rosett-ai 1.5.12 → 1.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb0358498de4f1123fd29a3ae3e728712340a70772a5469a31d25048a4525aca
-  data.tar.gz: bbc11a0a29c5d4b8b14fe3c34e9d28ae93c1046b1b6fc6f1758f09e4c8d21684
+  metadata.gz: 8968373d949471c707db0f0bddbe526797d8e47fdaf80b53a17d65e7fb5cb198
+  data.tar.gz: efdd68439a73eb12e2f6b503e999c2d0a40c9a6d9c73693da59cbacd9c3dab0c
 SHA512:
-  metadata.gz: bbfc6704a022cbc1077b0c394282abb6ed055aea1de6810d7bfc56b915c2749831ba9484b2325aae150601bd8cf8c01db2b84e17856e2a71c928184b06121436
-  data.tar.gz: 8a143b9cb92ee1e6dad0622cd0da6275e806589e6ec10fb171111af98a0e21882a24e4f952652e0b7b40aa079c69cda8b57f07cd7bfc2b1d5949030b1bb5021b
+  metadata.gz: 82e690044b7a4b4a54d3bf5f562c1b27711cb462b973d5d3d0078c3c0c8e84ca20dec5f027949d4cd0c233c26d4d321fe42cb20cfe9bb8ab7bdb068613c7787f
+  data.tar.gz: 4680e074d51a261d6ad4a98ce477d990b2ddf4187b30f90883c3d26cb86b1c7cfe6502b0ea7c5a07434f692111dc296e9a5eebb4ecb6477913bb5e6516b111d8

data/CHANGELOG.md

@@ -6,6 +6,35 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.6.1] - 2026-07-23
+
+### Security
+
+- **CVE-2026-41316**: pin `erb` to `>= 6.0.6`; update Gemfile.lock to erb 6.0.6 —
+  resolves the gem-level vector of the ERB deserialization bypass advisory.
+
+## [1.6.0] - 2026-07-19
+
+### Added
+
+- **Behaviour-rule schema v1.4.0** — three new optional, backward-compatible fields on rule items,
+  laying the foundation for mechanical context-load reduction:
+  - `enforced: boolean` — marks rules whose behaviour is deterministically enforced by a live
+    PreToolUse/other hook; the C2 lean-context emitter will omit these from loaded bundles.
+  - `applies_to: [enum]` — one or more of `worker-impl`, `worker-research`, `orchestrator`,
+    `interactive`, `all`; the C3 role-scoped emitter uses this to produce per-role bundles.
+    Absence is treated as `["all"]`.
+  - `evidence: string` — the "Why / On \<date\> / incident" provenance narrative, separated from
+    the imperative rule body; the C2 lean emitter strips this field to reduce context size.
+  All three fields are optional; existing behaviour YAML files validate unchanged.
+
+### Security
+
+- **`mcp` gem upgraded 0.9.2 → 0.25.0** — fixes five CVEs in the MCP ruby-sdk:
+  GHSA-52jp-gj8w-j6xh, GHSA-5p9g-j988-pcwv, GHSA-7683-3w9x-ch42, GHSA-h669-8m4g-r2hc,
+  GHSA-rjr6-rcgv-9m7m (memory exhaustion, session poisoning, DNS-rebinding; all fixed in 0.23.0).
+  Dependency constraint widened from `~> 0.9.2` to `>= 0.23.0`.
+
 ## [1.5.12] - 2026-07-15
 
 ### Fixed

data/conf/schemas/behaviour_schema.json

@@ -4,8 +4,8 @@
   "title": "NeatNerds Behaviour Configuration",
   "description": "Schema for validating behaviour configuration files used by the NeatNerds Code Companion (rosett-ai). Behaviour files define operational rules for Claude Code workflows.",
   "$comment": {
-    "date": "2026-04-17",
-    "version": "1.3.0",
+    "date": "2026-07-19",
+    "version": "1.4.0",
     "source": "rosett-ai",
     "compatible_claude_code_versions": [
       ">=0.1.0"
@@ -148,6 +148,30 @@
               "type"
             ],
             "additionalProperties": false
+          },
+          "enforced": {
+            "type": "boolean",
+            "description": "True when a live PreToolUse or other hook deterministically enforces this rule. Hook-enforced rules can be omitted from lean context bundles (C2 emitter). Absence is treated as false."
+          },
+          "applies_to": {
+            "type": "array",
+            "description": "Session roles this rule applies to. Used by the role-scoped bundle emitter (C3) to include only relevant rules per role. Absence is treated as [\"all\"].",
+            "items": {
+              "type": "string",
+              "enum": [
+                "worker-impl",
+                "worker-research",
+                "orchestrator",
+                "interactive",
+                "all"
+              ]
+            },
+            "minItems": 1,
+            "uniqueItems": true
+          },
+          "evidence": {
+            "type": "string",
+            "description": "Provenance narrative — the 'Why / On <date> / incident' context separated from the imperative rule body. Stripped from lean bundles (C2 emitter). Absence is treated as no separate evidence (provenance stays inline in description)."
           }
         }
       }

data/lib/rosett_ai/mcp/governance.rb

@@ -72,6 +72,24 @@ module RosettAi
       # @return [Array] Parameter types passed as keyword arguments.
       KEYWORD_PARAM_TYPES = [:keyreq, :key].freeze
 
+      # Lightweight adapter so plain resource-entry hashes satisfy the mcp >= 0.23.0
+      # server.resources= API, which requires objects responding to #uri and #to_h.
+      class ResourceListEntry
+        def initialize(attrs)
+          @attrs = attrs
+        end
+
+        def uri
+          @attrs[:uri]
+        end
+
+        def to_h
+          { uri: @attrs[:uri], name: @attrs[:name], description: @attrs[:description],
+            mimeType: @attrs[:mimeType] }.compact
+        end
+      end
+      private_constant :ResourceListEntry
+
       module_function
 
       # @param server [MCP::Server]
@@ -89,8 +107,9 @@ module RosettAi
       # @param server [MCP::Server]
       def register_resources(server)
         resources = RESOURCE_CLASSES.map(&:new)
-        server.resources_list_handler { resources.flat_map(&:list) }
-        server.resources_read_handler do |uri:|
+        server.resources = resources.flat_map(&:list).map { |e| ResourceListEntry.new(e) }
+        server.resources_read_handler do |params|
+          uri = params.is_a?(Hash) ? (params[:uri] || params['uri']) : params.to_s
           resource_name = uri.split('/').last
           resource_class = find_resource_for_uri(resources, uri)
           result = resource_class&.read(resource_name)

data/lib/rosett_ai/version.rb

@@ -5,5 +5,5 @@
 
 module RosettAi
   # @return [String] Current version of the rosett-ai gem.
-  VERSION = '1.5.12'
+  VERSION = '1.6.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rosett-ai
 version: !ruby/object:Gem::Version
-  version: 1.5.12
+  version: 1.6.1
 platform: ruby
 authors:
 - Hugo Antonio Sepulveda Manriquez
@@ -237,16 +237,16 @@ dependencies:
   name: mcp
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.2
+        version: 0.23.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.9.2
+        version: 0.23.0
 description: Configuration management tool for AI-assisted development workflows.
   Author rules once, compile to Claude Code, Cursor, AGENTS.md, and more.
 email: