rails-ai-context 5.36.7 → 5.36.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8498e25402e035ed53ab2c0dff9dff31da4c849e616632069891de80f38ff7f4
-  data.tar.gz: 92dac2339bbe11cc0486ad449f8b84fd5fe840d15c31e56414b53b9b0d7e9fbc
+  metadata.gz: 8cd401837a164e83cf1558e5ff9ed491e0409974c9ffae9d4b648e56b4e4fb68
+  data.tar.gz: 1667e185eba134e006450acd3edf19ffe1e590b3a6033608db25ad60e529e87a
 SHA512:
-  metadata.gz: d06dccf666aa9a2ca94e8a42f5191a9d7cf98f2a8f9799f6ab0afa941c6d4e397ecefe5aa71979bb91d6f667151345b161795bd81058a4e4810d5f29828e64eb
-  data.tar.gz: 324d72633467fc133a608d848fa3dce1f3f21cc600ab0a9d637288a5ba05f1f69c356aaf3a2871a5217a5c4498787a279695554d8c08ff80af303ba1a8857984
+  metadata.gz: ef8df079d4306b933571f8a01f697a0ca8c6e96b663b71894e065760fc72eb5ffca09a0a07471722afb684e805258ad05c60676f28a7f68599f591e1f955ec67
+  data.tar.gz: 7edafa2842e04597cbc61786c8ee67c7e8c74ab312ce9c75c6d0bc711bf0f496deff280e45984c5104e08b229ec7ba16b6d7dd822990f133d77e945b923ec174

data/CHANGELOG.md

@@ -5,6 +5,101 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.36.8] - 2026-10-23
+
+### Security
+
+- **The static tier keeps the security settings the app's Ruby config writes.**
+  No initializer runs without a boot, so on the static tier (`--no-boot`, or a
+  boot that failed) a `sensitive_patterns`, `excluded_paths` or `skip_tools`
+  value set in a `RailsAiContext.configure` block was dropped, and a file the
+  block made sensitive was searched and read. The static tier now reads every
+  Ruby file of the app that names the gem, without running it: a file under
+  `config/`, and the top level of any other, whole, and a method's body
+  elsewhere (a tool's, a helper's) for what it writes, with tests, installed
+  gems and generator templates left out. The literal values those files write
+  to the three keys are added to the YAML's; a removal is left out, the
+  stricter reading. A value it cannot read, such as one built from a constant
+  or the environment, a pattern changed in place, or the configuration reached
+  through `send`, stops the static tier with an error that names the file and
+  line.
+- **A sensitive pattern covers its file wherever it sits.**
+  `config/database.yml` and the other patterns with a `/` matched only at the
+  app root, so an engine's, a pack's or a test/dummy app's copy was read by
+  every file tool, and `**/id_rsa` missed an `id_rsa` at the root. A pattern
+  now reads the way a `.gitignore` line does: one with a `/` names its file
+  below the root too, a leading `/` anchors it at the root, a trailing `/`
+  names a folder and everything in it, and `**/` stands for any number of
+  folders, none included.
+  A file a link brings in is also asked by its name in the app's repository, so
+  a link to a pack's `config/` folder cannot hide the `config/` a pattern looks
+  for. `doctor`'s gitignore check reads the files below the root the same way.
+  A path a caller names that is longer than 4096 bytes, which no file system
+  holds, is answered as not found before any pattern reads it.
+- **`rails_search_code` reads a path the way the file system does.** A path
+  with a `.` segment (`./`, `config/.`) made ripgrep print `./config/...`, and a
+  link inside the app to `config/` made it print the link's name, so no
+  sensitive pattern matched and a sensitive file's lines came back. The path is
+  now cleaned, and one inside the app is searched as the folder it leads to.
+- **`rails_search_code` and `rails_review_changes` keep a private key's body
+  hidden on every line they show.** A search row is redacted with its whole
+  file, but ripgrep searched files over `max_file_size`, which the redaction
+  does not read, so each body line of a PEM key in such a file came back on its
+  own, unfiltered. ripgrep now skips those files as the Ruby search does, and a
+  file named as the path over the limit answers "File too large". A diff hunk
+  that opened inside a key showed its body lines the same way; each diff line
+  is now redacted with the whole side of the file it comes from, the hunk
+  header's line too. The diff is read with the repository's colour, external
+  diff and textconv settings off, and a diff over `max_file_size` or a merge
+  conflict's combined diff shows no lines. A submodule's change shows as the
+  commits it moves between, where `diff.submodule=diff` printed its files'
+  lines unredacted. A changed file that is not UTF-8 is read, where the tool
+  stopped with an encoding error.
