rails_console_ai 0.33.0 → 0.34.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8af25f720aae1fe703b947bdc860dcace9a13e2e1db61d9d698634fa46838e59
-  data.tar.gz: efc3b4c00ea66d941e5fb03c61543398fed5ffdde700c44c080ee5e8c8e09ad6
+  metadata.gz: 61fcabfed3f03e58e104b7c8b49b86ccf365db5dbae5e1dbf1f8f1b7e63d811c
+  data.tar.gz: ec844ca4e1251fb9c1f0c0172095050745ef9690a90defefbcded92eae0962f8
 SHA512:
-  metadata.gz: 0b8de788b6391a303815cd160fb57ce4300c33dfd3f66645ce31f9bb256de0922b7ce8d26fd05c23dc8802c80da6201ffb9935c89cfd82b94ebde609b1631733
-  data.tar.gz: 5c73d678909c5e950cff5191b506a72570c2eb50bd2d6f01602bfe63ec2fade56c94b88d91f6d487803b073abd7b3565c9b92c355f90f7e32be82e465b72b7f9
+  metadata.gz: f2294a51714714de69afcc908dccbcb8d5034999973c40b4533600579e8617efc1133ed918ed7925aa082a3afd5598335b5a09527d1a933b38a6ddbf8143d595
+  data.tar.gz: bce68674c9467a92eac6b7521e4f1e39f1d06c32b374f38f627513c7ab31bdda57a12a2e937654103a2322d075b594aa56b610cf2ad716f1965f1c2d6123cfad

data/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.34.0]
+
+- Add an `:in_process_requests` built-in safety guard that blocks in-process HTTP dispatch against the app itself — `ActionDispatch::Integration::Session` requests (the console `app` helper) and direct Rack dispatch (`Rails.application.call`) — for all verbs including GET, since these can hang the session thread indefinitely; allowlist entries are request paths
+- Create/update the session record with a `running` status before each turn's tool loop starts, so a turn that hangs or dies mid-loop still leaves a visible session record, and show each session's status in the admin sessions page
+- Make session logging drop attributes the sessions table doesn't have a column for yet, so a gem newer than the table degrades to a partial row instead of losing the insert
+- Fix the sessions page cost display after the pricing refactor
+
 ## [0.33.0]
 
 - Support Claude Opus 5 and make it the default model for the Anthropic and Bedrock providers

data/README.md

@@ -176,15 +176,17 @@ Safety guards prevent AI-generated code from causing side effects. When a guard
 
 ```ruby
 RailsConsoleAi.configure do |config|
-  config.use_builtin_safety_guard :database_writes  # blocks INSERT/UPDATE/DELETE/DROP/etc.
-  config.use_builtin_safety_guard :http_mutations    # blocks POST/PUT/PATCH/DELETE via Net::HTTP
-  config.use_builtin_safety_guard :mailers           # disables ActionMailer delivery
+  config.use_builtin_safety_guard :database_writes      # blocks INSERT/UPDATE/DELETE/DROP/etc.
+  config.use_builtin_safety_guard :http_mutations        # blocks POST/PUT/PATCH/DELETE via Net::HTTP
+  config.use_builtin_safety_guard :mailers               # disables ActionMailer delivery
+  config.use_builtin_safety_guard :in_process_requests   # blocks in-process requests against the app itself
 end
 ```
 
 - **`:database_writes`** — intercepts the ActiveRecord connection adapter to block write SQL. Works on Rails 5+ with any database adapter.
 - **`:http_mutations`** — intercepts `Net::HTTP#request` to block non-GET/HEAD/OPTIONS requests. Covers libraries built on Net::HTTP (HTTParty, RestClient, Faraday).
 - **`:mailers`** — sets `ActionMailer::Base.perform_deliveries = false` during execution.
+- **`:in_process_requests`** — blocks `ActionDispatch::Integration::Session` requests (the console `app` helper) and direct Rack dispatch (`Rails.application.call`). These run the app's full middleware stack inside the current process and can deadlock or hang the session thread indefinitely, so **all verbs are blocked, including GET**. Allowlist entries are request paths.
 
 ### Custom Guards
 

data/app/helpers/rails_console_ai/sessions_helper.rb

@@ -1,7 +1,7 @@
 module RailsConsoleAi
   module SessionsHelper
     def estimated_cost(session)
-      pricing = Configuration::PRICING[session.model]
+      pricing = Configuration.pricing_for(session.model)
       return nil unless pricing
 
       (session.input_tokens * pricing[:input]) + (session.output_tokens * pricing[:output])

data/app/views/layouts/rails_console_ai/application.html.erb

@@ -35,6 +35,11 @@
     .badge-one_shot { background: #d4edda; color: #155724; }
     .badge-interactive { background: #cce5ff; color: #004085; }
     .badge-explain { background: #fff3cd; color: #856404; }
+    .badge-status-running { background: #fff3cd; color: #856404; }
+    .badge-status-queued { background: #e2e3e5; color: #383d41; }
+    .badge-status-ready { background: #d4edda; color: #155724; }
+    .badge-status-failed { background: #f8d7da; color: #721c24; }
+    .badge-status-aborted { background: #f8d7da; color: #721c24; }
     .meta-card {
       background: #fff; border-radius: 8px; padding: 20px;
       box-shadow: 0 1px 3px rgba(0,0,0,0.1); margin-bottom: 24px;

data/app/views/rails_console_ai/sessions/index.html.erb

@@ -17,6 +17,7 @@
         <th>Name</th>
         <th style="max-width: 400px;">Query</th>
         <th>Mode</th>
+        <th>Status</th>
         <th>Tokens</th>
         <th>Cost</th>
         <th>Duration</th>
@@ -31,6 +32,7 @@
           <td><%= session.name.present? ? session.name : '-' %></td>
           <td class="query-cell"><a href="<%= rails_console_ai.session_path(session) %>" title="<%= h session.query.truncate(200) %>"><%= truncate(session.query.gsub(/\s+/, ' ').strip, length: 80) %></a></td>
           <td><span class="badge badge-<%= session.mode %>"><%= session.mode %></span></td>
+          <td><% status = session.try(:status) %><%= status.present? ? content_tag(:span, status, class: "badge badge-status-#{status}") : '-' %></td>
           <td class="mono"><%= session.input_tokens + session.output_tokens %></td>
           <td class="mono"><%= format_cost(session) %></td>
           <td class="mono"><%= session.duration_ms ? "#{session.duration_ms}ms" : '-' %></td>

data/lib/generators/rails_console_ai/templates/initializer.rb

@@ -72,6 +72,13 @@ RailsConsoleAi.configure do |config|
   # Built-in guard for mailers — disables ActionMailer delivery:
   # config.use_builtin_safety_guard :mailers
   #
+  # Built-in guard for in-process requests — blocks ActionDispatch::Integration::Session
+  # (the console `app` helper) and direct Rack dispatch against the running app.
+  # These run the full middleware stack inside this process and can hang the session
+  # thread indefinitely, so ALL verbs are blocked (including GET). Strongly recommended
+  # for Slack/API channels:
+  # config.use_builtin_safety_guard :in_process_requests
+  #
   # config.safety_guard :jobs do |&execute|
   #   Sidekiq::Testing.fake! { execute.call }
   # end

data/lib/rails_console_ai/configuration.rb

@@ -172,12 +172,13 @@ module RailsConsoleAi
     end
 
     # Register a built-in safety guard by name.
-    # Available: :database_writes, :http_mutations, :mailers
+    # Available: :database_writes, :http_mutations, :mailers, :in_process_requests
     #
     # Options:
     #   allow: Array of strings or regexps to allowlist for this guard.
-    #     - :http_mutations  → hosts (e.g. "s3.amazonaws.com", /googleapis\.com/)
-    #     - :database_writes → table names (e.g. "rails_console_ai_sessions")
+    #     - :http_mutations      → hosts (e.g. "s3.amazonaws.com", /googleapis\.com/)
+    #     - :database_writes     → table names (e.g. "rails_console_ai_sessions")
+    #     - :in_process_requests → request paths (e.g. "/health")
     def use_builtin_safety_guard(name, allow: nil)
       require 'rails_console_ai/safety_guards'
       guard_name = name.to_sym
@@ -188,8 +189,10 @@ module RailsConsoleAi
         safety_guards.add(:http_mutations, &BuiltinGuards.http_mutations)
       when :mailers
         safety_guards.add(:mailers, &BuiltinGuards.mailers)
+      when :in_process_requests
+        safety_guards.add(:in_process_requests, &BuiltinGuards.in_process_requests)
       else
-        raise ConfigurationError, "Unknown built-in safety guard: #{name}. Available: database_writes, http_mutations, mailers"
+        raise ConfigurationError, "Unknown built-in safety guard: #{name}. Available: database_writes, http_mutations, mailers, in_process_requests"
       end
 
       if allow

data/lib/rails_console_ai/conversation_engine.rb

@@ -242,6 +242,8 @@ module RailsConsoleAi
     end
 
     def execute_direct(raw_code)
+      @interactive_query ||= "> #{raw_code}"
+      log_interactive_turn(status: 'running')
       exec_result = @executor.execute_unsafe(raw_code)
 
       output_parts = []
@@ -260,14 +262,31 @@ module RailsConsoleAi
       end
       @history << { role: :user, content: context_msg, output_id: output_id }
 
-      @interactive_query ||= "> #{raw_code}"
       @last_interactive_code = raw_code
       @last_interactive_output = @executor.last_output
       @last_interactive_result = exec_result ? exec_result.inspect : nil
       @last_interactive_executed = true
+      log_interactive_turn(status: 'ready')
     end
 
+    # Wraps run_turn with session-row status tracking. The row is created/updated
+    # with status 'running' BEFORE the tool loop starts, so a turn that hangs or
+    # dies mid-loop (hung eval, OOM-killed pod, deploy) still leaves a visible
+    # session record instead of vanishing without a trace.
     def send_and_execute
+      log_interactive_turn(status: 'running')
+      status = run_turn
+      log_interactive_turn(status: status == :error ? 'failed' : 'ready')
+      status
+    rescue Interrupt
+      log_interactive_turn(status: 'ready')
+      raise
+    rescue StandardError
+      log_interactive_turn(status: 'failed')
+      raise
+    end
+
+    def run_turn
       begin
         result, tool_messages, last_llm_stats = send_query(nil, conversation: @history)
       rescue Providers::ProviderError => e
@@ -568,7 +587,7 @@ module RailsConsoleAi
 
     # --- Session logging ---
 
-    def log_interactive_turn
+    def log_interactive_turn(status: nil)
       require 'rails_console_ai/session_logger'
       session_attrs = {
         conversation:  @history,
@@ -580,6 +599,7 @@ module RailsConsoleAi
         executed:      @last_interactive_executed,
         console_output: @channel.respond_to?(:console_capture_string) ? @channel.console_capture_string : nil
       }
+      session_attrs[:status] = status if status
 
       if @interactive_session_id
         SessionLogger.update(@interactive_session_id, session_attrs)

