rails-ai-context 5.36.3 → 5.36.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ecc8cfb0b751983a682c2a2c0bd2082216595b83f12f679d190506425d60ae48
-  data.tar.gz: e0674fed2e5f40ebe3f33166c59d9c17bcd5c5160352100cf8b38d87a73387a4
+  metadata.gz: d0dd31bd07cbfa7f5cb1e1232627cda1c7ea16f035f864d8db86e1f544bb3893
+  data.tar.gz: 92512c007d7fc751a59bf72b1f651fb2a6e58117bc47697e109c145cbd65b6cf
 SHA512:
-  metadata.gz: c78d50c7e050632c88f60e901a8805ed5d397f2f12fb9412fa7ac64af1ed3921ff776486a8e4912f0a5a531e6a90661ca6d7b35def872bc4cd11215bde2941b0
-  data.tar.gz: 0b597f6cc7372007cb84936ac62f2ca893791622c62a667ea4601b545c73a9719949f3abfc09fd8fe75fe2e143fb1bfa5a4bbf82ee47e4f5fca6d293392c5b9d
+  metadata.gz: 0d751847ce7745680c03f69a54077e1f8a1836c37e788d78ad5072792af68be4f7e531b98e5bc3b62159e8b297259d8ebc2649ee22c41b6150edc90e9faf0c69
+  data.tar.gz: a64566fdec0abb014195d48dcf81d2463a24b9c72addaec1254dcac0778e6f4190805baddfdf073ec2ca5b847fe4ebc4ba643de759b46fc5a16e13b586e80dab

data/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.36.4] - 2026-10-16
+
+### Added
+
+- **The standalone binary says when a newer release is out.** A copy installed
+  with `gem install` stayed at its version until someone thought to update it.
+  It now asks rubygems.org for the latest version at most once a day, in a
+  detached child process, and keeps the answer under `$XDG_STATE_HOME`
+  (`~/.local/state/rails-ai-context/latest`). A command run in a terminal prints
+  one line on stderr naming the Ruby to update under and the two commands to
+  run. The MCP server adds the line to its instructions and to the end of
+  `rails_onboard` for the agent to pass on, or asks for a restart when the new
+  version is already installed. `RAILS_AI_CONTEXT_NO_UPDATE_CHECK=1` turns it
+  off. It is off in CI, on a prerelease, for an older version run on purpose
+  (`_5.30.0_`) and in a copy the app's bundle runs. Nothing is installed for you.
+
+### Fixed
+
+- **The code reads prism 2 the way it reads prism 1.** prism's main branch
+  (2.0.0.rc1) parses with the running Ruby's grammar when it is given none,
+  replaced `MissingNode` with `ErrorRecoveryNode`, and leaves an unterminated
+  heredoc without a closing location. The gem now names the newest grammar
+  when it parses and lexes, reads either recovery node, and ends an
+  unterminated heredoc at its body. The gemspec still requires prism below 2.0.
+
 ## [5.36.3] - 2026-10-15
 
 ### Fixed

data/SECURITY.md

@@ -32,4 +32,4 @@ If you discover a security vulnerability in rails-ai-context, please report it r
 - **Migration input validation** - `rails_migration_advisor` validates table and column names as safe identifiers before generating migration code.
 - **Cache invalidation coverage** - Fingerprinter watches `app/components`, `package.json`, and `tsconfig.json` alongside models/controllers/views to prevent stale tool responses.
 - **Fetch size limits** - `rails_search_docs` caps fetched documentation content at 2MB to prevent memory exhaustion.
-- The gem makes outbound HTTPS requests only when `rails_search_docs` is called with `fetch: true` (to fetch Rails documentation from GitHub raw content). All other tools are offline.
+- The gem makes outbound HTTPS requests in two places. `rails_search_docs` fetches Rails documentation from GitHub raw content when called with `fetch: true`. The standalone binary (installed with `gem install`, not through the app's Gemfile) asks `https://rubygems.org/api/v1/versions/rails-ai-context/latest.json` for the latest version at most once a day, in a child process that sends nothing about the app, and writes the answer to `rails-ai-context/latest` under `$XDG_STATE_HOME` (`~/.local/state`). `RAILS_AI_CONTEXT_NO_UPDATE_CHECK=1` turns it off; it is off in CI and in a copy the app's bundle runs. All other tools are offline.

