `--help` and `-h`**, exit 0, where each failed with
+  Thor's "was called with arguments" (`inspect`'s naming `inspect_app`) and
+  `tool`/`preset` read the flag as a name. `doctor --no-boot` and
+  `serve --transport bogus` are refused in words, the transport before the
+  boot. `tool --list` in an app whose boot fails says so in one line. An
+  unknown param's suggestion keeps the form it was typed in.
+- **An unknown format is refused before any work, with every valid one named,
+  `all` included**: `rails 'ai:context_for[bogus]'` printed "Writing bogus
+  context file..." and then a raw `ArgumentError`.
+- **An unknown `context_mode` or `tool_mode` is refused** from
+  `CONTEXT_MODE`, the YAML and the initializer, where it was kept and read
+  as the default.
+- **The `ai:facts` footer names a command that gives the full JSON**,
+  `rails ai:context:json`, since `ai:inspect` prints a text summary, and the
+  `ai:inspect` table no longer pairs `.codex/config.toml` with
+  `rails ai:context:codex`.
+- **`ruby -W` prints no warning from the gem's own files.**
+- **`doctor` checks that each MCP config's command can start the server.** A
+  config passed when it parsed, so after `bundle remove rails-ai-context`
+  every `bundle exec rails-ai-context serve` entry still read as valid, an
+  in-Gemfile app whose `.mcp.json` ran the bare binary was told it
+  "activates via bundler", and a `path:` copy without the executable passed
+  while `bundle exec` could not find it. Each entry is now checked without
+  starting it: `bundle exec` needs `bundle` on the PATH the client gives the
+  server, a lockfile (the one the entry's `BUNDLE_GEMFILE` names, if set)
+  that carries the gem, and a copy that lists its executable; a bare
+  `rails-ai-context` must be on that PATH, and in an app whose bundle
+  carries the gem it is a warning. The fix names the command to rerun, a
+  config that holds no rails-ai-context server says so, and a JSON config
+  that does not parse is named in the install's words.
+- **`doctor` checks the PATH a Codex env snapshot saved.** Codex starts the
+  server with only the env its config sets, and an rbenv or asdf snapshot
+  saves `PATH` alone, so checking `GEM_HOME` passed a snapshot whose Ruby
+  had been removed. Each snapshot's `PATH` now has to reach the command its
+  entry runs, in the app's config and in a folder-of-apps config above it,
+  and a failure names the directory that is gone and where to rerun
+  `rails-ai-context init`. A saved `GEM_HOME` has to exist too, and so does
+  each directory on a saved `GEM_PATH` that the shell's own `GEM_PATH` does
+  not name: RubyGems passes over a directory that is not there, and `init`
+  saves the shell's `GEM_PATH` again, so a warning about one could never
+  clear.
+- **A context file is out of date when a context run would rewrite it.**
+  `doctor` compared file times, so touching a model raised "CLAUDE.md may be
+  stale" and `rails ai:context`, which leaves unchanged files alone, could
+  not clear it; it ignored `output_dir`; and after an upgrade it called
+  files stamped with the old version up to date. It now runs the context
+  generation into a scratch copy, names the files it would write and why
+  (the version that wrote them, or the folders changed since), and the fix
+  it names clears it. The app's files are not touched.
+- **`doctor` reads pending migrations in every database.** Only the primary
+  was asked, so a pending migration for a second database passed. Each
+  database the environment configures is asked through its own connection,
+  as `db:migrate:status` does, without writing to it, the message names the
+  database, and the Migrations row counts every database's files.
+- **A development database that does not exist fails `doctor`.** It scored
+  93 and `--strict` exited 0. A Database row now fails, naming a database
+  that does not exist (fix: `bin/rails db:prepare`) or one that does not
+  answer, with the error.
+- **`doctor` reads the bundle, suite and code the tools read.** It reported
+  "Gemfile.lock not found" for an app whose `config/boot.rb` names a shared
+  Gemfile above it, and in an engine's `test/dummy` it counted only the
+  dummy's models, controllers, views and tests and found no migrations. It
+  now finds the lockfile as the tools do, counts the engine's code, suite
+  and migrations with the dummy's, and names the engine's root as the place
+  to run the db task it suggests.
+- **`doctor`'s secrets check is about the files that hold secrets.** Every
+  stock app was warned about committing `config/credentials.yml.enc`,
+  `config/database.yml`, `config/cable.yml` and `config/storage.yml`. A
+  committed key or env file (`config/master.key`,
+  `config/credentials/*.key`, `.env*` and the like) still fails; a config
+  such as `config/database.yml` warns only when it holds a literal password,
+  token or URL with a password, naming the key and line; encrypted
+  credentials are not reported.
