tep 0.11.5 → 0.11.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a0f6e0ace2299c85ad62734b3af3b5b5a704994d2c0769f3151f1741b2c7ec26
-  data.tar.gz: 0d57c798029526125f7698d20c9f6419c557381b0d99ebb55be2ca35a8e819d4
+  metadata.gz: f69c2e25a18f0ad96cc6a765e9655cc130c35ecc90fe006715409868c8e69e72
+  data.tar.gz: bfe36187e4d9565b03c58b37ac1e0243f96dbe3b888752983acc6d6f87595fc7
 SHA512:
-  metadata.gz: c5bc56857336297807d32345e8957dfafb714c6f15445da6b69a833b2d41090a4c3a8918ca89f5ec02bdbb593db1ed79996fb3ef5a271aec768358fe26604e67
-  data.tar.gz: 8fadaa359cdee7cd715e61e89c83ce29e82d471cfb2f00489c365f98078f7d50368aba77542fbe5e3fa6873898803a499c77913fac2dd32e01914cf3bdb7d5d0
+  metadata.gz: 65c8b19acd15c4548a98a3db081e5f0c9d5b73068b8e99744e9064a35f1a4cdc920aa0a447061d708cd889155c5034efc6303532abee38869b193b5a1d10241d
+  data.tar.gz: 6307c6fefde2da3b7a3e67480d1c59ab051527c62796d03971fe25e1596c0fbee7271ea9d9d531b458ec310b99758e9d81b075d1f4c139d9500c25afc677a71a

data/README.md

@@ -4,37 +4,41 @@
 
 # Tep
 
-A Sinatra-flavoured web framework that compiles to a native binary
-via [Spinel][spinel].
+A Sinatra-flavoured web framework that compiles to a **native binary**
+via [Spinel][spinel]. You write a Sinatra-style `app.rb`:
 
-> **Current release:** [v0.11.0](https://github.com/OriPekelman/tep/releases/tag/v0.11.0)
-> — now on [RubyGems](https://rubygems.org/gems/tep) (`gem install tep`):
-> TLS, HTTP caching, connection pooling, PG raise-on-error + embeddings,
-> on top of the agentic surface (Auth, Broadcast, Presence, LiveView, MCP).
+```ruby
+require 'sinatra'
+
+get '/hi/:name' do
+  "hi, " + params[:name] + "!"
+end
+```
+
+…and get `./app` — a single static executable, ~80 KB, **no Ruby
+runtime**, doing ~150k req/s. Beyond routing / sessions / templates, the
+[batteries ↓](#whats-in-the-box) cover auth (bearer / cookie / OAuth2),
+SQLite, opt-in PostgreSQL, WebSockets, Broadcast + Presence + LiveView,
+an MCP tool catalog, TLS, a pooled HTTP client, and an OpenAI-compatible
+LLM client + server.
+
+> **Current release:** [v0.11.7](https://github.com/OriPekelman/tep/releases/tag/v0.11.7)
+> on [RubyGems](https://rubygems.org/gems/tep) — `gem install tep`.
 > Pre-alpha; API still in motion.
 
-> **Why Tep exists.** Two complementary goals:
->
-> 1. **Exercise Spinel against real-world Ruby code.** Tep is the
->    largest pure-Ruby application Spinel compiles end-to-end. Every
->    Sinatra idiom, every battery, every demo doubles as a torture
->    test for the AOT compiler's codegen + analyzer. Bugs surface
->    here, get reduced to minimal repros, and land upstream as PRs
->    or issues against [matz/spinel](https://github.com/matz/spinel).
->    If something doesn't work in Tep, the bug is usually in Spinel,
->    and that's the point.
->
-> 2. **Be the harness for [toy][toy].** Toy is Tep's sibling
->    project: a machine-learning framework written in pure Ruby and
->    compiled by Spinel. Toy needs an HTTP/MCP layer for serving
->    models, exposing training tools to agents (Claude Code et al.),
->    streaming inference results, and wiring presence into
->    collaborative training sessions. Tep is that layer. Every
->    battery in Tep is shaped by what Toy actually needs to ship.
->
-> Tep happens to be useful as a general web framework too — fast,
-> single-binary, Sinatra-shaped — but the design choices are made
-> through these two lenses.
+<details>
+<summary><b>Why Tep exists</b> — it's a deliberate Spinel torture test + toy's serving layer</summary>
+
+Tep is the largest pure-Ruby application Spinel compiles end-to-end:
+every Sinatra idiom and battery doubles as a torture test for the AOT
+compiler's codegen + analyzer, and bugs found here get reduced to
+minimal repros and land upstream as
+[matz/spinel](https://github.com/matz/spinel) PRs. It's also the
+HTTP / MCP / serving layer for its sibling [toy][toy] — a pure-Ruby ML
+framework Spinel compiles — so every battery is shaped by what toy
+needs to ship. Tep is a genuinely useful general web framework too, but
+the design choices are made through those two lenses.
+</details>
 