data/docs/COMPATIBILITY.md

@@ -340,6 +340,12 @@ Proof sources:
    with Rails 7.0 and 7.2, Ruby 3.3 with Rails 7.1, Ruby 3.4 with Rails 8.0 and
    8.1, and Ruby 4.0 with Rails 8.1; and the unit suite and the E2E harness on
    Linux, macOS and Windows.
+   In the v5.36.4 release QA: the update check run as the installed binary on
+   Ruby 3.1, 3.3, 3.4 and 4.0 against rubygems.org, through a terminal and over
+   MCP stdio on a fixture app, a large private app booted and another in the
+   static tier, with the app's pinned json and net-http still loaded; the
+   suite on prism 1.4.0 and on prism main under Ruby 3.2 and 3.4; and the unit
+   suite and the E2E harness on Linux, macOS and Windows.
 2. Non-crash coverage for every built-in tool including `get_view` in
    `spec/e2e/in_gemfile_install_spec.rb`'s full-tool sweep; output correctness
    (ivar cross-check, render-form detection, partial interfaces) verified

data/docs/CONFIGURATION.md

@@ -266,6 +266,7 @@ server entry's `env`.
 | Variable | Read by | Effect |
 |:---------|:--------|:-------|
 | `RAILS_AI_CONTEXT_BOOT_TIMEOUT` | Every command that boots the app, and the `ai:serve`, `ai:serve_http` and `ai:tool` rake tasks | Seconds a boot may take before it counts as failed; a command that can then answers from the static tier. Default 20 for `serve` over stdio and `rails ai:serve`, whose client waits about 30 seconds for its first answer, and 60 for everything else. A value that is not a whole number warns and keeps the default |
+| `RAILS_AI_CONTEXT_NO_UPDATE_CHECK` | The standalone binary | Any non-empty value turns off the daily check for a newer release on rubygems.org. The check also stays off in CI, on a prerelease and in a copy the app's bundle runs |
 | `RAILS_AI_CONTEXT_SERVER_NAME` | The MCP server | The name it announces for one process, in place of the default `server_name`; a `server_name` the app sets wins. A workspace's MCP entries set it |
 | `DEBUG` | Every command and the MCP server | Any value prints the backtrace of a failed boot, a failed command and an exception that escapes a tool, and names the errors a fallback swallows |
 | `RAILS_ENV`, `RACK_ENV` | Every command | The Rails environment to boot, read the way Rails reads it; `--environment` sets it for one command. Default `development` |

data/docs/SECURITY.md

@@ -18,7 +18,7 @@
 1. **Read-only by design** - All 35 tools are annotated as non-destructive in the MCP protocol
 2. **Defense in depth** - Multiple security layers, not single points of failure
 3. **Sensitive data blocking** - Configurable patterns prevent access to secrets
-4. **Offline by default** - No network calls except optional `rails_search_docs` with `fetch: true`
+4. **Offline except where named** - No network calls except optional `rails_search_docs` with `fetch: true`, and the standalone binary's daily version check against rubygems.org (`RAILS_AI_CONTEXT_NO_UPDATE_CHECK=1` turns it off)
 5. **Graceful degradation** - Missing optional dependencies don't expose errors or state
 
 ---

data/docs/STANDALONE.md

@@ -140,6 +140,26 @@ Codex CLI is special - it `env_clear()`s the process before spawning MCP servers
 
 If you switch Ruby versions, re-run `rails-ai-context init` to update the snapshot.
 