+- **`doctor` agrees with the boot about a pinned dependency.** With
+  `prism 1.3.0` locked, the boot warned that the gem needs `>= 1.4` while the
+  Prism parser row passed, and the same held for `mcp` and the MCP server
+  row. Both rows now warn with the locked and needed versions and name
+  `bundle update <gem>` as the fix.
+- **`rails_validate` checks a Stimulus controller as the ES module it is.**
+  On Node 22, `node -c` exits 0 for any `.js` file that imports when its
+  package declares no type, broken or not, so every Stimulus controller
+  passed. The source now goes to node on stdin with its module type spelled
+  out, decided as Node decides it, and nothing is written next to the app.
+  A failure names the line, the column and node's message, where it printed
+  the first lines of node's output and cut the message off. Without node, a
+  file whose brackets balance is listed as skipped rather than passed, and
+  JSX is skipped rather than failed. `.mjs` and `.cjs` files are checked too.
+- **`rails_get_callbacks` lists the callbacks turbo-rails' broadcast macros
+  declare.** A model with `broadcasts_refreshes`, `broadcasts_to`,
+  `broadcasts` or `broadcasts_refreshes_to` read as having none of the commit
+  callbacks they add. Each is listed under its event as
+  `broadcasts_refreshes (turbo-rails)`, with the method turbo-rails runs at
+  `detail:"full"`, and `broadcasts_refreshes` is a macro on
+  `rails_get_model_details` too. `detail:"full"` also prints a block or
+  lambda callback's declaration, where it printed `[inline_block]` alone.
+- **A scope declared in a loop over a literal list is a scope.**
+  `KINDS.each { |k| scope k, -> { ... } }` gave no scope statically, and
+  booted the scopes read as class methods. Each element is now a scope,
+  tagged `[INFERRED]`.
+- **`rails_diagnose` calls a `NoMethodError` a nil reference only when the
+  receiver is nil.** On any other receiver it is an undefined method, and
+  booted, the answer names the receiver's closest method; a private method
+  is said to be private.
+- **`rails_diagnose` reads an error as a Rails log writes it.**
+  `Pundit::AuthorizationNotPerformedError (ProductsController)` came back as
+  `Error: Unknown`. Authorization not performed and authorization denied are
+  classified, and an error with no rule names the gem or app file that
+  defines its class.
+- **`rails_diagnose`'s log correlation finds the request.** It searched the
+  log's last 15 lines and printed the matching line alone. It now reads the
+  log's last megabyte and shows the latest entry: path, action, parameters,
+  status, request id, the error and the first frames, all redacted. It says
+  so when there is no entry.
+- **`rails_dependency_graph` counts only an `as:` declaration as implementing
+  a polymorphic interface, and lists foreign-key cycles only.** An
+  association and its inverse were listed as a cycle, sixteen of them on an
+  app with none; when there are none the answer now says so.
+- **`rails_get_concern` lists private methods and `helper_method`, and says
+  when an include is conditional.** On a booted app, a conditionally
+  included module that is not defined is said never to have been mixed in.
+- **`rails_get_env` skips YAML comment lines and reads a block's literal
+  default.** A default in a `sensitive_patterns` file is said to be present
+  and unread, where a lone site read as having none.
+- **`rails_runtime_info` says its pool and cache are the MCP server
+  process's own.** It also names the shared store another environment keeps
+  the app's cache in.
+- **An in-Gemfile install from a copy outside git has its executable.** The
+  gemspec listed its files with `git ls-files`, which lists nothing outside a
+  checkout, so a `path:` entry pointing at a vendored or unpacked copy left
+  the gem without `rails-ai-context` and every MCP config's
+  `bundle exec rails-ai-context serve` failed to start. Outside a checkout
+  the files on disk are the list.
+- **`rails_review_changes` shows what a migration's tables hold now.** Each
+  affected table's line was the first line of `rails_get_schema`, which is
+  its heading (`products: ## Table: products`); it is now the table's
+  current columns, or "not in the schema yet" for one the migration
+  creates. The routes line drops the heading marks it carried.
+- **A folder of apps keeps its MCP configs true as apps come and go**
+  (#429). Folders named outside ASCII all make the name `app`, so the gem
+  numbered its own entries (`rails-ai-context-app-2`) and then never
+  recognised them: when one app went, the other kept a second server, or
+  one naming a folder that was gone. A numbered name of the gem's own is
+  now dropped like any other. An app folder that starts with a dash is
+  written `./-api`, where `--app-path -api` read as an option and the
+  server never started. A folder named in Latin-1 crashed `init` with
+  "invalid byte sequence in UTF-8"; JSON and TOML hold UTF-8 alone, so that
+  app is now left out of the folder's configs, with a message, and the
+  other apps' entries are written. A config holding comments is named for
+  them under json 3 too, which refuses comments json 2 passed over, where
+  it was blamed on a trailing comma.
