rosett-ai 1.5.12 → 1.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb0358498de4f1123fd29a3ae3e728712340a70772a5469a31d25048a4525aca
-  data.tar.gz: bbc11a0a29c5d4b8b14fe3c34e9d28ae93c1046b1b6fc6f1758f09e4c8d21684
+  metadata.gz: 4199d3afb89e1e5378dad08e0f989c085375643d7f48436a4786c7b7c615f646
+  data.tar.gz: 3af391ea23387c019d6247cb8e77ca78586f5e0e9626cca37b1946d3f4dff31f
 SHA512:
-  metadata.gz: bbfc6704a022cbc1077b0c394282abb6ed055aea1de6810d7bfc56b915c2749831ba9484b2325aae150601bd8cf8c01db2b84e17856e2a71c928184b06121436
-  data.tar.gz: 8a143b9cb92ee1e6dad0622cd0da6275e806589e6ec10fb171111af98a0e21882a24e4f952652e0b7b40aa079c69cda8b57f07cd7bfc2b1d5949030b1bb5021b
+  metadata.gz: 0db1b2103c8b5334786442adea3cb254ff81389354a6dba39a0a38c38d41ba0f337dab6be90758b75c8ae51e6ada6e391befe8f671502ecd08634133067e1d23
+  data.tar.gz: edb943d87180a8656fdd5a33a5d20e5cb3bf05201824fbfc581c8c13b31102ec9449d3e346bb3fe05612d63333abe89331eadb0fb116c626821d5f64b6d1eadb

data/CHANGELOG.md

@@ -6,6 +6,79 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.8.0] - 2026-08-13
+
+### Added
+
+- **Enforcement rule scoping** — `HookGenerator` now supports per-rule `match_target`
+  (`path` | `content` | `both`) and optional `path_scope` (regex guard on the target
+  file path) fields in generated PreToolUse hook scripts. Rules without these fields
+  default to `both`, preserving backward-compatible behaviour. This eliminates false
+  positives that occurred when security-documentation text mentioning a forbidden
+  pattern triggered the rule against the file that documents it (e.g. sec_018
+  documentation was itself blocked).
+
+- **Behaviour schema v1.5.0** — two new optional fields on the `enforcement` block:
+  - `match_target: "path" | "content" | "both"` — selects which part of the tool
+    input the rule pattern is tested against. Default: `"both"`.
+  - `path_scope: string` — regex; when set, the rule only applies when the target
+    file path matches. Ignored when `match_target` is `"path"`.
+
+- **`Validator#build_valid_entry`** — passes `match_target` and `path_scope` through
+  to the rule hash so `HookGenerator` can embed them in RULES entries.
+
+## [1.7.0] - 2026-08-02
+
+### Added
+
+- **sec_018 bypass vector enforcement** — `HookGenerator` now uses per-tool field
+  extraction when generating PreToolUse hook scripts, preventing false positives
+  from raw hash stringification. Bash hooks match against the `command` field only;
+  Write/Edit hooks match against `file_path` and content fields. Covers all
+  sec_018 bypass vectors: `--no-verify`, `OVERCOMMIT_DISABLE`, `core.hooksPath=`,
+  `ruby-audit --ignore`, `SKIP=`, `allow_failure: true` on CI gates, and writes
+  to the bundler-audit ignore file. Red-team spec suite added covering all
+  known bypass vectors.
+
+## [1.6.2] - 2026-07-25
+
+### Fixed
+
+- **`raictl config compile` / `config show` crash with older engine plugins** — `resolve_config_compiler`
+  unconditionally passed `strict:` to the engine's `ConfigCompiler#initialize`, causing
+  `ArgumentError: unknown keyword: :strict` with engine gems whose constructor predates the
+  `strict` parameter. The fix introspects the constructor's parameter list at runtime and
+  only includes `strict:` when the engine supports it.
+
+## [1.6.1] - 2026-07-23
+
+### Security
+
+- **CVE-2026-41316**: pin `erb` to `>= 6.0.6`; update Gemfile.lock to erb 6.0.6 —
+  resolves the gem-level vector of the ERB deserialization bypass advisory.
+
+## [1.6.0] - 2026-07-19
+
+### Added
+
+- **Behaviour-rule schema v1.4.0** — three new optional, backward-compatible fields on rule items,
+  laying the foundation for mechanical context-load reduction:
+  - `enforced: boolean` — marks rules whose behaviour is deterministically enforced by a live
+    PreToolUse/other hook; the C2 lean-context emitter will omit these from loaded bundles.
+  - `applies_to: [enum]` — one or more of `worker-impl`, `worker-research`, `orchestrator`,
+    `interactive`, `all`; the C3 role-scoped emitter uses this to produce per-role bundles.
+    Absence is treated as `["all"]`.
+  - `evidence: string` — the "Why / On \<date\> / incident" provenance narrative, separated from
+    the imperative rule body; the C2 lean emitter strips this field to reduce context size.
+  All three fields are optional; existing behaviour YAML files validate unchanged.
+
+### Security
+
+- **`mcp` gem upgraded 0.9.2 → 0.25.0** — fixes five CVEs in the MCP ruby-sdk:
+  GHSA-52jp-gj8w-j6xh, GHSA-5p9g-j988-pcwv, GHSA-7683-3w9x-ch42, GHSA-h669-8m4g-r2hc,
+  GHSA-rjr6-rcgv-9m7m (memory exhaustion, session poisoning, DNS-rebinding; all fixed in 0.23.0).
+  Dependency constraint widened from `~> 0.9.2` to `>= 0.23.0`.
+
 ## [1.5.12] - 2026-07-15
 