+## Updating
+
+A gem installed with `gem install` stays at its version until you update it:
+
+```bash
+gem update rails-ai-context
+rails-ai-context init --defaults   # in each app: brings its MCP configs and context files up to the new version
+```
+
+Each Ruby has its own copy, so update under the Ruby your AI client starts the
+server with. Restart the AI client afterwards so its MCP server runs the new copy.
+
+The binary checks rubygems.org for a newer release at most once a day, in the
+background. When there is one, a command run in a terminal says so on stderr,
+and the MCP server tells the agent to pass it on, in its instructions and at the
+end of `rails_onboard`. A server reads the answer the check left the last time,
+so the first check shows up from the next start. `RAILS_AI_CONTEXT_NO_UPDATE_CHECK=1` turns the check off.
+It stays off in CI and in a copy the app's bundle runs, where the lockfile picks
+the version.
+
 ## Switching between standalone and in-Gemfile
 
 You can switch freely:

data/exe/rails-ai-context

@@ -201,7 +201,10 @@ class RailsAiContextCLI < Thor
     # One answer for any command's failure; Thor's refusals and SystemExit pass through.
     no_commands do
       def invoke_command(command, *args)
-        super
+        start_update_check
+        result = super
+        check_for_update
+        result
       rescue Thor::Error
         raise
       rescue StandardError, ScriptError => e
@@ -319,6 +322,7 @@ class RailsAiContextCLI < Thor
       # No Thor default: it would overwrite the config file's http_port.
       ::RailsAiContext.configuration.http_port = options[:port] if options[:port]
 
+      start_update_check&.refresh(env: STARTING_ENV)
       ::RailsAiContext.start_mcp_server(transport: transport)
     end
 
@@ -1326,6 +1330,29 @@ class RailsAiContextCLI < Thor
       nil
     end
 
+    # A notice on a terminal only: stdout may be piped, and an agent reads rails_onboard's copy instead.
+    def check_for_update
+      check = start_update_check or return
+      check.refresh(env: STARTING_ENV)
+      note = check.notice unless check.told?
+      $stderr.puts note if note && $stderr.tty?
+    rescue StandardError, ScriptError
+      nil
+    end
+
+    # Only this copy run outside a bundle checks; under bundle exec the app's lockfile picks the version.
+    # Started before the command, while Gem.path is still the one an app's boot replaces.
+    def start_update_check
+      return if STARTING_ENV["BUNDLE_BIN_PATH"]
+
+      @start_update_check ||= begin
+        require_relative "../lib/rails_ai_context/update_check"
+        ::RailsAiContext::UpdateCheck.tap(&:enable!)
+      end
+    rescue StandardError, ScriptError
+      nil
+    end
+
     # Stdlib only, so it is safe to load before the app boots.
     def entry_boot
       @entry_boot ||= begin

data/lib/rails_ai_context/ast_cache.rb

@@ -80,14 +80,14 @@ module RailsAiContext
     # A one-shot parse that stores nothing: for a scan reading thousands of
     # files once, whose entries would only evict what other readers reuse.
     def self.parse_uncached(source)
-      Prism.parse(source)
+      Prism.parse(source, version: NEWEST_GRAMMAR)
     end
 
     # Whether a file parses under `ruby:`'s grammar, with no tree built or
     # kept: the check before a loader requires each file it walks.
     def self.parse_success?(path, ruby: nil)
       version = prism_version(ruby)
-      version ? Prism.parse_file_success?(path, version: version) : Prism.parse_file_success?(path)
+      Prism.parse_file_success?(path, version: version || NEWEST_GRAMMAR)
     end
 
     # Parse a Ruby source string, cached by content digest, so every extractor
@@ -112,6 +112,8 @@ module RailsAiContext
     private_class_method :content_key
 
     OLDEST_GRAMMAR = "3.3"
+    # Named, because prism 2 parses with the running Ruby's grammar when given none.
+    NEWEST_GRAMMAR = "latest"
     GRAMMARS = Concurrent::Map.new # major.minor => whether the loaded prism parses it
 