+- **Commands the binary prints read as a person would type them.** A path
+  holding a space or a character a shell reads is single-quoted, letters
+  outside ASCII stay as they are (`--app-path 'my apps/шоп'`, where every
+  one was backslashed), and a path that starts with a dash is spelled from
+  the current directory. The several-apps refusal says `<folder> is no
+  Rails app, and holds 2 below it`. The boot-failure hint and the static
+  tier's banner name the doctor command as the binary was run, with its
+  `--app-path` and under `bundle exec` when it ran so: a workspace's
+  server runs with `--app-path`, and a bare `doctor` where its client
+  stands finds the folder of apps.
+- **The pre-commit hook checks a staged file whatever its name.** git
+  quotes a name holding a character outside ASCII, a quote or a backslash
+  in the list the hook read, so no `.rb` test matched it and the file went
+  unchecked: a broken `db/seeds/brokén.rb` committed. Names are now read
+  NUL-separated. validate takes its files comma-separated, so a name
+  holding a comma is named and left unchecked rather than passed in two
+  halves. With several apps in one hook each app's lines are headed by its
+  name, and the second app's question asks to add it. The question and the
+  hook say what it checks - that the staged Ruby, ERB and JavaScript files
+  parse - where
+  they promised hallucinated columns and missing models, which a commit
+  never checked.
+- **The binary runs an app's own copy of the gem when its bundle has one.**
+  In an app whose Gemfile carries rails-ai-context at another version or
+  from a `path:` copy, the global binary loaded its own files before the
+  boot and the bundle's over them: "already initialized constant" warnings,
+  and a command that ran half of each copy (`version` said one release, the
+  server announced another). It now runs the command as
+  `bundle exec rails-ai-context` would, from where it was typed, and says
+  so on stderr: that is the copy the app's MCP configs start. Only a run
+  that boots the app does so, since the boot runs the app's bundle anyway:
+  `--no-boot` stays on the installed copy, as bundle exec would evaluate
+  the app's Gemfile and start whatever copy the app names, code nobody has
+  read on a repo just cloned. `init` asks its questions on the installed
+  copy and has the app's copy write only the context files, so an
+  MCP-only setup, by flag or at the prompt, runs nothing of the app's, and
+  the MCP configs it writes are not written again from the bundle's
+  environment. A
+  bundle not installed yet is left alone too (`bundle check` says so), so
+  its failed boot still serves the static tier. The bundle is the one a
+  `BUNDLE_GEMFILE` you set names (a dual boot's `Gemfile.next`), and a
+  command typed in a subdirectory, or in a folder holding the one app,
+  runs from the app root, where a released copy, which does not look for
+  the root, finds the app. Hints that name another command (`doctor`,
+  `facts`' pointer to `inspect`) name it as typed: no `bundle exec` the
+  user did not type, the `--app-path` they did.
+- **The binary loads no gem the app pins before the app boots.** Run from a
+  subdirectory of an app (#427) or a folder holding one, it asked of every
+  directory it passed whether a non-Rails framework lived there, which
+  parsed the Gemfile with the prism gem; it read config/boot.rb the same
+  way. A Rails 8 app locks prism, json and securerandom, so a version
+  other than the newest installed loaded over ours at the boot: dozens of
+  "already initialized constant" lines, then a mixed library. The Gemfile
+  and config/boot.rb are now read with Ruby's own Ripper before the boot,
+  a directory is checked for a framework only once it holds an app, and
+  json, strscan and securerandom load when first used.
+- **The install summary names a preset that exists:** it suggested
+  `rails 'ai:preset[arch]'`, which answers "Unknown preset". It is
+  `ai:preset[architecture]`.
+- **Commands run from a subdirectory of an app find the app** (#427), the way
+  `bin/rails` and Bundler do: the nearest directory above with
+  `config/application.rb`, `config/environment.rb` or a `bin/rails` that
+  boots an app or an engine. A packwerk pack, `$HOME`, `node_modules`,
+  `vendor/bundle` and a gem install are walked past, never stopped at. The
+  app is named on stderr, so `serve` keeps stdout clean.
+- **Commands run from a folder of apps say which they could read** (#428):
+  one app below is used, several are refused with the exact `--app-path`
+  command for each, and `tool --list` still lists.
+- **`init --app-path` sets up the app it names** (#424). The config, every MCP
+  config and the `.gitignore` entries went to the current directory and the
+  context files to the named app; from a directory that is no app, it
+  refused outright. The commands it prints afterwards name the app the same
+  way. Under `bundle exec`, a command that reads an app other than the
+  bundle's says it boots against that bundle, and the install form every
+  file names - the MCP command, the commands in context files and tool
+  hints - is read from the app's own Gemfile.lock, not the bundle's.
+- **`tool --list --app-path` lists the app's custom tools** (#426). It never
+  booted the named app, so tools from its initializer were missing.
