RubyGems - senren-ui - Versions diffs - 0.1.6 → 0.3.0 - Mend

senren-ui 0.1.6 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (101) hide show

data/lib/generators/senren/install/templates/senren_themes.css.tt ADDED Viewed

@@ -0,0 +1,339 @@
+/*
+ * Senren UI - optional palette presets.
+ *
+ * Link this after senren.css and set data-senren-theme on <html> to switch:
+ *
+ *   <%%= stylesheet_link_tag "senren" %>
+ *   <%%= stylesheet_link_tag "senren_themes" %>
+ *
+ *   <html data-senren-theme="slate">
+ *
+ * Leave the attribute off for the default Spring Garden palette, which
+ * senren.css declares in :root.
+ *
+ * Every theme below is nothing but a re-declaration of the same token set that
+ * senren.css defines. No component is aware that themes exist: components read
+ * hsl(var(--senren-*)) and inherit whatever is in scope. Adding your own theme
+ * means copying one of these blocks and changing the values — there is no
+ * component to touch and no build step to run.
+ *
+ * Scoping: [data-senren-theme] on <html>, so it composes with the existing
+ * .dark class rather than replacing it. Each theme therefore ships a light and
+ * a dark block, and light/dark stays orthogonal to the palette choice.
+ *
+ * `senren` is the default and needs no block: it is what senren.css already
+ * declares in :root and .dark.
+ *
+ * test/themes_test.rb asserts every theme here declares the complete token set,
+ * so a palette cannot ship with a variable quietly missing.
+ */
+/* ── slate ────────────────────────────────────────────────────────────────
+   Cool neutrals, near-black primary, tight radius. The restrained look most
+   developer tools converge on. */
+[data-senren-theme="slate"] {
+  --senren-background: 0 0% 100%;
+  --senren-foreground: 222 47% 11%;
+  --senren-muted: 210 40% 96%;
+  --senren-muted-foreground: 215 16% 47%;
+  --senren-card: 0 0% 100%;
+  --senren-card-foreground: 222 47% 11%;
+  --senren-popover: 0 0% 100%;
+  --senren-popover-foreground: 222 47% 11%;
+  --senren-border: 214 32% 91%;
+  --senren-input: 214 32% 91%;
+  --senren-ring: 222 47% 11%;
+  --senren-primary: 222 47% 11%;
+  --senren-primary-foreground: 210 40% 98%;
+  --senren-secondary: 210 40% 96%;
+  --senren-secondary-foreground: 222 47% 11%;
+  --senren-accent: 210 40% 94%;
+  --senren-accent-foreground: 222 47% 11%;
+  --senren-destructive: 0 72% 51%;
+  --senren-destructive-foreground: 210 40% 98%;
+  --senren-success: 142 71% 36%;
+  --senren-success-foreground: 210 40% 98%;
+  --senren-warning: 38 92% 50%;
+  --senren-warning-foreground: 222 47% 11%;
+  --senren-radius: 0.375rem;
+  --senren-palette-sky: 217 91% 60%;
+  --senren-palette-sakura: 330 81% 60%;
+  --senren-palette-pond: 199 89% 48%;
+  --senren-palette-leaf: 142 71% 45%;
+  --senren-palette-iris: 258 90% 66%;
+  --senren-palette-paper: 210 40% 98%;
+}
+.dark[data-senren-theme="slate"] {
+  --senren-background: 222 47% 7%;
+  --senren-foreground: 210 40% 98%;
+  --senren-muted: 217 33% 17%;
+  --senren-muted-foreground: 215 20% 65%;
+  --senren-card: 222 47% 9%;
+  --senren-card-foreground: 210 40% 98%;
+  --senren-popover: 222 47% 9%;
+  --senren-popover-foreground: 210 40% 98%;
+  --senren-border: 217 33% 20%;
+  --senren-input: 217 33% 20%;
+  --senren-ring: 213 27% 84%;