     # The grammar prism parses `ruby` with: its own major.minor, the oldest prism
@@ -134,7 +136,7 @@ module RailsAiContext
     private_class_method :supported?
 
     def self.prism_parse(source, version)
-      version ? Prism.parse(source, version: version) : Prism.parse(source)
+      Prism.parse(source, version: version || NEWEST_GRAMMAR)
     end
     private_class_method :prism_parse
 

data/lib/rails_ai_context/introspectors/listeners/base_listener.rb

@@ -122,7 +122,7 @@ module RailsAiContext
         end
 
         def lex(text)
-          Prism.lex(text).value.map(&:first)
+          Prism.lex(text, version: AstCache::NEWEST_GRAMMAR).value.map(&:first)
         rescue StandardError
           []
         end

data/lib/rails_ai_context/introspectors/listeners/queue_assignment_listener.rb

@@ -9,6 +9,9 @@ module RailsAiContext
       # and Que's `self.queue = "name"`, or a `def self.queue` returning one, which
       # Resque asks for when @queue is unset. A literal is kept as its value, anything else as source.
       class QueueAssignmentListener < BaseListener
+        # What a half-written `@queue =` parses its value as: MissingNode before prism 2, ErrorRecoveryNode from it.
+        RECOVERY_NODES = %i[MissingNode ErrorRecoveryNode].filter_map { |name| Prism.const_get(name) if Prism.const_defined?(name, false) }.freeze
+
         def initialize
           super
           @def_depth = 0
@@ -40,9 +43,8 @@ module RailsAiContext
 
         private
 
-        # A half-written `@queue =` parses with a MissingNode value.
         def record(node, value, form)
-          return if value.is_a?(Prism::MissingNode)
+          return if RECOVERY_NODES.any? { |type| value.is_a?(type) }
 
           literal = value.is_a?(Prism::SymbolNode) || value.is_a?(Prism::StringNode)
           @results << { form: form, queue: literal ? value.unescaped : nil, source: value.slice,

data/lib/rails_ai_context/introspectors/node_source.rb

@@ -18,12 +18,12 @@ module RailsAiContext
       # @return [String] the node's slice, followed by the body of every
       #   heredoc it opens whose body lies past its end
       def text(node)
-        trailing = heredocs(node).select { |doc| doc.closing_loc.end_offset > node.location.end_offset }
+        trailing = heredocs(node).select { |doc| body_end(doc).end_offset > node.location.end_offset }
         return node.slice if trailing.empty?
 
         first = trailing.min_by { |doc| body_start(doc).start_offset }
-        last = trailing.max_by { |doc| doc.closing_loc.end_offset }
-        "#{node.slice}\n#{body_start(first).join(last.closing_loc).slice}"
+        last = trailing.max_by { |doc| body_end(doc).end_offset }
+        "#{node.slice}\n#{body_start(first).join(body_end(last)).slice}"
       end
 
       def heredocs(node)
@@ -40,9 +40,14 @@ module RailsAiContext
       def body_start(doc)
         if doc.respond_to?(:content_loc) then doc.content_loc
         elsif doc.parts.any? then doc.parts.first.location
-        else doc.closing_loc
+        else body_end(doc)
         end
       end
+
+      # The terminator; an unterminated heredoc has none from prism 2 on, and ends with its body.
+      def body_end(doc)
+        doc.closing_loc || (doc.content_loc if doc.respond_to?(:content_loc)) || doc.parts.last&.location || doc.location
+      end
     end
   end
 end