+- **A wrong `--app-path` inside an app names the app**, and a relative one
+  that misses because the client started inside an app names the folder it
+  was written for.
+- **The install generator offers the pre-commit hook in a submodule, a
+  monorepo app and under `core.hooksPath`** (#425). It looked for a `.git`
+  directory in the app root and skipped the step silently otherwise; the
+  hooks directory is now git's own answer. A monorepo's hook validates each
+  app's staged files from inside that app, from a linked worktree too, and
+  installing in a second app adds it to the same hook. A deleted file no
+  longer blocks the commit: there is nothing left to validate, and an
+  exported `CDPATH` cannot send the hook into another folder of the same
+  name. Running the generator again brings a hook an earlier version wrote,
+  and nobody changed since, up to date. A `core.hooksPath` outside the
+  repository, which every repository using it shares, a repository that does
+  not track the app (a dotfiles repository at `$HOME`), and any other hook
+  that runs `rails-ai-context` are left alone with a message.
+- **The pre-commit hook starts a `path:` copy of the gem from a submodule
+  or a linked worktree.** git hands every command a hook runs the
+  committing repository's `GIT_DIR` and `GIT_INDEX_FILE`, and the gemspec's
+  `git ls-files` read that repository: in an app kept as a submodule the
+  gem's file list was the app's, and every commit failed with "can't find
+  executable rails-ai-context". The gemspec now asks git about its own
+  directory alone.
+- **An app with a Gemfile and no lockfile yet is read by what its Gemfile
+  names.** It counted as an in-Gemfile install, so a fresh clone that never
+  named the gem got `bundle exec` commands that could not start. A Gemfile
+  that pulls in others (`eval_gemfile`, `gemspec`) still counts as one.
+- **Codex's config keeps the tables around the gem's own.** A server section
+  ran on into the next table when no blank line separated them, so updating
+  it replaced the user's table too; a comment above the next table now stays
+  with it, a section a formatter wrapped over several lines is still read as
+  the gem's, values are written as TOML strings rather than Ruby literals, a
+  file with Windows line endings keeps them, a byte order mark no longer
+  hides the first section, and one that is not ASCII is read whatever the
+  locale, by `doctor` too.
+- **A JSON config the install cannot write back faithfully is left alone**,
+  with the entry to add by hand, said on the terminal: one that does not
+  parse (VS Code's and OpenCode's take trailing commas) was replaced by a
+  file holding only the gem's server, one with comments lost them, and one
+  that is JSON but not an object, or not UTF-8, raised out of the install. A
+  byte order mark at the head of a config is kept, where it cost the file
+  its contents, and an entry of the user's under the gem's own name - the
+  HTTP one SETUP.md describes - is kept in place of the gem's, where it was
+  overwritten. `doctor` says to make such a file valid JSON holding an
+  object before running the install again, where it called one that parsed
+  valid whatever it held.
+- **In a C or POSIX locale, a container's default, the binary reads paths
+  and files as UTF-8 when they are**, as Rails does once it boots. An app
+  folder or a folder of apps whose path holds characters outside ASCII, a
+  home directory holding them while the binary looked for the app, and an
+  initializer holding them stopped the binary with an encoding error. A
+  folder named in another encoding is read byte by byte, as before.
+- **A hand-written `app/models/AGENTS.md` or `app/controllers/AGENTS.md`
+  keeps its text.** With OpenCode or Codex selected, `rails ai:context`,
+  `rails-ai-context context`, the installer and `init` replaced the file
+  with the gem's listing without a word. These names are ones teams write
+  by hand, so they now follow the root files' rule: a file the gem
+  generated whole (it carries `> Auto-generated by rails-ai-context. Do not
+  edit manually.`) is rewritten whole, a file holding the markers gets only
+  its block replaced, and any other file keeps its text and gets the
+  listing between markers above it, with a note that claims the block
+  rather than the file. Dropping the AI tool takes out only that block.
+- **`tool_mode :cli` reaches every generated file.** The root files followed
+  it, but the split rule files and OpenCode's per-directory `AGENTS.md`
+  still said "ALWAYS use MCP tools" and "Use `rails_get_model_details` MCP
+  tool", the protocol's third rule named `rails_get_conventions`, the "All
+  45 tools" list gave MCP names, and the tools rule files called themselves
+  MCP tools in their Cursor description and Copilot name. In CLI mode each
+  of them names the command now (`rails 'ai:tool[model_details]'
+  model=Name`), the trim note included; MCP mode reads as before.
+- **A static-tier CLAUDE.md no longer shows an empty Architecture
+  heading.** Without a boot there is no conventions section, so the
+  heading stood over a blank line before the services and jobs it held
+  and read as a section that came up empty; the names now follow it
+  directly, and the blank line only separates them from a pattern list.