 ### Fixed

data/conf/schemas/behaviour_schema.json

@@ -4,8 +4,8 @@
   "title": "NeatNerds Behaviour Configuration",
   "description": "Schema for validating behaviour configuration files used by the NeatNerds Code Companion (rosett-ai). Behaviour files define operational rules for Claude Code workflows.",
   "$comment": {
-    "date": "2026-04-17",
-    "version": "1.3.0",
+    "date": "2026-08-13",
+    "version": "1.5.0",
     "source": "rosett-ai",
     "compatible_claude_code_versions": [
       ">=0.1.0"
@@ -142,12 +142,46 @@
               "message": {
                 "type": "string",
                 "description": "Human-readable message shown when the rule triggers"
+              },
+              "match_target": {
+                "type": "string",
+                "enum": ["path", "content", "both"],
+                "description": "Which part of the tool input the pattern is tested against. Default: both (concatenated path + content, current behaviour)."
+              },
+              "path_scope": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Regex string. When set, rule applies only when the target path matches. Ignored when match_target is path."
               }
             },
             "required": [
               "type"
             ],
             "additionalProperties": false
+          },
+          "enforced": {
+            "type": "boolean",
+            "description": "True when a live PreToolUse or other hook deterministically enforces this rule. Hook-enforced rules can be omitted from lean context bundles (C2 emitter). Absence is treated as false."
+          },
+          "applies_to": {
+            "type": "array",
+            "description": "Session roles this rule applies to. Used by the role-scoped bundle emitter (C3) to include only relevant rules per role. Absence is treated as [\"all\"].",
+            "items": {
+              "type": "string",
+              "enum": [
+                "worker-impl",
+                "worker-research",
+                "orchestrator",
+                "interactive",
+                "all"
+              ]
+            },
+            "minItems": 1,
+            "uniqueItems": true
+          },
+          "evidence": {
+            "type": "string",
+            "description": "Provenance narrative — the 'Why / On <date> / incident' context separated from the imperative rule body. Stripped from lean bundles (C2 emitter). Absence is treated as no separate evidence (provenance stays inline in description)."
           }
         }
       }

data/lib/rosett_ai/adopter/executor_resolver.rb

@@ -8,7 +8,7 @@ module RosettAi
     # Resolves the correct executor for an engine by reading its manifest
     # to determine the API type and constructor kwargs.
     #
-    # SDK-based engines (api_gem) receive api_key: and base_url:.
+    # SDK-based engines (api_gem) receive api_key: and base_url:. # gitleaks:allow
     # HTTP-based engines (api_type: http|openai_compatible) receive
     # endpoint: and model: from the manifest defaults.
     # CLI-based engines (api_type: cli) receive binary: from the manifest.