data/lib/rails_ai_context/server.rb

@@ -273,11 +273,15 @@ module RailsAiContext
     # code changed (BaseTool.stale_code_note).
     def self.instructions
       intro = "Ground truth engine for Rails apps. Live Prism AST introspection."
-      return "#{intro} Answers follow edits to the app's files." if CodeReloader.reloadable? || RailsAiContext.static_tier?
-
-      "#{intro} Answers follow edits to the app's files, except what reflection reads, such as associations: " \
-        "RAILS_ENV=#{RailsAiContext.environment_name} does not reload code, so that stays as of boot, and every " \
-        "answer says when app code changed since."
+      text = if CodeReloader.reloadable? || RailsAiContext.static_tier?
+        "#{intro} Answers follow edits to the app's files."
+      else
+        "#{intro} Answers follow edits to the app's files, except what reflection reads, such as associations: " \
+          "RAILS_ENV=#{RailsAiContext.environment_name} does not reload code, so that stays as of boot, and every " \
+          "answer says when app code changed since."
+      end
+      note = UpdateCheck.agent_note
+      note ? "#{text} #{note}" : text
     end
 
     # Anything that still escapes a tool (schema validation bugs, SDK-level

data/lib/rails_ai_context/tools/onboard.rb

@@ -46,7 +46,8 @@ module RailsAiContext
         else
           compose_standard(ctx)
         end
-        text_response(body, suffix: introspection_warnings_note(ctx))
+        update = RailsAiContext::UpdateCheck.agent_note
+        text_response(body, suffix: [ introspection_warnings_note(ctx), ("\n\n---\n#{update}" if update) ].compact.join)
       end
 