+- **`rails_read_logs` filters a secret column's value written inline in a
+  statement.** MySQL and MariaDB run no prepared statements, so Active Record
+  logs every value inline with backquoted names, and `insert_all` and
+  `upsert_all` write their rows inline on every adapter. Password hashes,
+  tokens and reset keys came back from INSERT, UPDATE and WHERE lines, from the
+  `CAST()` and `LOWER()` a uniqueness validation writes, and from the database
+  errors that repeat a row's values. A value compared with a secret column
+  (through a JSON path too), listed for it with `IN` or `BETWEEN`, inserted
+  under it, or bound to its placeholder is now filtered whatever quotes the
+  names and the value carry, and so is a value whose column cannot be told in a
+  statement that names a secret column, every value of an `INSERT` with no
+  column list, and a secret-named key in JSON a value holds. PostgreSQL's
+  failing row is filtered whole, as it names no column, MySQL's duplicate entry
+  unless Rails named the index after columns that hold no secret, PostgreSQL's
+  duplicate key when the key names a secret, and the statement excerpt a MySQL
+  syntax error quotes; a message cut off is filtered to the end of its line. A
+  JSON log line's strings are read the same way, a value under a secret's key
+  and a JSON logger's binds included.
+- **`rails_get_config(section: "env")` hides a DSN or a webhook URL wherever it
+  is set.** A Dockerfile `ENV` or `ARG` value, an `.env.example` value and a
+  default in code went through the generic redaction only, which reads a URL's
+  password but not a key before `@` or a token in the path, so a Sentry DSN or
+  a Slack webhook printed in full where the Kamal section hid the same value.
+  Those values now read `[FILTERED]` when their shape can carry a secret: a URL
+  whose user part is a key or a password, a webhook's address, a token in a
+  query, a key-like run of letters and digits, and a `BUNDLE_<HOST>` gem server
+  credential. Paths, hosts and local or public URLs still show. An
+  `.env.example` value in quotes keeps a `#`, where the part after it printed
+  as a comment, and an inline comment is hidden when it holds a secret's shape.
+- **`rails_get_view` and `rails_get_partial_interface` match a path as plain
+  text.** A missing view's folder and a partial's name were globbed as written,
+  so each `{a,b}` group doubled the work for every view file, and one crafted
+  path held a server thread for minutes.
+- **`rails_query` refuses a `PROCEDURE` clause on MySQL and MariaDB.**
+  MariaDB's `SELECT ... PROCEDURE ANALYSE()` returns each column's lowest and
+  highest values, lengths and null counts, a secret column's included, under
+  names of its own that the result redaction does not read. `SHOW PROCEDURE
+  STATUS` still runs.
+- **The patterns that find a URL's password, a JWT and an `sk-` key read a
+  line in time that grows with its length.** The URL pattern tried a scheme from
+  each letter of a run, and the JWT and `sk-` patterns read to a run's end from
+  every repeat in it, so a 100 KB log line or env value took 15 to 35 seconds. A
+  URL's password is now read from its `://`, after a shell default's `:-` too,
+  and a JWT and an `sk-` key are read so that a run of repeats costs its length.
+
 ## [5.36.7] - 2026-10-22
 
 ### Security

data/docs/COMPATIBILITY.md

@@ -366,6 +366,15 @@ Proof sources:
    security, gate, redaction and database specs on Rails 7.0 (Ruby 3.1), 7.1,
    7.2 and 8.1 against live PostgreSQL; and the unit suite and the E2E harness
    on Linux, macOS and Windows.
+   In the v5.36.8 release QA: each fix's example failing on the code before
+   it; `rails_read_logs` against Active Record 8.0's own logs from live
+   PostgreSQL 16, MySQL 8.4 and MariaDB 13 for inline values, binds and the
+   errors that repeat a row, and against a JSON logger's lines; the static-tier
+   settings reader, `rails_search_code`, `rails_get_config` and
+   `rails_review_changes` on five open-source apps and two private ones with
+   `--no-boot`, compared with v5.36.7 and every changed answer checked; the
+   touched specs on Rails 7.0 (Ruby 3.1) and on prism 1.4; and the unit suite
+   and the E2E harness on Linux, macOS and Windows.