+  --senren-primary: 210 40% 98%;
+  --senren-primary-foreground: 222 47% 11%;
+  --senren-secondary: 217 33% 17%;
+  --senren-secondary-foreground: 210 40% 98%;
+  --senren-accent: 217 33% 20%;
+  --senren-accent-foreground: 210 40% 98%;
+  --senren-destructive: 0 63% 46%;
+  --senren-destructive-foreground: 210 40% 98%;
+  --senren-success: 142 60% 40%;
+  --senren-success-foreground: 210 40% 98%;
+  --senren-warning: 38 85% 52%;
+  --senren-warning-foreground: 222 47% 11%;
+}
+/* ── indigo ───────────────────────────────────────────────────────────────
+   The default of a great many B2B products: white surfaces, indigo action
+   colour, cool grey text. */
+[data-senren-theme="indigo"] {
+  --senren-background: 0 0% 100%;
+  --senren-foreground: 224 71% 4%;
+  --senren-muted: 220 14% 96%;
+  --senren-muted-foreground: 220 9% 46%;
+  --senren-card: 0 0% 100%;
+  --senren-card-foreground: 224 71% 4%;
+  --senren-popover: 0 0% 100%;
+  --senren-popover-foreground: 224 71% 4%;
+  --senren-border: 220 13% 91%;
+  --senren-input: 220 13% 91%;
+  --senren-ring: 239 84% 67%;
+  --senren-primary: 243 75% 59%;
+  --senren-primary-foreground: 0 0% 100%;
+  --senren-secondary: 226 100% 97%;
+  --senren-secondary-foreground: 243 75% 40%;
+  --senren-accent: 226 100% 94%;
+  --senren-accent-foreground: 243 75% 40%;
+  --senren-destructive: 0 84% 60%;
+  --senren-destructive-foreground: 0 0% 100%;
+  --senren-success: 160 84% 32%;
+  --senren-success-foreground: 0 0% 100%;
+  --senren-warning: 32 95% 52%;
+  --senren-warning-foreground: 224 71% 4%;
+  --senren-radius: 0.5rem;
+  --senren-palette-sky: 217 91% 60%;
+  --senren-palette-sakura: 330 81% 70%;
+  --senren-palette-pond: 199 89% 60%;
+  --senren-palette-leaf: 160 84% 39%;
+  --senren-palette-iris: 243 75% 59%;
+  --senren-palette-paper: 220 14% 96%;
+}
+.dark[data-senren-theme="indigo"] {
+  --senren-background: 229 42% 8%;
+  --senren-foreground: 220 14% 96%;
+  --senren-muted: 229 30% 16%;
+  --senren-muted-foreground: 218 11% 65%;
+  --senren-card: 229 40% 11%;
+  --senren-card-foreground: 220 14% 96%;
+  --senren-popover: 229 40% 11%;
+  --senren-popover-foreground: 220 14% 96%;
+  --senren-border: 229 25% 22%;
+  --senren-input: 229 25% 22%;
+  --senren-ring: 239 84% 72%;
+  --senren-primary: 239 84% 70%;
+  --senren-primary-foreground: 229 42% 8%;
+  --senren-secondary: 229 30% 18%;
+  --senren-secondary-foreground: 226 100% 88%;
+  --senren-accent: 229 30% 22%;
+  --senren-accent-foreground: 226 100% 92%;
+  --senren-destructive: 0 72% 55%;
+  --senren-destructive-foreground: 0 0% 100%;
+  --senren-success: 160 70% 42%;
+  --senren-success-foreground: 229 42% 8%;
+  --senren-warning: 32 90% 58%;
+  --senren-warning-foreground: 229 42% 8%;
+}
+/* ── emerald ──────────────────────────────────────────────────────────────
+   Green action colour on soft neutrals, with a generous radius. Common in
+   finance, health, and sustainability products. */
+[data-senren-theme="emerald"] {
+  --senren-background: 150 20% 99%;
+  --senren-foreground: 160 40% 10%;
+  --senren-muted: 150 24% 95%;
+  --senren-muted-foreground: 160 12% 42%;
+  --senren-card: 0 0% 100%;
+  --senren-card-foreground: 160 40% 10%;
+  --senren-popover: 0 0% 100%;
+  --senren-popover-foreground: 160 40% 10%;
+  --senren-border: 152 22% 88%;
+  --senren-input: 152 22% 88%;
+  --senren-ring: 160 84% 39%;
+  --senren-primary: 160 84% 30%;
+  --senren-primary-foreground: 150 30% 98%;
+  --senren-secondary: 152 45% 92%;
+  --senren-secondary-foreground: 160 60% 20%;
+  --senren-accent: 168 60% 90%;
+  --senren-accent-foreground: 168 70% 18%;
+  --senren-destructive: 0 74% 50%;
+  --senren-destructive-foreground: 150 30% 98%;
+  --senren-success: 160 84% 32%;
+  --senren-success-foreground: 150 30% 98%;
+  --senren-warning: 40 95% 50%;
+  --senren-warning-foreground: 160 40% 10%;
+  --senren-radius: 0.75rem;
+  --senren-palette-sky: 190 80% 45%;
+  --senren-palette-sakura: 340 70% 82%;
+  --senren-palette-pond: 172 66% 78%;
+  --senren-palette-leaf: 145 63% 49%;
+  --senren-palette-iris: 250 60% 78%;
+  --senren-palette-paper: 150 24% 95%;
+}
+.dark[data-senren-theme="emerald"] {
+  --senren-background: 165 40% 6%;
+  --senren-foreground: 150 24% 95%;
+  --senren-muted: 165 28% 14%;
+  --senren-muted-foreground: 152 14% 62%;
+  --senren-card: 165 38% 9%;
+  --senren-card-foreground: 150 24% 95%;
+  --senren-popover: 165 38% 9%;
+  --senren-popover-foreground: 150 24% 95%;
+  --senren-border: 165 22% 20%;
+  --senren-input: 165 22% 20%;
+  --senren-ring: 160 84% 45%;
+  --senren-primary: 158 74% 44%;
+  --senren-primary-foreground: 165 40% 6%;
+  --senren-secondary: 165 28% 16%;
+  --senren-secondary-foreground: 152 45% 88%;
+  --senren-accent: 168 40% 20%;
+  --senren-accent-foreground: 168 60% 88%;
+  --senren-destructive: 0 66% 52%;
+  --senren-destructive-foreground: 150 30% 98%;
+  --senren-success: 158 70% 42%;
+  --senren-success-foreground: 165 40% 6%;
+  --senren-warning: 40 88% 56%;
+  --senren-warning-foreground: 165 40% 6%;
+}
+/* ── rose ─────────────────────────────────────────────────────────────────
+   Warm neutrals and a soft pink action colour, with the roundest corners of
+   the set. The consumer-facing end of SaaS. */
+[data-senren-theme="rose"] {
+  --senren-background: 20 40% 99%;
+  --senren-foreground: 340 30% 12%;
+  --senren-muted: 20 30% 96%;
+  --senren-muted-foreground: 340 8% 46%;
+  --senren-card: 0 0% 100%;
+  --senren-card-foreground: 340 30% 12%;
+  --senren-popover: 0 0% 100%;
+  --senren-popover-foreground: 340 30% 12%;
+  --senren-border: 20 25% 90%;
+  --senren-input: 20 25% 90%;
+  --senren-ring: 347 77% 60%;
+  --senren-primary: 347 77% 50%;
+  --senren-primary-foreground: 20 40% 99%;
+  --senren-secondary: 350 80% 95%;
+  --senren-secondary-foreground: 347 70% 32%;
+  --senren-accent: 350 80% 92%;
+  --senren-accent-foreground: 347 70% 30%;
+  --senren-destructive: 0 78% 52%;
+  --senren-destructive-foreground: 20 40% 99%;
+  --senren-success: 150 62% 36%;
+  --senren-success-foreground: 20 40% 99%;
+  --senren-warning: 35 95% 55%;
+  --senren-warning-foreground: 340 30% 12%;
+  --senren-radius: 1rem;
+  --senren-palette-sky: 205 85% 58%;
+  --senren-palette-sakura: 350 85% 84%;
+  --senren-palette-pond: 190 70% 82%;
+  --senren-palette-leaf: 140 55% 55%;
+  --senren-palette-iris: 280 70% 78%;
+  --senren-palette-paper: 20 30% 96%;
+}
+.dark[data-senren-theme="rose"] {
+  --senren-background: 340 22% 8%;
+  --senren-foreground: 20 30% 96%;
+  --senren-muted: 340 16% 16%;