 [toy]: https://github.com/OriPekelman/toy
 
@@ -107,7 +111,7 @@ gem install. Recommended Ruby manager:
 [`rv`](https://github.com/spinel-coop/rv) — fast version+gem
 manager from the Spinel Cooperative (separate project from the
 matz/spinel AOT compiler Tep compiles through; same Ruby
-neighbourhood). `.ruby-version` in this repo pins 3.4.0; `rv
+neighbourhood). `.ruby-version` in this repo pins 4.0.0; `rv
 shell` makes `rv run rake test` just work. Build deps on Linux:
 `build-essential`, `libsqlite3-dev`. macOS: Xcode CLI tools.
 
@@ -174,7 +178,7 @@ through Spinel.
 | `Tep::WebSocket` | RFC 6455 server-side WebSocket. `websocket '/chat' do \|ws\| ... end` DSL lowers to Frame + Handshake + Driver + Connection. Requires `set :scheduler, :scheduled`. |
 | `Tep::Parallel`  | grosser/parallel-shaped fork fan-out. |
 | `Tep::Job`       | sidekiq-shaped queue over SQLite. |
-| `PG`             | ruby-pg-shape libpq client: `PG::Connection`, `PG::Result`, `PG::Error`; surface mirrors the `pg` gem (`exec` / `exec_params` / `escape_*` / `fields` / `values` / `getvalue` / `sql_state`). Designed so an eventual ActiveRecord-on-spinel port reuses the existing AR adapter with minimal divergence — see `docs/PG-BATTERY.md`. |
+| `PG`             | **Opt-in** ruby-pg-shape libpq client — `require "tep/pg"` (so non-PG apps don't link libpq). `PG::Connection`, `PG::Result`, `PG::Error`; surface mirrors the `pg` gem (`exec` / `exec_params` / `escape_*` / `fields` / `values` / `getvalue` / `sql_state`). Designed so an eventual ActiveRecord-on-spinel port reuses the existing AR adapter with minimal divergence — see `docs/PG-BATTERY.md`. |
 | `Tep::Auth`      | Principal+delegate identity (`Tep::Identity` / `Tep::AgentDelegation`) + provider chain. Three providers shipped: `Tep::AuthBearerToken` (JWT-HS256), `Tep::AuthSessionCookie` (signed cookie), `Tep::AuthOAuth2` (authorization-code grant issuance for bots/agents). Same `req.identity` surface regardless of provider; agents are first-class (`identity.agent?`, `identity.acting_via.agent_id`, capability subsetting). |
 | `Tep::Broadcast` | In-process pub-sub + cross-worker via PG LISTEN/NOTIFY. Subscribe an fd to a topic (`subscribe` raw, `subscribe_ws` WS-frame-wrapped); publish writes to every matching subscriber. The seam Presence and LiveView build on. |
 | `Tep::Presence`  | Topic-keyed who's-here registry, agent-aware. `Tep::Presence.track(req, topic, fd)` records a (principal, session, topic) tuple with a 3-state structured status (`:available | :busy | :blocked` + free-text note + expiry). Diffs broadcast on join/leave/status; PG-mirror for cross-worker `list_global` snapshots. |

data/bin/tep

@@ -86,7 +86,14 @@ def fatal(msg)
 end
 
 # Build the translated Ruby source from a Sinatra-style file.
-def translate(input_path)
+#
+# Strict by default (mirror condition 3, docs/mirrors/sinatra.md):
+# any construct the translator would drop -- Rack `use`, `helpers`,
+# unknown `set` keys, on_stop, malformed DSL blocks, missing views --
+# is a fatal error, because building anyway produces a binary that
+# silently diverges from what the same source does under real
+# sinatra. `--lax` (or TEP_LAX=1) restores warn-and-continue.
+def translate(input_path, lax: ENV["TEP_LAX"] == "1")
   raw_source = File.read(input_path)
 
   # Split off `__END__` inline templates. Sinatra's convention is
@@ -909,7 +916,19 @@ def translate(input_path)
   RB
   out << ""
 
-  warnings.each { |w| warn "tep: #{w}" }
+  if warnings.any?
+    if lax
+      warnings.each { |w| warn "tep: #{w}" }
+      warn "tep: --lax: built with #{warnings.length} dropped construct(s); " \
+           "behaviour diverges from real sinatra where they applied"
+    else
+      warnings.each { |w| warn "tep: error: #{w}" }
+      fatal "#{warnings.length} unsupported construct(s) -- refusing to build " \
+            "a binary that silently diverges (docs/mirrors/sinatra.md, " \
+            "condition 3). Re-run with --lax (or TEP_LAX=1) to drop them " \
+            "with a warning instead."
+    end
+  end
 
   out.join("\n")
 end
@@ -1596,8 +1615,12 @@ def rewrite_block(src, force_string: true)
   # `headers["X"] = "y"` -> `res.headers[...]` when not already qualified
   s = s.gsub(/(?<![\w.])headers\[/, "res.headers[")
 
-  # `cookies["k"]` -> `req.cookies["k"]` when not already qualified
-  s = s.gsub(/(?<![\w.])cookies\[/, "req.cookies[")
+  # `cookies["k"] = v` (write) -> direct hash write; `cookies["k"]`
+  # (read) -> Tep.cookie(req, "k"), which nil-guards the miss: the
+  # documented cookies[] contract is ""-on-miss (test_cookies pins
+  # it), but the underlying hash reads nil for a missing key.
+  s = s.gsub(/(?<![\w.])cookies\[([^\]]*)\]\s*=(?![=~])/, 'req.cookies[\1] =')
+  s = s.gsub(/(?<![\w.])cookies\[([^\]]*)\]/, 'Tep.cookie(req, \1)')
 
   # `erb :name`              -> `tep_view_name(Tep.str_hash, req.ivars)`
   # `erb :name, locals: {a: "b", c: "d"}` -> build a String=>String
@@ -1610,7 +1633,14 @@ def rewrite_block(src, force_string: true)
     # are handled separately so they can contain commas or spaces.
     pairs = $2.scan(/(\w+):\s*("[^"]*"|'[^']*'|[^,}]+?)\s*(?=,|\z)/)
     setters = pairs.map { |k, v| %{__l["#{k}"] = (#{v.strip}).to_s} }.join("; ")
-    "(__l = Tep.str_hash; #{setters}; tep_view_#{view}(__l, req.ivars))"
+    # Build the locals hash INSIDE the first argument (a sequence
+    # expression that returns __l), rather than `(__l = ...; render(__l))`
+    # with __l a bare arg. In the latter shape spinel (recent master)
+    # hoists the `render`'s arg temp -- `_t = __l` -- above the in-sequence
+    # `__l = str_hash()` assignment, so render receives the pre-assignment
+    # (empty) hash and every interpolated value blanks (matz/spinel#1478).
+    # Keeping the assignment inside the arg evaluation defeats the hoist.
+    "tep_view_#{view}((__l = Tep.str_hash; #{setters}; __l), req.ivars)"
   end
   s = s.gsub(/(?<![\w.])erb\s+:(\w+)/, 'tep_view_\1(Tep.str_hash, req.ivars)')
 
@@ -1619,7 +1649,8 @@ def rewrite_block(src, force_string: true)
     view = $1
     pairs = $2.scan(/(\w+):\s*("[^"]*"|'[^']*'|[^,}]+?)\s*(?=,|\z)/)
     setters = pairs.map { |k, v| %{__l["#{k}"] = (#{v.strip}).to_s} }.join("; ")
-    "(__l = Tep.str_hash; #{setters}; tep_mustache_#{view}(__l, req.ivars))"
+    # Same arg-hoist avoidance as the erb form above (matz/spinel#1478).
+    "tep_mustache_#{view}((__l = Tep.str_hash; #{setters}; __l), req.ivars)"
   end
   s = s.gsub(/(?<![\w.])mustache\s+:(\w+)/, 'tep_mustache_\1(Tep.str_hash, req.ivars)')
 
@@ -1689,6 +1720,12 @@ def rewrite_block(src, force_string: true)
   # to string keys.
   s = s.gsub(/(req\.params)\[:(\w+)\]/, '\1["\2"]')
 
+  # Read form -> Tep.param(req, k), which nil-guards the miss: tep's
+  # documented params[] contract is ""-on-miss (test_params pins it;
+  # ledgered as a sinatra divergence -- sinatra reads nil). Writes
+  # (assignment) stay direct hash writes.
+  s = s.gsub(/req\.params\[([^\]]*)\](?!\s*=[^=~])/, 'Tep.param(req, \1)')
+
   # `"#{params['x']}"` interpolation works fine after the params rewrite.
 
   # String-coerce the last expression of the block body. Spinel's
@@ -2168,23 +2205,25 @@ def cmd_build(args)
   input    = nil
   out_path = nil
   c_only   = false
+  lax      = ENV["TEP_LAX"] == "1"
   i = 0
   while i < args.length
     a = args[i]
     case a
     when "-o" then out_path = args[i + 1]; i += 2
     when "-c" then c_only = true; i += 1
+    when "--lax" then lax = true; i += 1
     when /^-/ then fatal "unknown option: #{a}"
     else
       input ||= a
       i += 1
     end
   end
-  fatal "usage: tep build app.rb [-o out] [-c]" unless input
+  fatal "usage: tep build app.rb [-o out] [-c] [--lax]" unless input
 
   base = File.basename(input, ".rb")
   out_path ||= File.join(File.dirname(input), base)
-  translated = translate(input)
+  translated = translate(input, lax: lax)
 
   # Spinel's require_relative resolves against the source file's
   # directory and chokes on absolute paths. Drop the generated file
@@ -2222,8 +2261,10 @@ def cmd_run(args)
 end
 
 def cmd_translate(args)
-  input = args.first or fatal "usage: tep translate app.rb"
-  puts translate(input)
+  lax = ENV["TEP_LAX"] == "1"
+  lax = true if args.delete("--lax")
+  input = args.first or fatal "usage: tep translate app.rb [--lax]"
+  puts translate(input, lax: lax)
 end
 
 case ARGV.shift
@@ -2235,9 +2276,14 @@ when nil, "-h", "--help"
     tep -- Sinatra-flavoured framework that compiles to a native binary.
 
     Usage:
-      tep build app.rb [-o out] [-c]    translate + spinel-compile
-      tep run   app.rb [-p PORT] [-w N] build then exec
-      tep translate app.rb               print the translated Ruby
+      tep build app.rb [-o out] [-c] [--lax]  translate + spinel-compile
+      tep run   app.rb [-p PORT] [-w N]       build then exec
+      tep translate app.rb [--lax]            print the translated Ruby
+
+    Strict by default: source constructs tep would have to drop
+    (Rack `use`, `helpers do`, unknown `set` keys, ...) fail the
+    build rather than silently diverging from real sinatra.
+    `--lax` (or TEP_LAX=1) downgrades them to warnings.
 
     Source compatibility: top-level `get '/path' do ... end`,
     `post`, `put`, `patch`, `delete`, `before`, `after`, `not_found`,

data/examples/blog/app.rb

@@ -332,6 +332,7 @@ end
 post '/api/posts' do
   res.headers["Content-Type"] = "application/json"
   auth = req.req_headers["authorization"]
+  auth = "" if auth.nil?     # missing header reads as nil (tep#235)
   bearer = ""
   if auth.length > 7 && auth[0, 7] == "Bearer "
     bearer = auth[7, auth.length - 7]

data/examples/experiments/app.rb

@@ -218,7 +218,9 @@ end
 # baked in. Here, accept an X-Demo-Cap-Run header as the
 # capability source so humans can drive the demo with curl.
 before do
-  if req.req_headers["x-demo-cap-run"].length > 0
+  cap = req.req_headers["x-demo-cap-run"]
+  cap = "" if cap.nil?     # missing header reads as nil (tep#235)
+  if cap.length > 0
     req.identity = Tep::Identity.new(
       "user:demo", nil, [:run_experiments])
   end

data/examples/pg_hello.rb

@@ -68,15 +68,16 @@ get '/error' do
     out = "rescued PG::UndefinedTable\n" +
           "sqlstate: " + c.last_sqlstate + "\n" +
           "is undefined-table? " + (c.last_sqlstate == "42P01" ? "yes" : "no") + "\n" +
-          # WORKAROUND -- REMOVE WHEN UPSTREAM LANDS: `e.is_a?(PG::Error)`
-          # miscompiles at spinel master (whole-program is_a? on a deep
-          # exception subclass vs an ancestor -- e here is rescued as
-          # PG::UndefinedTable, a PG::Error subclass, so this is always
-          # "yes"). Minimal `rescue Sub => e; e.is_a?(Super)` repros
-          # compile fine; it only trips in the full program. Hardcoded
-          # to "yes" to keep the example building for the re-pin. See
-          # matz/spinel#1434, tep#196. Original:
+          # WORKAROUND -- still open at SPINEL_PIN (re-checked at the
+          # ad2b71ad re-pin: `e.is_a?(PG::Error)` here is rejected as
+          # `unsupported call: is_a? recv=LocalVariableRead argc=1`).
+          # `e` is the rescued exception, typed PG::UndefinedTable -- a
+          # whole-program is_a? against the namespaced ancestor PG::Error
+          # isn't lowered yet. Minimal `rescue Sub => e; e.is_a?(Super)`
+          # compiles fine; only the full program trips it. Since `e` is
+          # always a PG::Error subclass here, hardcode "yes". Restore
           #   (e.is_a?(PG::Error) ? "yes" : "no")
+          # once is_a?-on-rescued-namespaced-ancestor lowers. See tep#196.
           "is PG::Error? " + "yes" + "\n" +
           "message: " + e.message
   end

data/lib/tep/app.rb

@@ -187,6 +187,7 @@ module Tep
       secret = Tep.session_secret
       if secret.length > 0
         cv = req.cookies[Tep::COOKIE_NAME]
+        cv = "" if cv.nil?
         if cv.length > 0
           req.session.load_from(cv, secret)
         end

data/lib/tep/auth_bearer_token.rb

@@ -47,6 +47,7 @@ module Tep
     # signature / expired / malformed payload.
     def self.try(req)
       header = req.req_headers["authorization"]
+      header = "" if header.nil?
       if header.length < 8 || header[0, 7] != "Bearer "
         return nil
       end

data/lib/tep/auth_session_cookie.rb

@@ -84,12 +84,16 @@ module Tep
     # if the session has no identity (no prior #set call, or after
     # #clear) or the stored identity is expired.
     def self.try(req)
+      # Session#get on a missing key reads as nil (sinatra-parity Hash
+      # semantics; same class as tep#235) -- guard before String calls.
       sub = req.session.get("identity_sub")
+      sub = "" if sub.nil?
       if sub.length == 0
         return nil
       end
 
       exp_str = req.session.get("identity_exp")
+      exp_str = "" if exp_str.nil?
       if exp_str.length > 0
         exp = exp_str.to_i
         if exp > 0 && Time.now.to_i >= exp
@@ -98,9 +102,11 @@ module Tep
       end
 
       caps_str = req.session.get("identity_caps")
+      caps_str = "" if caps_str.nil?
       caps = Tep::AuthBearerToken.parse_caps(caps_str)
 
       delegate_str = req.session.get("identity_delegate")
+      delegate_str = "" if delegate_str.nil?
       delegation = Tep::AuthBearerToken.parse_delegate(delegate_str)
 
       Tep::Identity.new(sub, delegation, caps)

data/lib/tep/cache.rb

@@ -18,8 +18,10 @@ module Tep
       # tag is matched as a substring so a comma-separated list of tags
       # in If-None-Match works.
       etag = res.headers["ETag"]
+      etag = "" if etag.nil?
       if etag.length > 0
         inm = req.headers["if-none-match"]
+        inm = "" if inm.nil?
         if inm.length > 0
           if inm == "*"
             return true
@@ -35,6 +37,7 @@ module Tep
       lm = res.lastmod_epoch
       if lm > 0
         ims = req.headers["if-modified-since"]
+        ims = "" if ims.nil?
         if ims.length > 0
           ims_epoch = Sock.sphttp_parse_http_date(ims)
           if ims_epoch >= 0 && lm <= ims_epoch

data/lib/tep/http.rb

@@ -9,10 +9,12 @@
 # plumbing (sphttp_connect, sphttp_set_nonblock, sphttp_recv_*); the
 # missing piece is the HTTP/1.0 client on top.
 #
-# Scope (v1)
-# ----------
-# * **HTTP only** -- no TLS. Talk to internal services, the local
-#   Ollama API, vLLM, your own tep-backed sidecars.
+# Scope
+# -----
+# * **http + https** -- outbound TLS landed in #150
+#   (Sock.sphttp_connect_tls; non-blocking handshake under the
+#   scheduled server). Talk to internal services, the local Ollama
+#   API, vLLM, your own tep-backed sidecars, or external https APIs.
 # * **HTTP/1.0 + Connection: close** -- one socket per request,
 #   read until EOF. No keep-alive, no pipelining.
 # * **No chunked-transfer reading** -- assumes Content-Length or
@@ -24,7 +26,7 @@
 #
 # These limits cover the dashboard's needs (talking to local
 # inference backends) and the bulk of "hit an internal API"
-# workloads. HTTPS + keep-alive + chunked land as a v2 surface.
+# workloads. Keep-alive + chunked reading land as a v2 surface.
 #
 # API shape
 # ---------

data/lib/tep/openai_server.rb

@@ -141,7 +141,10 @@ module Tep
         def self.serve!(events_jsonl = "")
           events = Tep::Events.new(events_jsonl)
           Tep::APP.set_openai_events(events)
+          # ENV[] reads nil for an unset variable (CRuby semantics) --
+          # guard before String calls (same class as tep#235).
           host = ENV["HOSTNAME"]
+          host = "" if host.nil?
           if host.length == 0
             host = "tep"
           end

data/lib/tep/parser.rb

@@ -55,8 +55,11 @@ module Tep
       end
 
       # Parse Cookie header into req.cookies. Format: "k=v; k2=v2; ...".
-      # Whitespace around `;` is allowed and stripped.
+      # Whitespace around `;` is allowed and stripped. A request with no
+      # Cookie header reads as nil (don't call methods on it: spinel's
+      # unresolved-call gate raises NoMethodError, same as CRuby).
       cookie_blob = req.req_headers["cookie"]
+      cookie_blob = "" if cookie_blob.nil?
       if cookie_blob.length > 0
         cookie_blob.split(";").each do |pair|
           eq = Tep.str_find(pair, "=", 0)

data/lib/tep/pg.rb

@@ -190,6 +190,16 @@ module PG
       @last_sqlstate = ""
       @last_error_message = ""
       @last_result_rh = -1
+      # Never-connected sentinel: PG::Connection.new("") is the
+      # type-seeding shape (see the _tep_seed_pg_* block). Exec on a
+      # seed conn returns the empty-Result sentinel instead of
+      # raising -- a REAL failed connect (non-empty conninfo) still
+      # raises PG::UnableToSend on first exec, per the documented
+      # non-raising-connect / raising-exec contract.
+      @seed_conn = false
+      if opts.is_a?(String) && opts.length == 0
+        @seed_conn = true
+      end
       if opts.is_a?(String)
         if Tep::Scheduler.scheduled_context?
           h = Connection.async_connect(opts)
@@ -197,34 +207,19 @@ module PG
           h = Pg.tep_pg_connect(opts)
         end
       else
-        # ============ WORKAROUND -- REMOVE WHEN UPSTREAM LANDS ============
-        # Hash-conninfo form. The `opts.each` below miscompiles at spinel
-        # master: `opts` is a String|Hash param, but in this is_a?(String)
-        # ELSE branch spinel types it String (the is_a?-else narrowing
-        # gap, matz/spinel#1434) and rejects `opts.each` as String#each
-        # -- the lone blocker to re-pinning tep onto master (tep#196).
-        #
-        # The Hash form is currently UNUSED + untested in tep and toy:
-        # every PG::Connection.new / PG.connect caller passes a String
-        # conninfo (AR connects with the String form too). So we stub
-        # this dead branch to a failed connection to unblock the re-pin.
-        #
-        # RESTORE the original kv-pack loop (preserved below) once the
-        # upstream narrowing fix lands, and re-add Hash-form test
-        # coverage. Until then a Hash arg yields a failed Connection
-        # (connected? == false) rather than a miscompile.
-        #
-        #   keys = ""
-        #   vals = ""
-        #   n = 0
-        #   opts.each do |k, v|
-        #     keys = keys + k + "\0"
-        #     vals = vals + v + "\0"
-        #     n += 1
-        #   end
-        #   h = Pg.tep_pg_connect_kv(keys, vals, n)
-        h = -1
-        # =================================================================
+        # Hash-conninfo form: pack the key/value pairs into NUL-delimited
+        # buffers for the C shim. (`opts` narrows to Hash in this
+        # is_a?(String) ELSE branch -- the narrowing gap that blocked the
+        # re-pin, matz/spinel#1434, is fixed as of the SPINEL_PIN bump.)
+        keys = ""
+        vals = ""
+        n = 0
+        opts.each do |k, v|
+          keys = keys + k + "\0"
+          vals = vals + v + "\0"
+          n += 1
+        end
+        h = Pg.tep_pg_connect_kv(keys, vals, n)
       end
       if h < 0
         # Slot 0 holds the most recent connect-failure error message
@@ -397,6 +392,9 @@ module PG
       Pg.tep_pg_set_nonblocking(@pgh, 1)
       ok = Pg.tep_pg_send_query(@pgh, sql)
       if ok != 1
+        if @seed_conn
+          return PG::Result.new(-1)
+        end
         Connection.raise_send_failure(self)
       end
       Connection.drain_send(@pgh)
@@ -436,6 +434,9 @@ module PG
       Pg.tep_pg_set_nonblocking(@pgh, 1)
       ok = Pg.tep_pg_send_query_params(@pgh, sql)
       if ok != 1
+        if @seed_conn
+          return PG::Result.new(-1)
+        end
         Connection.raise_send_failure(self)
       end
       Connection.drain_send(@pgh)

data/lib/tep/proxy.rb

@@ -62,7 +62,7 @@ module Tep
   # wins (whichever setter you called second).
   #
   # Default shape: max_attempts=1 (no retry, back-compat).
-  class Proxy
+  class Proxy < Tep::Handler
     class RetryPolicy
       attr_accessor :max_attempts, :base_backoff_ms, :backoff_multiplier
       attr_accessor :retry_on_status
@@ -125,7 +125,7 @@ module Tep
     end
   end
 
-  class Proxy < Tep::Handler
+  class Proxy
     attr_accessor :upstream, :timeout
     # Body size caps (chunk 6.6). max_request_body_bytes bounds the
     # inbound body the proxy will accept (over -> 413 Payload Too

data/lib/tep/request.rb

@@ -51,11 +51,16 @@ module Tep
     def headers; @req_headers; end
     def body;    @raw_body;    end
 
-    # Spinel's Hash[k] returns "" for missing string keys, not nil --
-    # so an empty Connection header looks the same as no header at all.
-    # We treat both as "use HTTP/1.1 default behaviour".
+    # A missing header reads as nil (CRuby Hash semantics; spinel's
+    # unresolved-call gate raises NoMethodError on nil receivers, same
+    # as CRuby would). Guard before calling String methods; an empty
+    # header and no header both mean "use HTTP/1.1 default behaviour".
+    # NOTE: guard with `x = "" if x.nil?`, not `x || ""` -- the ||-form
+    # mis-compiles at spinel pin f6d5eef (blanks the hit value).
     def keep_alive?
-      lc = @req_headers["connection"].downcase
+      lc = @req_headers["connection"]
+      lc = "" if lc.nil?
+      lc = lc.downcase
       if lc == "close"
         return false
       end
@@ -70,7 +75,9 @@ module Tep
     end
 
     def form?
-      @req_headers["content-type"].downcase.start_with?("application/x-www-form-urlencoded")
+      ct = @req_headers["content-type"]
+      ct = "" if ct.nil?
+      ct.downcase.start_with?("application/x-www-form-urlencoded")
     end
 
     # True when the request body is a multipart/form-data submission
@@ -78,7 +85,9 @@ module Tep
     # or carrying file inputs). Tep::Multipart.parse handles the
     # text fields; file-upload parts are skipped in v1.
     def multipart?
-      @req_headers["content-type"].downcase.start_with?("multipart/form-data")
+      ct = @req_headers["content-type"]
+      ct = "" if ct.nil?
+      ct.downcase.start_with?("multipart/form-data")
     end
 
     # ---- Rack::Request-style accessors (reads only, no .ip yet) ----
@@ -99,6 +108,7 @@ module Tep
     # proxy sets.
     def scheme
       proto = @req_headers["x-forwarded-proto"]
+      proto = "" if proto.nil?
       if proto.length > 0
         return proto.downcase
       end

data/lib/tep/server.rb

@@ -231,7 +231,11 @@ module Tep
         res.set_body("")
       end
 
-      if res.body.length > 0 && !res.headers.key?("Content-Type")
+      # Default Content-Type even on empty bodies (redirects!) --
+      # sinatra/Rack parity, caught by the differential oracle
+      # (test/differential/runner.rb). 204/304 are the exception:
+      # Rack strips entity headers there, so we don't default one in.
+      if !res.headers.key?("Content-Type") && res.status != 204 && res.status != 304
         res.headers["Content-Type"] = "text/html; charset=utf-8"
       end
       res.headers["Content-Length"] = res.body.length.to_s

data/lib/tep/server_scheduled.rb

@@ -327,11 +327,14 @@ module Tep
           res.file_path = ""
         end
 
-        # Default Content-Type for inline-body responses. Matches
-        # Tep::Server#send; without it, the Security::Headers nosniff
-        # default leaves the browser refusing to interpret an erb
-        # response as HTML.
-        if res.file_path.length == 0 && res.body.length > 0 && !res.headers.key?("Content-Type")
+        # Default Content-Type for inline-body responses -- including
+        # empty ones (redirects), for sinatra/Rack parity (differential
+        # oracle finding; matches Tep::Server). 204/304 excepted: Rack
+        # strips entity headers there. Without a Content-Type, the
+        # Security::Headers nosniff default leaves the browser refusing
+        # to interpret an erb response as HTML.
+        if res.file_path.length == 0 && !res.headers.key?("Content-Type") &&
+           res.status != 204 && res.status != 304
           res.headers["Content-Type"] = "text/html; charset=utf-8"
         end
         reason = Tep.reason(res.status)

data/lib/tep/session.rb

@@ -24,7 +24,15 @@ module Tep
     # exposes only named methods; the translator rewrites
     # `session[k] = v` to `session.set(k, v)` and `session[k]` to
     # `session.get(k)` for source compatibility with Sinatra.
-    def get(k);    @data[k];                          end
+    # A missing key reads as "" -- the documented `session[k]` DSL
+    # contract (test_sessions pins it; a deliberate divergence from
+    # sinatra's nil-on-miss, ledgered in docs/mirrors/sinatra.md).
+    # The raw @data hash reads nil for a miss.
+    def get(k)
+      v = @data[k]
+      v = "" if v.nil?
+      v
+    end
     def set(k, v); @data[k] = v; @dirty = true;       end
     def has?(k);   @data.key?(k);                     end
     def length;    @data.length;                      end