+- **The generated files count every database's tables and migrations.** In
+  an app with a second database, CLAUDE.md, AGENTS.md, `.cursorrules`,
+  copilot-instructions.md and the overview rule files counted the
+  primary's alone ("Migrations: 3 total" with 7 on disk), and
+  `.claude/rules/rails-schema.md` listed only the primary's tables, its
+  `paths:` missing `db/analytics_schema.rb` and `db/analytics_migrate/**`.
+  The Database and Migrations lines now name each other database after the
+  primary (`analytics: SQLite - 3 tables`, `analytics: 4 total, 1 pending`,
+  pending read from that database's dump as `rails_get_schema` reads it),
+  the schema rule lists each database's tables under its own heading and
+  triggers on each one's dump and migrations, and full mode's schema and
+  migrations sections cover them all. A database whose every table is
+  Solid Queue's, Solid Cache's or Solid Cable's, as a Rails 8 app's queue,
+  cache and cable are, is named for its framework in one phrase (`queue:
+  Solid Queue (13 tables)`); its tables, the framework's own, stay out of
+  the schema rule and full mode's dump, and its dump out of the rule's
+  `paths:`.
+- **Claude Code and Copilot read the tools guide once.** Both load the root
+  file and the always-on tools rule file on every request, and both files
+  carried the whole guide and the protocol, about 95 lines twice. With root
+  files on, `.claude/rules/rails-mcp-tools.md` and
+  `.github/instructions/rails-mcp-tools.instructions.md` now hold what the
+  root file leaves out, the detail levels and the table of every tool, and
+  point to it for the rest; with `generate_root_files` off they still carry
+  the whole guide. Cursor's agent-requested rule is unchanged.
+- **The models rule files no longer contradict the tools guide.** They said
+  "Read model files for business logic/methods" beside the guide's "NEVER
+  read reference files - ... model files"; they now say to read a model
+  file only when you edit it, the guide's own rule.
+- **A small `claude_max_lines` no longer cuts the tools guide.** Below
+  about 110 lines the budget was a hard cap that trimmed the file from the
+  end, so at 60 the four compact files kept the data and lost the
+  anti-hallucination protocol and the whole tool reference to one line and
+  the trim note, though the docs said those sections are kept whole. The
+  title block and the Commands, Warnings, Rules and Tools sections are now
+  never cut: the data sections between them go first, down to none, so
+  those sections set the smallest file a budget can give.
+- **Full mode keeps the anti-hallucination protocol and the tools guide.**
+  `context_mode :full` (`rails ai:context:full`, `CONTEXT_MODE=full`) wrote
+  CLAUDE.md, AGENTS.md and copilot-instructions.md without them, so OpenCode
+  and Codex, which load AGENTS.md alone, got neither, and `tool_mode` had no
+  effect on those files. Each now ends with the compact files' tools guide,
+  protocol included while `anti_hallucination_rules` is on; Copilot's gains
+  the behavioral rules the other two carry. The dump itself says what the
+  compact files already did: column defaults, indexes and foreign keys,
+  each model's concerns, scopes, callbacks, enum values and constants, and
+  the Stimulus controllers. It lists the app's routes as the count has
+  them, each PATCH/PUT pair one entry, and counts the framework's instead of
+  listing ~27 Active Storage, Action Mailbox and Turbo routes; a helper with
+  no methods no longer ends in a bare colon, and the Overview and Puma
+  headings appear only with something under them.
+- **A full-mode file names the command that regenerates it in full mode.**
+  Its last line said to run `rails ai:context`, which writes compact files
+  again unless `config.context_mode` is `:full`. It now says
+  `CONTEXT_MODE=full rails ai:context`, which keeps the AI tool selection
+  as `rails ai:context:full` does not; a standalone install, whose only
+  way into full mode is `context_mode: full` in `.rails-ai-context.yml`,
+  keeps `rails-ai-context context`. Copilot's full file shares the line.
+- **Every generated file states the route count the same way.** CLAUDE.md
+  said "12 app routes across 3 routed controllers (39 total incl.
+  framework)" while `.claude/rules/rails-context.md`,
+  `.cursor/rules/rails-project.mdc` and
+  `.github/instructions/rails-context.instructions.md` said "Routes: 39";
+  an app with no routes of its own read "0 app routes" beside "Routes: 27".
+  The rule files now print CLAUDE.md's line, from one place
+  (`RouteCoverage.summary`), as `rails ai:inspect` does.
+- **The tool guide's examples name the app's own model, controller and
+  files.** Every app's workflows said `rails_get_context(model:"Post")`,
+  `app/models/post.rb`, `PostsController`, `publishable?` and
+  `shared/status_badge`, right beside the rule never to name what a tool
+  call has not verified, so an app of Authors and Books read them as its
+  own. They now use the app's most connected model, its controller, a
+  template and a partial it renders and a method its source defines, and
+  an obvious placeholder (`YourModel`) where the app has none. The tools
+  table's mailers row says `mailer:"X"` like the rest, where it said
+  `UserMailer`.