+  --senren-muted-foreground: 340 8% 64%;
+  --senren-card: 340 20% 11%;
+  --senren-card-foreground: 20 30% 96%;
+  --senren-popover: 340 20% 11%;
+  --senren-popover-foreground: 20 30% 96%;
+  --senren-border: 340 14% 22%;
+  --senren-input: 340 14% 22%;
+  --senren-ring: 347 77% 66%;
+  --senren-primary: 347 82% 62%;
+  --senren-primary-foreground: 340 22% 8%;
+  --senren-secondary: 340 16% 18%;
+  --senren-secondary-foreground: 350 80% 90%;
+  --senren-accent: 340 20% 24%;
+  --senren-accent-foreground: 350 80% 90%;
+  --senren-destructive: 0 70% 55%;
+  --senren-destructive-foreground: 20 40% 99%;
+  --senren-success: 150 55% 44%;
+  --senren-success-foreground: 340 22% 8%;
+  --senren-warning: 35 90% 60%;
+  --senren-warning-foreground: 340 22% 8%;
+}
+/* ── amber ────────────────────────────────────────────────────────────────
+   Sand-toned neutrals, amber action colour, near-square corners. The
+   document-and-workspace look. */
+[data-senren-theme="amber"] {
+  --senren-background: 40 30% 98%;
+  --senren-foreground: 30 25% 12%;
+  --senren-muted: 40 24% 94%;
+  --senren-muted-foreground: 32 10% 44%;
+  --senren-card: 40 40% 99%;
+  --senren-card-foreground: 30 25% 12%;
+  --senren-popover: 40 40% 99%;
+  --senren-popover-foreground: 30 25% 12%;
+  --senren-border: 36 20% 87%;
+  --senren-input: 36 20% 87%;
+  --senren-ring: 32 95% 44%;
+  --senren-primary: 30 30% 16%;
+  --senren-primary-foreground: 40 30% 98%;
+  --senren-secondary: 40 60% 90%;
+  --senren-secondary-foreground: 30 40% 20%;
+  --senren-accent: 38 80% 88%;
+  --senren-accent-foreground: 30 45% 20%;
+  --senren-destructive: 4 74% 48%;
+  --senren-destructive-foreground: 40 30% 98%;
+  --senren-success: 140 55% 34%;
+  --senren-success-foreground: 40 30% 98%;
+  --senren-warning: 32 95% 46%;
+  --senren-warning-foreground: 40 30% 98%;
+  --senren-radius: 0.25rem;
+  --senren-palette-sky: 200 75% 50%;
+  --senren-palette-sakura: 20 80% 82%;
+  --senren-palette-pond: 190 60% 80%;
+  --senren-palette-leaf: 100 45% 50%;
+  --senren-palette-iris: 265 55% 74%;
+  --senren-palette-paper: 40 24% 94%;
+}
+.dark[data-senren-theme="amber"] {
+  --senren-background: 30 18% 8%;
+  --senren-foreground: 40 24% 94%;
+  --senren-muted: 30 14% 15%;
+  --senren-muted-foreground: 36 10% 62%;
+  --senren-card: 30 16% 11%;
+  --senren-card-foreground: 40 24% 94%;
+  --senren-popover: 30 16% 11%;
+  --senren-popover-foreground: 40 24% 94%;
+  --senren-border: 30 12% 21%;
+  --senren-input: 30 12% 21%;
+  --senren-ring: 32 95% 55%;
+  --senren-primary: 36 90% 58%;
+  --senren-primary-foreground: 30 25% 10%;
+  --senren-secondary: 30 14% 17%;
+  --senren-secondary-foreground: 40 60% 86%;
+  --senren-accent: 32 30% 22%;
+  --senren-accent-foreground: 38 80% 86%;
+  --senren-destructive: 4 68% 52%;
+  --senren-destructive-foreground: 40 30% 98%;
+  --senren-success: 140 50% 42%;
+  --senren-success-foreground: 30 18% 8%;
+  --senren-warning: 32 90% 56%;
+  --senren-warning-foreground: 30 18% 8%;
+}

data/lib/senren/rails/agent_rules_writer.rb CHANGED Viewed

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 require 'yaml'
+require 'senren/rails/marker_block'
+require 'senren/rails/safe_write'
 module Senren
   module Rails
@@ -21,6 +23,7 @@ module Senren
       end
       def sync!
+        assert_distinct_adapters!
         paths.ensure_agent_dirs!
         files = []
         files << write_full_file(paths.agent_rules_file, render_source_rules)
@@ -31,8 +34,46 @@ module Senren
         files
       end
+      # Each adapter gets different content, so two of them resolving to the
+      # same file means the last write silently wins.
+      #
+      # `ln -s AGENTS.md CLAUDE.md` is a normal way to keep one set of agent
+      # instructions, and now that in-repo symlinks are allowed it reaches here
+      # rather than being refused as an escape.
+      #
+      # Public so ComponentInstaller can run it as a preflight. The first
+      # version of this check lived inside sync!, which runs after the copier,
+      # so `senren:add` failed with components already on disk and the ledger
+      # already written.
+      def assert_distinct_adapters!
+        collisions = adapter_targets.group_by { |path, _| SafeWrite.real_target(path) }
+                                    .select { |_, group| group.size > 1 }
+        return if collisions.empty?
+        raise ArgumentError, collision_message(collisions)
+      end
       private
+      def adapter_targets
+        {
+          paths.codex_agents_md => 'AGENTS.md',
+          paths.claude_md => 'CLAUDE.md',
+          paths.copilot_instructions => '.github/copilot-instructions.md',
+          paths.cursor_rule_file => '.cursor/rules/senren.mdc'
+        }
+      end
+      def collision_message(collisions)
+        detail = collisions.map do |target, group|
+          "#{group.map(&:last).join(' and ')} both resolve to #{target}"
+        end.join('; ')
+        'Senren writes different instructions to each agent adapter, so these cannot share a file: ' \
+          "#{detail}. Replace the link with a real file, or have one adapter reference the other " \
+          'by path instead of linking to it.'
+      end
       def installed_names
         path = paths.installed_components
         return [] unless path.exist?
@@ -57,8 +98,17 @@ module Senren
           - Use ViewComponent for reusable UI.
           - Use Turbo for server state.
           - Use Stimulus only for local behavior.
-          - Do not introduce React, Vue, Alpine, or external state frameworks.
+          - Keep interactivity in Stimulus. These components render on the server,
+            so a client-side framework alongside them means two systems own the
+            same state.
           - Use semantic Tailwind tokens; do not hard-code color families.
+          - Never add `app/components` to `config.assets.paths`. Propshaft
+            publishes every file under an asset path, so component `.rb` and
+            `.html.erb` source is precompiled into `public/assets` and served
+            over HTTP. Put sidecar assets in `app/components/assets` instead.
+          - A button inside a form needs no `type:`. ButtonComponent omits the
+            attribute so the browser submits, as plain HTML does. Pass
+            `type: :button` only for a trigger that must not submit.
           ## Important Files
@@ -82,7 +132,7 @@ module Senren
           - Prefer Senren components before custom HTML.
           - Keep reusable UI in ViewComponent.
           - Use Turbo for server state, Stimulus for local behavior.
-          - Do not add React, Vue, Alpine, or external state frameworks.
+          - Keep interactivity in Stimulus rather than a client-side framework.
           - Use semantic Tailwind tokens.
         MD
       end
@@ -106,7 +156,7 @@ module Senren
           - Prefer Senren components before custom HTML.
           - Reusable UI must use ViewComponent.
           - Turbo handles server state; Stimulus handles local behavior.
-          - Do not introduce React, Vue, Alpine, or external state frameworks.
+          - Keep interactivity in Stimulus rather than a client-side framework.
           - Use semantic Tailwind tokens.
         MD
       end
@@ -120,7 +170,7 @@ module Senren
           - Prefer Senren components before custom HTML.
           - Reusable UI uses ViewComponent.
           - Turbo for server state, Stimulus for local behavior.
-          - No React/Vue/Alpine/external state frameworks.
+          - Keep interactivity in Stimulus rather than a client-side framework.
           - Use semantic Tailwind tokens.