       class << self

data/lib/rails_ai_context/update_check.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+require "rbconfig"
+require_relative "version"
+
+module RailsAiContext
+  # Tells the copy `gem install` put on PATH that rubygems.org has a newer
+  # release. Only the gem's own binary, run outside a bundle, turns it on
+  # (enable!), so a copy an app's bundle loads never checks: its lockfile
+  # decides the version.
+  #
+  # Core Ruby only. The binary loads this before the app boots, and requiring
+  # net/http or json here would activate the newest installed versions over
+  # the ones the app's lock pins. The fetch runs in a detached child instead,
+  # at most once a day, and the version it writes is what the next check reads.
+  module UpdateCheck
+    OPT_OUT_ENV = "RAILS_AI_CONTEXT_NO_UPDATE_CHECK"
+    URL = "https://rubygems.org/api/v1/versions/rails-ai-context/latest.json"
+    INTERVAL = 24 * 60 * 60
+
+    FETCH = <<~RUBY
+      require "net/http"
+      path, url = ARGV
+      uri = URI(url)
+      response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https", open_timeout: 5, read_timeout: 5) do |http|
+        http.get(uri.request_uri)
+      end
+      version = response.body[/"version"\\s*:\\s*"([^"]+)"/, 1] if response.is_a?(Net::HTTPSuccess)
+      exit unless version
+      tmp = "\#{path}.\#{Process.pid}"
+      begin
+        File.write(tmp, version)
+        File.rename(tmp, path)
+      ensure
+        File.delete(tmp) if File.exist?(tmp)
+      end
+    RUBY
+
+    module_function
+
+    # Called before an app's boot, which swaps Gem.path for the bundle's.
+    def enable!
+      @enabled = true
+      @gem_dirs = Gem.path
+      newest_at_start
+    end
+
+    # The notice for an agent to pass on. Giving it marks it told, so the CLI does not print it again.
+    def agent_note
+      note = notice or return
+      @told = true
+      "Tell the user: #{note}"
+    end
+
+    def told?
+      @told == true
+    end
+
+    def disabled?
+      !@enabled || !ENV[OPT_OUT_ENV].to_s.empty? || ci? || Gem::Version.new(VERSION).prerelease?
+    end
+
+    # Starts the fetch when the last one is a day old (or in the future, after a
+    # clock change). The file's time is set first, so a failed fetch waits a day
+    # too. Its own process group keeps a Ctrl-C at the terminal from killing it.
+    # @param env [Hash] the environment the binary started in, before an app's boot changed it
+    def refresh(env:)
+      return if disabled?
+
+      path = state_file
+      age = Time.now - File.mtime(path) if File.exist?(path)
+      return if age&.between?(0, INTERVAL)
+
+      make_dirs(File.dirname(path))
+      File.open(path, "a") { nil }
+      File.utime(nil, nil, path)
+      group = Gem.win_platform? ? { new_pgroup: true } : { pgroup: true }
+      pid = Process.spawn(env, RbConfig.ruby, "-e", FETCH, path, URL,
+                          unsetenv_others: true, in: File::NULL, out: File::NULL, err: File::NULL, **group)
+      Process.detach(pid)
+    rescue StandardError
+      nil
+    end
+
+    # One sentence for the user, or nil when this copy is current.
+    def notice
+      return if disabled?
+
+      latest = latest_release or return
+      running = Gem::Version.new(VERSION)
+      return unless latest > running
+      # A newer copy installed when this process started means an older one was run on purpose (`_5.30.0_`).
+      return if newest_at_start && newest_at_start > running
+
+      installed = newest_installed
+      if installed && installed >= latest
+        "rails-ai-context #{installed} is installed, but this process still runs #{VERSION}. " \
+          "Restart the MCP server (or the AI client) to load it."
+      else
+        "rails-ai-context #{latest} is out; this is #{VERSION} on Ruby #{RUBY_VERSION} (#{RbConfig.ruby}). " \
+          "Under that Ruby run `gem update rails-ai-context`, then `rails-ai-context init --defaults` in each app. " \
+          "#{OPT_OUT_ENV}=1 turns this check off."
+      end
+    end
+
+    def latest_release
+      text = File.read(state_file, 64).to_s.strip
+      return if text.empty? || !Gem::Version.correct?(text)
+
+      version = Gem::Version.new(text)
+      version unless version.prerelease?
+    rescue StandardError
+      nil
+    end
+
+    def state_file
+      home = Gem.respond_to?(:state_home) ? Gem.state_home : (ENV["XDG_STATE_HOME"] || File.join(Gem.user_home, ".local", "state"))
+      File.join(home, "rails-ai-context", "latest")
+    end
+
+    # The newest copy installed for this Ruby, in any directory of the gem path.
+    def newest_installed
+      Array(@gem_dirs).flat_map { |dir| Dir[File.join(dir, "specifications", "rails-ai-context-*.gemspec")] }.filter_map do |spec|
+        number = File.basename(spec, ".gemspec").delete_prefix("rails-ai-context-")
+        Gem::Version.new(number) if Gem::Version.correct?(number)
+      end.max
+    end
+
+    def newest_at_start
+      return @newest_at_start if defined?(@newest_at_start)
+
+      @newest_at_start = newest_installed
+    end
+
+    def ci?
+      defined?(Gem::CIDetector) ? Gem::CIDetector.ci? : !ENV["CI"].to_s.empty?
+    end
+
+    # Dir.mkdir one level at a time: fileutils is a gem an app may pin.
+    def make_dirs(dir)
+      return if Dir.exist?(dir)
+
+      make_dirs(File.dirname(dir))
+      Dir.mkdir(dir)
+    rescue Errno::EEXIST
+      nil
+    end
+  end
+end

data/lib/rails_ai_context/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsAiContext
-  VERSION = "5.36.3"
+  VERSION = "5.36.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-ai-context
 version: !ruby/object:Gem::Version
-  version: 5.36.3
+  version: 5.36.4
 platform: ruby
 authors:
 - crisnahine
@@ -560,6 +560,7 @@ files:
 - lib/rails_ai_context/tools/session_context.rb
 - lib/rails_ai_context/tools/validate.rb
 - lib/rails_ai_context/tools/validate_semantics.rb
+- lib/rails_ai_context/update_check.rb
 - lib/rails_ai_context/version.rb
 - lib/rails_ai_context/vfs.rb
 - lib/rails_ai_context/view_file.rb