+- **The tool guide names tools as `tools/list` does.** It sent the AI to
+  `get_schema` and `get_model_details` and called `get_context` the power
+  tool, none of which exists, and the `rails_diagnose` example put a
+  backtick inside its code span, which cut it in two.
+- **The generated files count, list and document the tools the server
+  serves.** `config.skip_tools` and `config.custom_tools` reached the server
+  and the CLI but not the context files: with two tools skipped and one
+  added, CLAUDE.md said 45, listed both skipped tools, and its tools table
+  offered `rails 'ai:tool[query]'`, which answers "Unknown tool", while the
+  custom tool went unmentioned. Every count, the name list and the tools
+  table now read the server's own set, a custom tool getting a row with the
+  first sentence of its description, and the installer's and `init`'s
+  summaries count the same. No workflow step, rule, protocol line or
+  pointer names a skipped tool either: it is left out, or said without the
+  tool, so with `rails_get_context` skipped the model workflow starts from
+  `rails_get_model_details`, and with `rails_validate` skipped no file asks
+  the AI to validate with it.
+- **With `config.output_dir` set, the OpenCode per-directory files say why
+  they were not written.** They are written only into a directory that
+  exists, since OpenCode reads them beside the code, and the run reported
+  `app/models not present` for an app that has one; it is the output
+  directory that lacks it, and the reason now says `no app/models under
+  output_dir`.
+- **The split rule files end with a newline.** The fourteen files under
+  `.claude/rules/`, `.cursor/rules/`, `.github/instructions/` and
+  `app/*/AGENTS.md` stopped at their last character, so an editor or an
+  end-of-file fixer rewrote each one and git flagged it. Files written by
+  an earlier version are rewritten once.
+- **A context file whose markers do not pair up is left as it is.** A lost
+  `<!-- END rails-ai-context -->` had a fresh section prepended and the old
+  one kept below it, so CLAUDE.md carried the gem's section twice from then
+  on. With a marker missing, a second pair pasted in or END before BEGIN,
+  nothing says where the gem's section ends, so a run now writes nothing to
+  that file and names it `unpaired rails-ai-context marker, left as it is`.
+  A regenerated section keeps a double backslash, where it was written as
+  one.
+- **`rails_query` refuses a `DO $$ … $$` block as a statement it does not
+  run**, not as "multiple statements": a semicolon inside a string or a
+  block body is data now, and one between two statements is still caught.
+- **`rails_query` says when the row limit held rows back.** A capped result
+  gave no sign the query had more; every format now ends with a note naming
+  the limit, in CSV after a blank line so a parser still reads clean rows.
+- **`rails_query` bounds a MariaDB query with `max_statement_time`.**
+  MariaDB ignores MySQL's `MAX_EXECUTION_TIME` hint, so `query_timeout` did
+  nothing there and `SELECT SLEEP(8)` ran to the end, holding the
+  connection. The statement is now wrapped in MariaDB's own `SET STATEMENT
+  max_statement_time = <seconds> FOR …`, which leaves nothing on the pooled
+  connection, and a cut query says "Query exceeded N second timeout".
+- **The selection record changes only what moved.** `init`, `rails
+  ai:context` and the generator rewrote `.rails-ai-context.yml` through
+  `to_yaml`, dropping every comment, and re-indented `config.ai_tools` in
+  the initializer. They now edit `ai_tools`, `tool_mode` and
+  `context_files` in place, keep comments, and write nothing when no value
+  changed.
+- **The generated initializer passes a new Rails app's Rubocop**, and its
+  comments say what the code does.
+- **The installer writes the context files in the mode it was just given.**
+  A first install in CLI mode wrote files describing MCP tools via `rails
+  ai:serve`.
+- **Install and context summaries name files from the app root, or from
+  where the command was typed** (`init --app-path ../b` prints
+  `../b/.mcp.json`), never as absolute paths. The `rm -f` line for the
+  v5.0.0 leftover rule files does the same, so pasting it removes them.
+- **`init` asks every question before it boots the app, and writes nothing
+  until the app's bundle is set up**; an MCP-only setup boots nothing. With
+  an app that pins an older `json`, `init` printed four "already
+  initialized constant" warnings; it prints none.
+- **`init` and `context` write Codex's environment as the binary was
+  started**, not with the `GEM_HOME` and bundle `bin` directory the app's
+  boot put into the process.
+- **Dropping an AI tool says what was kept and what was deleted** ("Kept
+  AGENTS.md - Codex CLI uses it too", "Removed opencode.json
+  (rails-ai-context was its only server)"), and a dot-directory the cleanup
+  emptied is removed.
+- **Switching to CLI mode offers to take the gem out of the MCP configs**,
+  and the CLI-mode summary no longer lists `.codex/config.toml`. The
+  initializer is named whenever one of its lines moved, in `init` and on
+  the first `rails ai:context`, which also records an MCP-only answer where
+  it used to ask again on every run.
+- **Install summaries say only what applies**: re-runs show the current
+  selection, only tools not yet picked are offered, there is no standalone
+  pitch inside a bundle, the Codex gitignore hint appears only when it
+  applies, an MCP-only install lists no `rails ai:context`, and
+  `--defaults` no longer says "No tools selected". The setup answer is
+  confirmed in the words the question offered it, and an unchanged file
+  reads `(unchanged)` in every line.
+- **`rails ai:context:<tool>` writes that tool's MCP config in MCP mode**,
+  and the binary's `context` keeps the MCP configs current as `rails
+  ai:context` does: after `bundle remove rails-ai-context`, configs that
+  started `bundle exec` are rewritten to the binary.
+- **The installer run at a mountable engine's root installs into that
+  root.** It writes no initializer the host apps would run, no context
+  files under `test/dummy`, and no hook calling a task the engine lacks,
+  and it reports its MCP config once. The context files and the tools'
+  hints there name `bundle exec rails-ai-context`, since `rails ai:serve`
+  and `rails 'ai:tool[...]'` exist only in the dummy app. `doctor` reads
+  that install, run as `bin/rails app:ai:doctor` or as
+  `bundle exec rails-ai-context doctor` at the engine's root (which now
+  checks the dummy app `bin/rails` boots instead of refusing), and its fixes
+  name the commands that run there (a command of the dummy app's own, in
+  `test/dummy`). It names every path from where it was
+  typed: at the engine's root, the dummy app's files as `test/dummy/...` and
+  the engine's own as `Gemfile.lock` and `app/views`; typed inside
+  `test/dummy`, from `../..`.
+- **The standalone binary uses a `listen` installed beside it** for
+  `watch` and for `serve`'s live reload, behind a `listen` the app's bundle
+  locks, and `doctor` checks the same one. Where there is none, a
+  standalone install is told `gem install listen`, and `serve` says each
+  tool call still checks for changed files.
+- **Routes the app's own route files declare are app routes.**
+  `devise_for` and the `rails/health` check were hidden as framework
+  routes, so `rails_get_routes(controller: "devise/sessions")` answered "No
+  routes"; a controller filter now finds its routes. The static tier draws
+  no `new` or `edit` route for an API-only app, and the routes heading
+  names the actions that skip a filter.
+- **Model details name the `devise` modules**, and Mongoid model details
+  name the collection and the fields Mongoid adds.
+- **Next-step hints name only controllers the app has**, and under
+  `tool_mode: :cli` they name the command, not an MCP call.
+- **N+1 risks follow a loaded collection into the loops and partials that
+  walk it**, instead of matching an association name anywhere in any view,
+  and each risk names its view.
+- **`rails_get_config` no longer calls a hand-written Authentication
+  concern the Rails 8 generator.**
+- **The migration advisor warns about what the app's migrations already
+  hold**: a pending migration that adds the column, a colliding migration
+  name, `create_table` on an existing table, `null: false` with no default
+  on a table with rows, and an unknown type ("Did you mean string?").
+  Self-references use `to_table:`, and dropping a column lists the code
+  that names it.
+- **`rails_get_schema` reads pending migrations from the connection**
+  (an unmigrated database no longer reads "Pending migrations: none"),
+  keeps each model on its own database's table, and marks encrypted, array
+  and generated columns. A MySQL boolean default reads `true` or `false` on
+  Rails 8.0 and 8.1, and SQLite row counts stop at a cap instead of
+  reading every table whole.
+- **`rails_get_context` counts the instance variables a `before_action`
+  sets.**
+- **`rails_validate level:"rails"` keeps its Brakeman findings when an app
+  file does not parse**, and `DEBUG=1` no longer floods stderr from
+  Brakeman, in validate and security_scan alike.
+- **`rails_search_code` shows the first match under a low
+  `max_search_results`**; `definition` and `class` searches read a regex,
+  and `definition` finds a name anywhere in a method name.
+- **`rails_analyze_feature`** lists Sidekiq workers, a service's own public
+  methods and the files that call it, finds a model's test anywhere in the
+  suite, and writes `after_commit (on: :create)`.
+- **`rails_get_test_info`'s RSpec template uses shoulda-matchers only when
+  the app bundles it.**
+- **`rails_generate_test`** gives an existing test file the cases to add,
+  gives a job a job test, signs a controller test in with the app's helper
+  behind a login filter (or says it must), invents no params for a
+  controller with no strong params, and writes a real system test for
+  `type: "system"`.
+- **`rails_get_partial_interface` finds Turbo Stream, broadcast and
+  jbuilder render sites** and jbuilder locals, lists a partial's render
+  sites by the format each one looks up, and lists no helper as a local;
+  `rails_get_view` lists those partials. A call names a format the way
+  Rails reads one, as `formats:` among the options it renders with: a
+  `format:` passed to the partial, or any key inside `locals:`, is a local,
+  and so is every key of `render "shared/date", date: d, format: :short`.
+- **Render maps and frame sources keep their closing brackets.**
+- **`rails_get_turbo_map` wires a stream by the records and names it is
+  built from**, says "can't tell" for what it cannot resolve, and says when
+  a stream filter matches nothing.
+- **`rails_get_stimulus`'s markup** wires actions to the events the app's
+  views use, leaves out change callbacks and the controller's own helpers,
+  and adds class and outlet attributes.
+- **`rails_get_controllers`** says when an action needs a controller and
+  which controller a bare name resolved to, answers for
+  ApplicationController, counts template formats, and lists the implicit
+  `format.turbo_stream` render.
+- **A 100 KB argument is answered at once and echoed shortened**, where
+  `rails_analyze_feature` took 14 seconds and echoed it whole. v5.32.2
+  repeated such an argument whole in 62 answers across 29 tools, among them
+  the not-found and invalid-value answers of `rails_search_docs`,
+  `rails_get_component_catalog`, `rails_get_concern`,
+  `rails_review_changes`, `rails_generate_test`, `rails_get_controllers` and
+  `rails_get_context`; each now shows its first 80 characters and its
+  length. `rails_migration_advisor`, which wrote the argument into the
+  migration twice over, refuses a name longer than 256 characters and
+  options longer than 1,024. A `rails_review_changes` ref too long to hand
+  git at all (128 KB on Linux, some 32,000 characters on Windows) is an
+  unknown ref, where the answer was the error starting git raised.
+- **`rails_onboard` counts every database the app declares**, naming the
+  framework's own databases in one line; it and
+  `rails_get_frontend_stack` count every broadcast, and onboard includes
+  STI payment subclasses.
+- **`rails_get_conventions`' create skeleton checks permission the app's
+  way** and keeps controller namespaces.
+- **`rails_get_edit_context`'s not-found answer no longer offers the same
+  path back.**
+- **The documented engine mount loads where the gem is not.** README,
+  GUIDE and SETUP showed a mount that raised `NameError` in production
+  with the gem in the development group, and after the gem was removed.
+  They now show `mount RailsAiContext::Engine, at: "/mcp" if
+  defined?(RailsAiContext::Engine)`.
+- **`serve --transport http` stops on SIGTERM or Ctrl-C every time and
+  exits 0.** About one stop in five hung once a client had connected:
+  Puma's graceful stop ran inside the signal handler and deadlocked. A
+  request still running is cut off after 3 seconds, and `bin/rails
+  ai:serve_http` no longer prints `bin/rails aborted! SignalException`.
+- **`rails server` stops with an MCP client connected to the mounted
+  engine.** The engine answers the server-push GET with 405 instead of
+  holding a thread per client.
+- **Each HTTP client keeps its own session record**, and a
+  `rails_session_context` reset clears the caller's alone. The record holds
+  the call the client made, not the tools a composite tool called inside
+  it, and `mark` refuses an empty mark or one naming no tool.
+- **The HTTP error frame is JSON even when the app's `to_json` raises**
+  (Rails 7.0-8.0 with json 3).
+- **`auto_mount` answers while a migration is pending**; the mounted
+  engine, inside routing, still does not, as the docs say.
+- **The `http_bind` warning and docs say what a non-loopback bind
+  serves.**
+- **`rails_read_logs` works on logs with non-ASCII lines.** On Ruby before
+  3.4 the redaction patterns raised `RegexpError` on such a line, breaking
+  read_logs and `rails_diagnose`'s log section. `search:` now reaches back
+  through the last 4 MB of a log and says how many lines it searched, where
+  it searched only the last `lines` lines.
+- **The view resource labels a template by the language of its source**,
+  where every view read was `text/html`.
+- **A resource read for a name the app does not have fails with JSON-RPC
+  -32602**, naming the URI and the names that exist, where it came back as
+  a successful read holding an `error` key.
+- **A commented MCP config reads the same under json 3.** json 3 refuses
+  the comments json 2 passed over, so with it - what a new Rails 8.1 app
+  resolves - a `.vscode/mcp.json` holding a comment was reported on every
+  run as a file that does not parse, and doctor flagged it, even when its
+  entries were current. Configs are now read with comments allowed on every
+  json, so a current one is left alone as unchanged, and one that needs
+  new entries is still left as it is, since writing it back would drop the
+  comments.
+
 ## [5.32.2] - 2026-10-07
 
 ### Security