         MD
       end
@@ -147,28 +197,24 @@ module Senren
       def write_adapter_file(path, generated, prefix: '')
         existing = path.exist? ? path.read : prefix.to_s
-        updated = inject(existing, generated)
+        updated = inject(existing, generated, label: path.to_s)
         atomic_write(path, updated)
         path
       end
-      def inject(existing, generated)
-        if existing.include?(START_MARKER) && existing.include?(END_MARKER)
-          before = existing.split(START_MARKER, 2).first
-          tail = existing.split(START_MARKER, 2).last
-          after = tail.split(END_MARKER, 2).last
-          "#{before}#{START_MARKER}\n\n#{generated.rstrip}\n\n#{END_MARKER}#{after}"
-        else
-          body = existing.rstrip
-          prefix = body.empty? ? '' : "#{body}\n\n"
-          "#{prefix}#{START_MARKER}\n\n#{generated.rstrip}\n\n#{END_MARKER}\n"
-        end
+      def inject(existing, generated, label: nil)
+        MarkerBlock.inject(
+          existing, generated,
+          start_marker: START_MARKER, end_marker: END_MARKER, label: label
+        )
       end
+      # write_adapter_file reads its destination before rewriting it, so a
+      # symlinked .senren, .github or .cursor/rules did not merely redirect the
+      # write — it pulled outside content in and wrote it back out. SafeWrite
+      # refuses on the real path before either half of that happens.
       def atomic_write(path, content)
-        tmp = "#{path}.tmp"
-        File.write(tmp, content)
-        File.rename(tmp, path)
+        SafeWrite.write!(path, content, paths.root, path.to_s)
       end
     end
   end

data/lib/senren/rails/asset_path_guard.rb ADDED Viewed

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+module Senren
+  module Rails
+    # Refuses to let component source be served as a static asset.
+    #
+    # ViewComponent documents putting sidecar assets next to components, and the
+    # usual way to reach them is:
+    #
+    #   config.assets.paths << Rails.root.join("app/components")
+    #
+    # With Propshaft that one line makes every file under app/components a
+    # servable asset, `.rb` and `.html.erb` included. Verified against Propshaft
+    # 1.3.2: 129 component source files resolved, `assets:precompile` copied all
+    # of them into public/assets/, and public/assets/.manifest.json listed each
+    # logical path next to its digested filename — so the digest is not even an
+    # obstacle. In production the web server hands them out with Rails never
+    # involved.
+    #
+    # Development is a different risk calculation, so there it warns. Production
+    # raises: a boot failure is recoverable, published source is not.
+    module AssetPathGuard
+      SOURCE_EXTENSIONS = %w[.rb .erb].freeze
+      module_function
+      # `production:` is injected rather than read from ::Rails so the guard can
+      # be unit tested without booting Rails, which is how the rest of this
+      # library's unit suite runs.
+      def check!(app, io: $stderr, production: production_env?)
+        offenders = offending_paths(app)
+        return true if offenders.empty?
+        message = message_for(offenders)
+        raise message if production
+        io.puts("[senren] WARNING: #{message}")
+        false
+      end
+      # Fails closed. `Rails.env.production?` let a conventional
+      # RAILS_ENV=staging deploy print one line of stderr and precompile the
+      # source anyway, and the same held for review apps and any custom
+      # environment name. `local?` is true only for development and test — the
+      # two environments where exposure is acceptable — so everything else is
+      # treated as deployed. Available since Rails 7.1, which is the floor.
+      def production_env?
+        return false unless defined?(::Rails) && ::Rails.respond_to?(:env)
+        return !::Rails.env.local? if ::Rails.env.respond_to?(:local?)
+        !%w[development test].include?(::Rails.env.to_s)
+      end
+      # An asset path is only a problem when component source actually sits
+      # under it, so an app that keeps sidecar assets in their own directory is
+      # left alone.
+      def offending_paths(app)
+        components = components_dir(app)
+        return [] unless components&.directory?
+        asset_paths(app).select { |path| publishes_source?(path, components) }
+      end
+      # Whether serving this asset path would serve component source.
+      #
+      # `source_files?` used to be asked once about app/components as a whole,
+      # which is the wrong question for a descendant path: with that shape,
+      # app/components/assets holding nothing but CSS looked identical to
+      # app/components/senren holding every component. Only the overlapping
+      # subtree can publish anything, and that subtree is the deeper of the two
+      # paths.
+      def publishes_source?(asset_path, components)
+        asset = Pathname.new(asset_path.to_s).expand_path
+        components = components.expand_path
+        return false unless overlap?(asset, components)
+        source_files?(asset.to_s.length >= components.to_s.length ? asset : components)
+      end
+      def components_dir(app)
+        app.root.join('app/components')
+      rescue StandardError
+        nil
+      end
+      def source_files?(dir)
+        SOURCE_EXTENSIONS.any? { |ext| Dir.glob(dir.join("**/*#{ext}")).any? }
+      end
+      def asset_paths(app)
+        app.config.respond_to?(:assets) ? Array(app.config.assets.paths) : []
+      rescue StandardError
+        []
+      end
+      # Two paths overlap when one contains the other, in EITHER direction, and
+      # the test has to be separator-aware:
+      #
+      #   app/components         is an ancestor  -> publishes everything
+      #   app/components/senren  is a descendant -> publishes the components
+      #   app/comp               shares a prefix -> publishes nothing
+      #
+      # The first version tested only the ancestor direction with a bare
+      # start_with?, so it missed the descendant case — which is what a
+      # developer writes after reading this module's own remediation text — and
+      # it blocked production boots over an unrelated app/comp directory.
+      def overlap?(one, other)
+        a = "#{one}#{File::SEPARATOR}"
+        b = "#{other}#{File::SEPARATOR}"
+        a.start_with?(b) || b.start_with?(a)
+      end
+      def message_for(offenders)
+        <<~MESSAGE.strip
+          app/components is on the asset load path (#{offenders.join(', ')}).
+          Propshaft serves every file under an asset path, so your component
+          .rb and .html.erb source would be published — assets:precompile copies
+          them into public/assets and .manifest.json lists them by name.
+          Move sidecar assets into their own directory and add that instead, for
+          example app/components/assets rather than app/components.
+        MESSAGE
+      end
+    end
+  end
+end

data/lib/senren/rails/base_component_patch.rb ADDED Viewed

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+module Senren
+  module Rails
+    # Ruby appended to a host app's existing BaseComponent when it predates the
+    # URL-aware component templates.
+    #
+    # This duplicates the helpers in
+    # lib/generators/senren/install/templates/base_component.rb.tt, because
+    # apps installed before those helpers existed never receive the template
+    # again. The two definitions are pinned together by
+    # test/security/component_url_security_test.rb: if they drift, migrated apps
+    # silently keep an older, weaker safe_url.
+    module BaseComponentPatch
+      # Single-quoted heredoc: the body is emitted verbatim, so the backslash
+      # escapes inside safe_url survive into the host app's file.
+      URL_HELPERS = <<~'RUBY'
+        # Added by senren:add for compatibility with URL-aware component templates.
+        require 'uri'
+        module Senren
+          class BaseComponent
+            SAFE_URL_PROTOCOLS = %w[http https mailto tel].freeze unless const_defined?(:SAFE_URL_PROTOCOLS)
+            SAFE_MEDIA_URL_PROTOCOLS = %w[http https].freeze unless const_defined?(:SAFE_MEDIA_URL_PROTOCOLS)
+            private
+            def safe_url(value, fallback: '#', protocols: SAFE_URL_PROTOCOLS)
+              url = value.to_s.strip
+              return fallback if url.empty?
+              # Browsers treat "\" as "/" for special schemes and strip TAB/CR/LF
+              # before parsing, so "/\evil.example" and "/<TAB>/evil.example" would
+              # both slip past a plain "//" check and resolve off-origin.
+              return fallback if url.include?('\\')
+              return fallback if url.match?(/[[:cntrl:]]/)
+              return url if url.start_with?('#')
+              # Any leading "//" is protocol-relative regardless of how many slashes
+              # follow. Rejecting here rather than relying on URI.parse matters:
+              # URI.parse("///evil.example") reports no scheme and no host, so the
+              # scheme-less fallback below would otherwise hand back a URL the browser
+              # resolves to https://evil.example/.
+              return fallback if url.start_with?('//')
+              return url if url.start_with?('/')
+              uri = URI.parse(url)
+              return url if uri.scheme && Array(protocols).map(&:to_s).include?(uri.scheme.downcase)
+              return fallback if uri.host
+              return url unless uri.scheme
+              fallback
+            rescue URI::InvalidURIError
+              fallback
+            end
+            def safe_media_url(value, fallback: nil)
+              safe_url(value, fallback: fallback, protocols: SAFE_MEDIA_URL_PROTOCOLS)
+            end
+          end
+        end
+      RUBY
+    end
+  end
+end