 2. Non-crash coverage for every built-in tool including `get_view` in
    `spec/e2e/in_gemfile_install_spec.rb`'s full-tool sweep; output correctness
    (ivar cross-check, render-form detection, partial interfaces) verified

data/docs/CONFIGURATION.md

@@ -39,7 +39,7 @@ preset: full
 ### Precedence
 
 > [!IMPORTANT]
-> `configure` block > YAML > Defaults, merged key by key. The file is read once, at boot, before `config/initializers`, so an initializer may assign a key or edit it in place (`config.skip_tools << "rails_query"`) and both survive. A block that runs *before* the file - in `config/application.rb` or an environment file - must assign a key to keep it (`config.skip_tools = ["rails_query"]`), because an in-place edit there is replaced when the file loads. A key no block assigns keeps the YAML value. Corrupted YAML degrades gracefully with a warning, and a key the gem does not know warns on stderr and is ignored while the rest of the file applies.
+> `configure` block > YAML > Defaults, merged key by key. The file is read once, at boot, before `config/initializers`, so an initializer may assign a key or edit it in place (`config.skip_tools << "rails_query"`) and both survive. A block that runs *before* the file - in `config/application.rb` or an environment file - must assign a key to keep it (`config.skip_tools = ["rails_query"]`), because an in-place edit there is replaced when the file loads. A key no block assigns keeps the YAML value. Corrupted YAML degrades gracefully with a warning, and a key the gem does not know warns on stderr and is ignored while the rest of the file applies. On the static tier no initializer runs: the literal values that the app's Ruby files naming the gem write to `sensitive_patterns`, `excluded_paths` and `skip_tools` are read without running them and added to the YAML's, and one the gem cannot read stops the static tier with an error naming its file and line ([SECURITY.md](SECURITY.md#configuration)).
 
 ---
 

data/docs/SECURITY.md

@@ -57,6 +57,7 @@ Before any query reaches the database, the SQL gate (`RailsAiContext::SqlGate`)
 - **Blocks lock clauses**: FOR UPDATE, FOR SHARE, FOR NO KEY UPDATE, FOR KEY SHARE and LOCK IN SHARE MODE, with whatever follows them (NOWAIT, SKIP LOCKED, OF, WAIT). On PostgreSQL the clause is read on quote-masked text, so `LIKE '%ready for update%'` is data: its read-only transaction refuses a locking read anyway. MySQL's read-only transaction lets `FOR SHARE` and `LOCK IN SHARE MODE` through, so there and on SQLite the raw text decides
 - **Blocks SHOW forms that tell of other sessions, replication and logs, on MySQL and MariaDB**: `SHOW GRANTS`, `SHOW PROCESSLIST` and `SHOW FULL PROCESSLIST`, `SHOW BINLOG`, `SHOW BINARY LOGS` and `SHOW BINARY LOG STATUS`, `SHOW RELAYLOG EVENTS`, the `SHOW SLAVE` and `SHOW SLAVES` forms, `SHOW MASTER`, the `SHOW REPLICA` and `SHOW REPLICAS` forms, `SHOW ALL SLAVES STATUS` and `SHOW ALL REPLICAS STATUS`, `SHOW ENGINE ... STATUS`, `SHOW PROFILE` and `SHOW PROFILES`, `SHOW OPEN TABLES`, `SHOW EXPLAIN FOR` and `SHOW ANALYZE FOR`, `SHOW USER_STATISTICS`, `SHOW CLIENT_STATISTICS` and the `SHOW WSREP_` forms. The answer is "Blocked: sensitive SHOW command". They are matched on the raw text, so the words inside a string literal are refused too
 - **Blocks `EXPLAIN FOR CONNECTION`, on MySQL and MariaDB**: it shows the plan of the statement another session is running. It is refused also as `DESCRIBE` or `DESC`, with a `FORMAT`, and inside a version comment. The answer is "Blocked: EXPLAIN FOR CONNECTION is not run. It shows the plan of the statement another session is running." It is read on quote-masked text, so a string literal that holds the words runs
+- **Blocks a `PROCEDURE` clause, on MySQL and MariaDB**: MariaDB's `SELECT ... PROCEDURE ANALYSE()` returns each column's lowest and highest values, a secret column's too, under names of its own that the result redaction does not read. `PROCEDURE` is a reserved word there, so a bare one outside a `SHOW` statement is refused in any spelling, and `SHOW PROCEDURE STATUS` runs. The answer starts "Blocked: a PROCEDURE clause is not run."
 - **Blocks SHOW with a WHERE clause**, on every family. MySQL's statement timeout holds `SELECT` only, so a `SHOW ... WHERE` filter would run past `query_timeout`. `SHOW ... LIKE` runs. The answer names the query to use: "Blocked: SHOW with a WHERE clause is not run, because MySQL's statement timeout does not hold it. SHOW ... LIKE runs. For any other filter, SELECT from information_schema, for example `SELECT table_name FROM information_schema.tables WHERE table_schema = DATABASE()`."
 - **Blocks SELECT INTO**: prevents table creation via SELECT. After a `WITH` clause an `INTO` can belong to a write, and such a statement is answered as that write: `WITH ... INSERT INTO ...` answers "Blocked: contains INSERT", and `REPLACE` and `MERGE` are named the same way. `INTO OUTFILE` / `INTO DUMPFILE` disk writes, and the file and network functions below, stay matched on the **raw (unmasked) text**. No read-only transaction stops a server-side file write, so `INTO OUTFILE` inside a string literal is refused on every database family, and a file function inside one on the family that has it
 - **Blocks file and network functions**, each on the database family that has it. PostgreSQL: `pg_read_file`, `pg_read_binary_file`, `pg_ls_dir`, `pg_stat_file`, `lo_import`, `lo_export`, `dblink*` and their relatives. MySQL and MariaDB: `LOAD DATA` and `LOAD_FILE`. SQLite: `load_extension`. They are checked before and after comment stripping
@@ -357,6 +358,16 @@ A placeholder whose name ends in `.example`, `.sample`, `.template` or
 characters, still does, and so does a path pattern (one with a `/`, such as
 `.ssh/*`), which covers everything under it.
 
+A pattern reads the way a `.gitignore` line does. One with a `/` names its
+file below the root as well, so `config/database.yml` covers an engine's, a
+pack's and a test/dummy app's copy, and a leading `/` anchors it at the root. A
+trailing `/` names a folder and everything in it, and `**/` stands for any
+number of folders, none included, so `**/id_rsa` covers an `id_rsa` at the
+root too. A file a link brings in from the app's repository is also asked by
+its name there, so a link to a pack's `config/` folder cannot hide the
+`config/` a pattern looks for. A path a caller names that is longer than 4096
+bytes, which no file system holds, is answered as not found.
+
 ### AI context file exclusions
 
 Search also excludes generated AI context files to prevent circular references:
@@ -376,6 +387,28 @@ AGENTS.md, opencode.json
 config.sensitive_patterns = %w[.env* *.key *.pem credentials.yml.enc]
 ```
 
+On the static tier (`--no-boot`, or a boot that failed) no initializer runs.
+The gem reads every Ruby file of the app that names it (`RailsAiContext` or
+`rails_ai_context`), however the boot loads it, without running it: a file
+under a `config/` folder, and the top level and class bodies of any other file,
+which run as the file loads, whole; the body of a method outside `config/`, a
+tool's or a helper's that runs when called, for what it writes. Tests (a `spec/` or `test/` folder at any
+depth, an engine's test app among them), `db/`, `tmp/`, `vendor/bundle/`,
+`vendor/ruby/`, `vendor/cache/`, `vendor/gems/`, an installed copy of the gem, a
+generator's templates, hidden files and links are left out, and
+`config/initializers` and `config/environments` are read through a link as
+Rails globs them. The literal values those files write to
+`sensitive_patterns`, `excluded_paths` and `skip_tools` are added to the YAML's;
+a removal is left out. A value it cannot read, such as one built from a
+constant or the environment, the configuration handed to other code or
+reached through `send`, a pattern changed in place, or a file that does not
+parse, stops the static tier with an error that names the file and line;
+outside a method, so does a list or one of its patterns kept or handed on. A
+file outside the app, a list a method keeps and changes later, and code that reaches
+the settings through a name it builds at run time
+(`const_get("Rails" + "AiContext")`) are not followed.