data/lib/rails_console_ai/safety_guards.rb

@@ -364,6 +364,81 @@ module RailsConsoleAi
       }
     end
 
+    # Blocks in-process HTTP dispatch against the running app itself.
+    # An ActionDispatch::Integration::Session request (the console `app` helper,
+    # or a manually built integration session) runs the app's full middleware
+    # stack inside the current process and can deadlock or hang the session
+    # thread indefinitely — so ALL verbs are blocked, including GET.
+    module InProcessRequestBlocker
+      def process(*args, **kwargs, &block)
+        RailsConsoleAi::BuiltinGuards.check_in_process_request!(args[0], args[1])
+        super
+      end
+    end
+
+    # Backstop for the same hazard via direct Rack dispatch
+    # (e.g. Rails.application.call(env)), which bypasses Integration::Session.
+    module EngineCallBlocker
+      def call(env, *args)
+        if env.is_a?(Hash)
+          RailsConsoleAi::BuiltinGuards.check_in_process_request!(env['REQUEST_METHOD'], env['PATH_INFO'])
+        end
+        super
+      end
+    end
+
+    def self.check_in_process_request!(http_method, path)
+      return unless Thread.current[:rails_console_ai_block_in_process_requests]
+      return if Thread.current[:rails_console_ai_bypass_guards]
+
+      key = path.to_s
+      guards = RailsConsoleAi.configuration.safety_guards
+      return if !key.empty? && guards.allowed?(:in_process_requests, key)
+
+      label = [http_method.to_s.upcase, key].reject(&:empty?).join(' ')
+      raise RailsConsoleAi::SafetyError.new(
+        "In-process HTTP request blocked (#{label.empty? ? 'app dispatch' : label}). " \
+        "Dispatching a request through the app's own middleware stack from this session " \
+        "can hang the process indefinitely, even for GET. Do not retry via another route " \
+        "or Rack — call the controller's underlying service or model code directly instead.",
+        guard: :in_process_requests,
+        blocked_key: key.empty? ? nil : key
+      )
+    end
+
+    def self.in_process_requests
+      ->(&block) {
+        ensure_in_process_blocker_installed!
+        prev = Thread.current[:rails_console_ai_block_in_process_requests]
+        Thread.current[:rails_console_ai_block_in_process_requests] = true
+        begin
+          block.call
+        ensure
+          Thread.current[:rails_console_ai_block_in_process_requests] = prev
+        end
+      }
+    end
+
+    def self.ensure_in_process_blocker_installed!
+      return if @in_process_blocker_installed
+
+      begin
+        require 'action_dispatch'
+        require 'action_dispatch/testing/integration'
+      rescue LoadError, NameError
+        nil # actionpack not (fully) available — the Engine backstop may still apply
+      end
+
+      if defined?(ActionDispatch::Integration::Session) &&
+         !ActionDispatch::Integration::Session.ancestors.include?(InProcessRequestBlocker)
+        ActionDispatch::Integration::Session.prepend(InProcessRequestBlocker)
+      end
+      if defined?(Rails::Engine) && !Rails::Engine.ancestors.include?(EngineCallBlocker)
+        Rails::Engine.prepend(EngineCallBlocker)
+      end
+      @in_process_blocker_installed = true
+    end
+
     def self.ensure_http_blocker_installed!
       return if @http_blocker_installed
 

data/lib/rails_console_ai/session_logger.rb

@@ -32,7 +32,7 @@ module RailsConsoleAi
           opts = attrs[:options]
           create_attrs[:options] = opts.is_a?(String) ? opts : opts.to_json
         end
-        record = session_class.create!(create_attrs)
+        record = session_class.create!(filter_to_columns(create_attrs))
         record.id
       rescue => e
         msg = "RailsConsoleAi: session logging failed: #{e.class}: #{e.message}"
@@ -70,6 +70,7 @@ module RailsConsoleAi
         updates[:result]        = attrs[:result]         if attrs.key?(:result)
         updates[:error_message] = attrs[:error_message]  if attrs.key?(:error_message)
 
+        updates = filter_to_columns(updates)
         session_class.where(id: id).update_all(updates) unless updates.empty?
       rescue => e
         msg = "RailsConsoleAi: session update failed: #{e.class}: #{e.message}"
@@ -80,6 +81,17 @@ module RailsConsoleAi
 
       private
 
+      # Drop attrs the table doesn't have a column for, so a gem that's newer
+      # than the table (e.g. status added before RailsConsoleAi.migrate! ran)
+      # degrades to a partial row instead of losing the whole insert.
+      def filter_to_columns(attrs)
+        return attrs unless session_class.respond_to?(:column_names)
+        cols = session_class.column_names.map(&:to_s)
+        attrs.select { |k, _| cols.include?(k.to_s) }
+      rescue StandardError
+        attrs
+      end
+
       def table_exists?
         # Only cache positive results — retry on failure so transient
         # errors (boot timing, connection not ready) don't stick forever

data/lib/rails_console_ai/version.rb

@@ -1,3 +1,3 @@
 module RailsConsoleAi
-  VERSION = '0.33.0'.freeze
+  VERSION = '0.34.0'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_console_ai
 version: !ruby/object:Gem::Version
-  version: 0.33.0
+  version: 0.34.0
 platform: ruby
 authors:
 - Cortfr