data/lib/rosett_ai/config/secret_resolver.rb

@@ -5,7 +5,7 @@
 
 module RosettAi
   module Config
-    # Resolves ${secret:backend:key} references in configuration values.
+    # Resolves ${secret:backend:key} references in configuration values. # gitleaks:allow
     #
     # Security constraints:
     # - NO regex anywhere — deterministic string parsing only (ReDoS prevention)

data/lib/rosett_ai/licensing/license_key.rb

@@ -16,7 +16,7 @@ module RosettAi
     # is held server-side and NEVER distributed.
     class LicenseKey
       # @return [String] Hex-encoded public key for license verification.
-      PUBLIC_KEY_HEX = '91f54336c0d42a7c88642b8d7f8bacab3adba4a4d633a33002fc15f676bfd8f0'
+      PUBLIC_KEY_HEX = '91f54336c0d42a7c88642b8d7f8bacab3adba4a4d633a33002fc15f676bfd8f0' # gitleaks:allow
       # @return [String] Prefix for rosett-ai license key strings.
       RAI_PREFIX = 'NNCC-'
       # @return [Integer] Days of grace period after license expiry.

data/lib/rosett_ai/mcp/enforcement/hook_generator.rb

@@ -163,6 +163,8 @@ module RosettAi
             "    pattern: #{format_regex(rule[:pattern])},",
             "    applies_to: [#{tools}],",
             "    action: :#{rule[:action]},",
+            "    match_target: :#{rule.fetch(:match_target, 'both')},",
+            "    path_scope: #{rule[:path_scope] ? format_regex(rule[:path_scope]) : 'nil'},",
             "    message: '#{msg}',",
             "    description: '#{desc}' }"
           ].join("\n  ")
@@ -189,6 +191,10 @@ module RosettAi
         # Generates the runtime enforcement logic body.
         # Uses non-interpolating heredoc — this code runs at hook time, not generation time.
         #
+        # Per-tool field extraction prevents false positives from raw hash stringification.
+        # Each tool has a known input schema; we extract only the fields that carry
+        # user-controlled content that sec_018 patterns must match against.
+        #
         # @return [String]
         def enforcement_body
           <<~'RUBY'
@@ -196,10 +202,39 @@ module RosettAi
 
             input = JSON.parse($stdin.read)
             tool_name = input['tool_name'].to_s
-            tool_input = input['tool_input'].to_s
+
+            target_path, target_content = case tool_name
+                                          when 'Bash'
+                                            cmd = input.dig('tool_input', 'command').to_s
+                                            [cmd, cmd]
+                                          when 'Write'
+                                            [input.dig('tool_input', 'file_path').to_s,
+                                             input.dig('tool_input', 'content').to_s]
+                                          when 'Edit'
+                                            content = [input.dig('tool_input', 'old_string'),
+                                                       input.dig('tool_input', 'new_string')].compact.join(' ')
+                                            [input.dig('tool_input', 'file_path').to_s, content]
+                                          when 'Agent'
+                                            ['', input.dig('tool_input', 'prompt').to_s]
+                                          else
+                                            raw = input.fetch('tool_input', '').to_s
+                                            [raw, raw]
+                                          end
 
             violations = RULES.select do |rule|
-              rule[:applies_to].include?(tool_name) && rule[:pattern].match?(tool_input)
+              next false unless rule[:applies_to].include?(tool_name)
+
+              if rule[:path_scope] && rule[:match_target] != :path
+                next false unless rule[:path_scope].match?(target_path)
+              end
+
+              match_text = case rule[:match_target]
+                           when :path    then target_path
+                           when :content then target_content
+                           else               "#{target_path} #{target_content}"
+                           end
+
+              rule[:pattern].match?(match_text)
             end
 
             exit 0 if violations.empty?
@@ -209,7 +244,6 @@ module RosettAi
                            "(P#{v[:priority]}, #{v[:action]}): #{v[:message].empty? ? v[:description] : v[:message]}"
             end
 