+`.rails-ai-context.yml` is read on every tier.
+
 ---
 
 ## Path traversal protection
@@ -516,7 +549,7 @@ Complex patterns that would cause catastrophic backtracking raise `RegexpError`
 
 `SafeFile.read` provides drop-in safety for all file reads:
 
-- Size limit enforcement (`config.max_file_size`, default: 5 MB)
+- Size limit enforcement (`config.max_file_size`, default: 5 MB). `rails_search_code` skips a file over it on both backends, so a row is never shown without its whole file's redaction, and a file named as its path answers `File too large`
 - Returns `nil` on any failure (no exceptions leak)
 - UTF-8 encoding with invalid/undefined byte replacement
 - Handles: ENOENT, EACCES, EISDIR, ENAMETOOLONG, SystemCallError
@@ -532,6 +565,8 @@ What gets redacted:
 - Passwords, tokens, secrets and API keys, wherever they are named
 - The same in the app's own source a tool or resource shows: a method body, a template, a test file, a scan's code line, a change's diff (where a file on `sensitive_patterns` shows none of its lines)
 - Credentials embedded in URIs (`redis://user:pass@host`)
+- Values a logged SQL statement holds for a secret column: compared with it (through `LOWER()`, `CAST()` or a JSON path too), listed for it with `IN` or `BETWEEN`, inserted under it, or bound to a `$1` or `?` placeholder for it. MySQL and MariaDB log every value inline, and `insert_all` and `upsert_all` do on every adapter. A value whose column cannot be told is filtered when the statement names a secret column, and every value of an `INSERT` with no column list is filtered. A secret-named key in JSON a value holds is filtered, its quotes escaped or not. A line with `\'` in it that holds no backquoted name outside its strings is read both as MySQL and as standard SQL. Each string of a JSON log line, a header before it or not, is read as a line of its own; a value under a secret's key is filtered, an array's included, and so are a JSON logger's binds when the statement beside them names a secret column. A line is read on its own, so a value with a line break in it is read a line at a time
+- The values a database error repeats: PostgreSQL's failing row whole, since it names no column, and its duplicate key when the key names a secret; MySQL's and MariaDB's duplicate entry, unless Rails named the index after columns that name no secret (`index_users_on_email`); and the excerpt of the statement a MySQL syntax error quotes, whole. A message cut off is filtered to the end of its line. An error in a language other than English is read as any other line
 - Email addresses in log lines, in any script (`jürgen@example.com`, `anna@münchen.de`)
 - Values assigned to secret-named settings in initializers
 
@@ -596,7 +631,7 @@ The engine builds one transport per process, under a mutex, outside the controll
 ## Credential handling
 
 - `rails_get_config(section:"env")` returns credential **keys** and no values
-- The process's environment variable values are never read. A default written in code, and a placeholder from `.env.example`, `.env.sample` or `.env.template`, is shown after redaction
+- The process's environment variable values are never read. A default written in code, and a placeholder from `.env.example`, `.env.sample` or `.env.template`, is shown after redaction. A default in code, an example file's value and a Dockerfile `ENV` or `ARG` value read `[FILTERED]` when their shape can carry a secret: a URL whose user part holds a password or is a key (16 or more letters and digits, or hex in groups, as a DSN's is), a webhook's address, a token in a query, a run of 16 or more letters and digits with both in it, and a hex key split into groups. `/`, `.`, `-` and `_` end a run, so a path, a host and a slug show; so does a key written with them, base64 with a `/` among them, or in letters alone, unless its name says it is one. A class name with a digit in a run of 16 reads `[FILTERED]`. A `BUNDLE_<HOST>` variable, which Bundler reads a gem server's password from, is hidden whatever it holds. An example file's inline comment is hidden when it holds a credential, one of these shapes or a hex key in groups among its words, and a `#` starts a comment only after a space, so a password's `#` stays in its value (dotenv itself cuts an unquoted value at any `#`). A Kamal clear value that holds any URL, or a run of 16 letters and digits with `/` in it, is hidden
 - `config/credentials/*.yml.enc` is in the sensitive patterns list
 
 ---

data/docs/STANDALONE.md

@@ -117,7 +117,7 @@ A key the gem does not know warns on stderr and is ignored; the rest of the file
 
 ### Precedence
 
-In standalone mode `.rails-ai-context.yml` is the only config source. The gem is not loaded while `config/initializers` runs, so a `config/initializers/rails_ai_context.rb` contributes nothing: the generated file, which guards on `defined?(RailsAiContext) && RailsAiContext.respond_to?(:configure)`, is a silent no-op, and one without that guard raises `NoMethodError` (the binary opens the `RailsAiContext` namespace before the boot, so the constant exists but `configure` is not defined on it) and drops the command into the static tier.
+In standalone mode `.rails-ai-context.yml` is the only config source of a booted run. The gem is not loaded while `config/initializers` runs, so a `config/initializers/rails_ai_context.rb` contributes nothing there: the generated file, which guards on `defined?(RailsAiContext) && RailsAiContext.respond_to?(:configure)`, is a silent no-op, and one without that guard raises `NoMethodError` (the binary opens the `RailsAiContext` namespace before the boot, so the constant exists but `configure` is not defined on it) and drops the command into the static tier. On the static tier the gem reads the literal `sensitive_patterns`, `excluded_paths` and `skip_tools` values such a file writes, without running it ([SECURITY.md](SECURITY.md#configuration)).
 
 For in-Gemfile installs both sources apply and merge key by key - see [Precedence](CONFIGURATION.md#precedence).
 

data/docs/TOOLS.md

@@ -77,7 +77,7 @@ Search your codebase with regex, ripgrep acceleration, and sensitive file blocki
 | Parameter | Type | Default | Description |
 |:----------|:-----|:--------|:------------|
 | `pattern` | string | *required* | Regex pattern to search for. With `definition` or `class`, a plain method or constant name matches literally (`valid?`), anything else as a regex (`generate_.*`) |
-| `path` | string | - | Subdirectory or file to search (relative to Rails root); a file is searched whatever its type or ignore files say, as ripgrep does, unless it is sensitive |
+| `path` | string | - | Subdirectory or file to search (relative to Rails root); a file is searched whatever its type or ignore files say, as ripgrep does, unless it is sensitive or over `max_file_size` (`File too large`). A path through a link inside the app is searched as the folder it leads to |
 | `match_type` | enum | `any` | `any`, `definition` (def lines whose method name contains the pattern), `class` (class/module lines whose name contains it), `call`, `trace` |
 | `file_type` | string | - | Filter by extension (`rb`, `erb`, `js`, etc.) |
 | `exact_match` | boolean | `false` | Literal, whole-word match. `def reblog?` does not match `def reblog` |
@@ -566,7 +566,7 @@ ActiveSupport surface: concerns registry, deprecators, MessageVerifier/MessageEn
 
 #### `env` (was `rails_get_env`)
 
-Environment variables + credentials keys (values are never exposed). Scans `.rb`, `.rake`, ERB views and config YAML under `app`, `config` and `lib`, plus `config.ru`, `db/seeds.rb`, `db/seeds/` and the Ruby scripts in `bin/`. A tag on a YAML comment line is not read: ERB runs it, but what it writes goes with the comment. Config YAML matching `sensitive_patterns` (`config/database.yml`, `config/cable.yml`, `config/storage.yml` and the rest) is read only for the ENV names in its ERB tags, so a default there is listed as present and not read; credentials and keys are never read, and the answer says so. A default is read from a second argument or from a block whose one statement is a literal (`ENV.fetch("REDIS_URL") { "redis://localhost:6379/1" }`). The env Kamal's `config/deploy.yml` gives the app container is listed too: secret names only, and clear values, except one holding a URL or a key-like token, or under a secret-named variable, which shows as hidden, and one an ERB tag sets, which says so. So are the setting keys in the config gem's `config/settings.yml` and `config/settings/<env>.yml` when the bundle has the config gem, and the attributes of each `Anyway::Config` class in `config/configs` or `app/configs` with the env name it reads (`PAYMENT_API_KEY`), never their values. A variable whose call sites pass different defaults is labelled as such rather than with one site's default; `detail:"full"` names each site's. A default is redacted by the rule a source literal gets: a credential format under any name, a URL's password, and under a secret-named variable a value that is not clearly something else, so an address, URL or hostname default prints as written.
+Environment variables + credentials keys (values are never exposed). Scans `.rb`, `.rake`, ERB views and config YAML under `app`, `config` and `lib`, plus `config.ru`, `db/seeds.rb`, `db/seeds/` and the Ruby scripts in `bin/`. A tag on a YAML comment line is not read: ERB runs it, but what it writes goes with the comment. Config YAML matching `sensitive_patterns` (`config/database.yml`, `config/cable.yml`, `config/storage.yml` and the rest) is read only for the ENV names in its ERB tags, so a default there is listed as present and not read; credentials and keys are never read, and the answer says so. A default is read from a second argument or from a block whose one statement is a literal (`ENV.fetch("REDIS_URL") { "redis://localhost:6379/1" }`). The env Kamal's `config/deploy.yml` gives the app container is listed too: secret names only, and clear values, except one holding a URL or a key-like token, or under a secret-named variable, which shows as hidden, and one an ERB tag sets, which says so. A Dockerfile `ENV` or `ARG` value, an `.env.example` value and a default in code read `[FILTERED]` when their shape can carry a secret: a URL whose user part is a key or holds a password, a webhook's address, a token in a query, a key-like run of characters, or a `BUNDLE_<HOST>` gem server credential ([Credential handling](SECURITY.md#credential-handling)). An `.env.example` value in quotes keeps a `#`, and an inline comment is hidden when it holds a credential or one of those shapes. So are the setting keys in the config gem's `config/settings.yml` and `config/settings/<env>.yml` when the bundle has the config gem, and the attributes of each `Anyway::Config` class in `config/configs` or `app/configs` with the env name it reads (`PAYMENT_API_KEY`), never their values. A variable whose call sites pass different defaults is labelled as such rather than with one site's default; `detail:"full"` names each site's. A default is redacted by the rule a source literal gets: a credential format under any name, a URL's password, and under a secret-named variable a value that is not clearly something else, so an address, a hostname or a URL of none of the shapes above prints as written.
 
 #### `env_config` (was `rails_get_env_config`)
 
@@ -782,13 +782,13 @@ Each database other than the primary is reached through a connection handler of
 
 > Disabled in production by default.
 
-> Name the columns you need. A query is refused, with a message that says why, when it does one of these: it references a secret column (directly, or through an alias or expression; an `encrypts` column also when `query_allowed_columns` lists it); it serialises a whole row; it carries a column-alias list that renames a wildcard (a `VALUES`-body list such as `(VALUES (1,'a')) AS v(id, name)` is allowed, since it renames no table column); it uses UNION; it calls a session-effecting function, a function that returns a whole table as one value (`table_to_xml`), or any function by a quoted name; it reads a statistics, session or credential relation (`pg_stats`, `pg_stat_activity`, `pg_settings`, `performance_schema`, the `mysql` schema) or a PostgreSQL setting that can hold a password (`primary_conninfo`); it is a `SHOW` with a `WHERE` clause, `SHOW ALL` on PostgreSQL or `EXPLAIN FOR CONNECTION` on MySQL and MariaDB; or it is over 1,000,000 bytes long. `SELECT *` is allowed and its secret columns come back `[FILTERED]`. `SHOW CREATE TABLE` / `SHOW CREATE VIEW` are allowed and their definition text is secret-redacted; other `SHOW CREATE` forms are refused. In the default format a definition is shown whole, as the DDL in a fenced code block with its line breaks kept (a view's character set and collation follow as `name: value` lines); `csv` returns it as one quoted field. When the row limit holds rows back - only when the query really returned more than the cap - the answer says so in every format. With `csv`, a query that returns no rows answers the header row alone.
+> Name the columns you need. A query is refused, with a message that says why, when it does one of these: it references a secret column (directly, or through an alias or expression; an `encrypts` column also when `query_allowed_columns` lists it); it serialises a whole row; it carries a column-alias list that renames a wildcard (a `VALUES`-body list such as `(VALUES (1,'a')) AS v(id, name)` is allowed, since it renames no table column); it uses UNION; it calls a session-effecting function, a function that returns a whole table as one value (`table_to_xml`), or any function by a quoted name; it reads a statistics, session or credential relation (`pg_stats`, `pg_stat_activity`, `pg_settings`, `performance_schema`, the `mysql` schema) or a PostgreSQL setting that can hold a password (`primary_conninfo`); it is a `SHOW` with a `WHERE` clause, `SHOW ALL` on PostgreSQL, or `EXPLAIN FOR CONNECTION` or a `PROCEDURE` clause on MySQL and MariaDB; or it is over 1,000,000 bytes long. `SELECT *` is allowed and its secret columns come back `[FILTERED]`. `SHOW CREATE TABLE` / `SHOW CREATE VIEW` are allowed and their definition text is secret-redacted; other `SHOW CREATE` forms are refused. In the default format a definition is shown whole, as the DDL in a fenced code block with its line breaks kept (a view's character set and collation follow as `name: value` lines); `csv` returns it as one quoted field. When the row limit holds rows back - only when the query really returned more than the cap - the answer says so in every format. With `csv`, a query that returns no rows answers the header row alone.
 
 > **Cell rendering by format.** A `markdown` table cell shows `NULL` as `_NULL_`, escapes a pipe (`a\|b`) so it cannot end the cell, renders a line break as the two characters `\n` so it cannot end the row, and shortens a value over 100 characters to `…` (a `SHOW CREATE` definition is not a table cell, so it is never shortened). A `csv` cell is the value itself: `NULL` is an empty field, nothing is escaped beyond RFC 4180 quoting (a field holding a comma, a quote or a line break is wrapped in quotes with its quotes doubled), and nothing is truncated - so a line break stays a real line break inside the quoted field. Binary (non-text) data shows as `[BLOB]` in both.
 
 ### `rails_read_logs`
 
-Reverse file tail with level filtering and sensitive data redaction.
+Reverse file tail with level filtering and sensitive data redaction. A value an SQL statement holds inline is filtered when the column it meets is a secret, and so are the values a database error repeats ([Redaction](SECURITY.md#redaction)).
 
 | Parameter | Type | Default | Description |
 |:----------|:-----|:--------|:------------|
@@ -822,7 +822,7 @@ A changed migration lists the tables it affects: the table each schema method ta
 
 An app in a subfolder of its repository (a monorepo's `backend/`) is reviewed on its own: its changed files, named from the app root as `rails_validate` takes them, and the commits that touched it.
 
-Each diff passes through the redaction every tool's source does, read as the file it comes from, so a secret a change adds or takes out reads `[FILTERED]`, in a hunk header's line too. A changed file on `sensitive_patterns` (`config/database.yml`, `.env`, a key) is listed with its line counts and none of its lines.
+Each diff line is shown as the line of its side, redacted with the whole of that side the way every tool's source is, so a secret a change adds or takes out reads `[FILTERED]`, and so does a key's body in a hunk that opens inside the key, in a hunk header's line too. A changed file on `sensitive_patterns` (`config/database.yml`, `.env`, a key) is listed with its line counts and none of its lines, and so is one whose diff is over `max_file_size` and a merge conflict's combined diff. The diff is read with the repository's colour, external diff and textconv settings off, and a submodule's change shows as the commits it moves between.
 
 | Parameter | Type | Default | Description |
 |:----------|:-----|:--------|:------------|

data/lib/rails_ai_context/cli/entry_boot.rb

@@ -221,6 +221,8 @@ module RailsAiContext
         RailsAiContext.static_kind = kind
         RailsAiContext.configuration.app_root = root
         Configuration.auto_load!(root)
+        # No initializer runs here, so the security settings one writes are read from its source.
+        InitializerSettings.apply!(root)
         # A failed boot's reason is already the line above.
         messages << "[rails-ai-context] static tier active#{": #{reason}" unless kind == :boot_failed}"
         Outcome.new(tier: :static, reason: reason, kind: kind, messages: messages)

data/lib/rails_ai_context/doctor.rb

@@ -1529,8 +1529,11 @@ module RailsAiContext
       nil
     end
 
+    # Read as SafePath.sensitive? reads a pattern, so a file the tools refuse lands in the list that names it,
+    # an engine's or a test/dummy app's included.
     def matches_any?(patterns, file)
-      patterns.any? { |pattern| File.fnmatch(pattern, file, File::FNM_PATHNAME | File::FNM_DOTMATCH) }
+      basename = File.basename(file)
+      patterns.any? { |pattern| SafePath.compile_pattern(pattern).match(file, basename, file.downcase, basename.downcase) }
     end
 
     # Every file the tools refuse to read (the one sensitive-pattern list), plus the Codex