-            # Block if any violation has action :block
             blocked = violations.any? { |v| v[:action] == :block }
             exit(blocked ? 2 : 0)
           RUBY

data/lib/rosett_ai/mcp/enforcement/validator.rb

@@ -228,7 +228,9 @@ module RosettAi
           { rule_id: ctx.rule_id, behaviour: ctx.behaviour, type: 'enforceable',
             pattern: enforcement['pattern'], applies_to: enforcement['applies_to'],
             action: derive_action(enforcement, priority), message: enforcement['message'],
-            priority: priority, description: rule['description'].to_s.strip }
+            priority: priority, description: rule['description'].to_s.strip,
+            match_target: (enforcement['match_target'] || 'both').to_s,
+            path_scope: enforcement['path_scope'] }
         end
       end
     end

data/lib/rosett_ai/mcp/governance.rb

@@ -72,6 +72,24 @@ module RosettAi
       # @return [Array] Parameter types passed as keyword arguments.
       KEYWORD_PARAM_TYPES = [:keyreq, :key].freeze
 
+      # Lightweight adapter so plain resource-entry hashes satisfy the mcp >= 0.23.0
+      # server.resources= API, which requires objects responding to #uri and #to_h.
+      class ResourceListEntry
+        def initialize(attrs)
+          @attrs = attrs
+        end
+
+        def uri
+          @attrs[:uri]
+        end
+
+        def to_h
+          { uri: @attrs[:uri], name: @attrs[:name], description: @attrs[:description],
+            mimeType: @attrs[:mimeType] }.compact
+        end
+      end
+      private_constant :ResourceListEntry
+
       module_function
 
       # @param server [MCP::Server]
@@ -89,8 +107,9 @@ module RosettAi
       # @param server [MCP::Server]
       def register_resources(server)
         resources = RESOURCE_CLASSES.map(&:new)
-        server.resources_list_handler { resources.flat_map(&:list) }
-        server.resources_read_handler do |uri:|
+        server.resources = resources.flat_map(&:list).map { |e| ResourceListEntry.new(e) }
+        server.resources_read_handler do |params|
+          uri = params.is_a?(Hash) ? (params[:uri] || params['uri']) : params.to_s
           resource_name = uri.split('/').last
           resource_class = find_resource_for_uri(resources, uri)
           result = resource_class&.read(resource_name)

data/lib/rosett_ai/retrofit/secret_detector.rb

@@ -6,7 +6,7 @@
 module RosettAi
   module Retrofit
     # Detects sensitive values in parsed configuration data and replaces
-    # them with ${secret:env:NAME} references.
+    # them with ${secret:env:NAME} references. # gitleaks:allow
     #
     # Recognises API keys, tokens, passwords, and other secrets by
     # key name patterns and value heuristics (length, entropy, prefixes).
@@ -69,7 +69,7 @@ module RosettAi
         env_name = full_key.upcase.gsub(/[^A-Z0-9]/, '_').squeeze('_')
         @warnings << "Sensitive value detected for '#{key}' — replaced with secret reference. " \
                      "Set #{env_name} in your environment."
-        "${secret:env:#{env_name}}"
+        "${secret:env:#{env_name}}" # gitleaks:allow
       end
 
       def sensitive?(key, value)

data/lib/rosett_ai/thor/tasks/config.rb

@@ -143,8 +143,12 @@ module RosettAi
           end
 
           secret_resolver = masking ? RosettAi::Config::MaskingSecretResolver.new : nil
-          plugin.config_compiler_class.new(simulate: simulate, secret_resolver: secret_resolver,
-                                           strict: strict)
+          klass = plugin.config_compiler_class
+          params = { simulate: simulate, secret_resolver: secret_resolver }
+          init_params = klass.instance_method(:initialize).parameters
+          supports_strict = init_params.any? { |type, name| name == :strict && [:key, :keyreq].include?(type) }
+          params[:strict] = strict if supports_strict
+          klass.new(**params)
         end
 
         def engine_hint(available, engine_name)

data/lib/rosett_ai/version.rb

@@ -5,5 +5,5 @@
 
 module RosettAi
   # @return [String] Current version of the rosett-ai gem.
-  VERSION = '1.5.12'
+  VERSION = '1.8.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rosett-ai
 version: !ruby/object:Gem::Version
-  version: 1.5.12
+  version: 1.8.0
 platform: ruby
 authors:
 - Hugo Antonio Sepulveda Manriquez
@@ -237,16 +237,16 @@ dependencies:
   name: mcp
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.2
+        version: 0.23.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.2
+        version: 0.23.0
 description: Configuration management tool for AI-assisted development workflows.
   Author rules once, compile to Claude Code, Cursor, AGENTS.md, and more.
 email: