tina4ruby 3.13.144 → 3.13.146

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2e29afb3cbaf02d7c7023e2bac155eb3fd4ceb3493972c3eac8b0f68b117cab9
-  data.tar.gz: 6be275fdaab754c2be7ff562efc12d34ea5cc99c4837260b4e3f5303dbde9fdf
+  metadata.gz: aaafd9078b79dd56e7829b0a92ee162c3eaf471c7102746ed1b119f523f42b8e
+  data.tar.gz: eaa7f47dd692a137d5fce2395696a3f84addfb1feaf8a74b96f936f4177ffcf4
 SHA512:
-  metadata.gz: b491c66de3d3f24e620c7bf75937597befc770644a0f5acfa427c63de5a111c63cb0c346536f995ecb9176dbaf59804856fd24aa3e51eb7c9d66cce712275dfb
-  data.tar.gz: 5dd6c2217a02461313ace92290ddb93d97aaa4e43c2bf972852f0e5eb7ef1e0d02757e43ee95c1e1f3a23eebfc3970316ed45fdc7d73218fdd85f8972aeb7987
+  metadata.gz: 2b50b1109f4b5caf4001fde5141a248c5eaf7d6b9fb691eebe267235f2b7ad2f513b771eefa7233b4b6ef849908aad2e5671b04adee72cdbb674702ba9b2f1a1
+  data.tar.gz: dbc2ffdc2dd55b7ca03b8de790fc24793edf4ff58de61eeec66196444c8bd8788596cc9c518cecf83c1e8021e8710592f3a947e1039a15da2c5f8305c3e955ea

data/CHANGELOG.md

@@ -6,6 +6,21 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.146 — 2026-10-04
+
+### AI skills
+- Every skill now opens with a content list (table of contents) and a degrees-of-freedom legend (what is inviolable, what is a default, what is judgement).
+- New `tina4-cli` skill documents every `tina4` command and flag and the scaffolding discipline.
+- `tina4-maintainer` gains task checklists (PR review, release, installer signing, parity sweep); `tina4-design` split into focused reference files.
+- Skills installer now supports one-level-nested references; `install-skills.ps1` re-signed.
+
+### Framework
+- No framework code changes - the version bump carries the skills release across all four frameworks at parity.
+
+## 3.13.145 — 2026-10-03
+
+Two fixes land together. The Api client no longer carries an application-configured header onto a different origin: credentials travel under many names (`X-Api-Key`, a custom bearer header), so on a cross-origin redirect only content-negotiation and transport headers cross, and every configured or per-call header is bound to the origin it was meant for; a same-origin redirect keeps them. And `tina4ruby migrate` now exits 1 when there is no usable database (unreachable or misconfigured), so CI no longer reads a failed migration as success. Both are proven against real dependencies, no mocks. No runtime gems.
+
 ## 3.13.144 — 2026-10-02
 
 HEAD responses are locked to exactly one `Content-Length` on the wire, equal to the length the GET would have sent. A HEAD emitting two differing `Content-Length` headers is malformed (RFC 7230 s3.3.2); a strict proxy (nginx) 502s it while lenient clients show 200. Ruby already writes a single, correct `Content-Length` with an empty body; this release LOCKS it with a conformance test that boots the real built-in server and reads the raw socket, because the in-process test reads a response object and cannot see the wire - the layer where tina4-php shipped `Content-Length: 0` on every routed HEAD (fixed in the same release). Also internal: the serve-debug readiness harness is unified on the `Server:`-banner identity guard across all four frameworks, and a carbon-benchmark drift (a `to_paginate` call with arguments, which ADR-0043 forbids) is fixed so `carbon_benchmarks.rb --carbon` runs clean. No runtime behaviour change in ruby. The framework still has no required runtime dependencies.

data/lib/tina4/api.rb

@@ -41,6 +41,14 @@ module Tina4
   # master's _STRIP_ON_CROSS_ORIGIN.
   API_STRIP_ON_CROSS_ORIGIN = %w[authorization cookie].freeze
 
+  # The only headers carried onto a different origin. A caller-set header can
+  # hold a credential under any name (X-Api-Key, X-Auth-Token, ...), so a
+  # denylist cannot contain it: the headers configured on the client (and any
+  # per-call header, on a redirect) are bound to the origin they were meant for,
+  # and only these content-negotiation headers cross. Compared case-insensitively.
+  API_KEEP_ON_CROSS_ORIGIN = %w[user-agent accept accept-encoding accept-language
+                                content-type content-length].freeze
+
   # A curated extension -> MIME map for guessing a multipart part's Content-Type
   # from its filename (Ruby core ships no mimetypes db, and pulling one in would
   # break the zero-dependency promise). tina4: a small built-in map covering the
@@ -265,7 +273,7 @@ module Tina4
       return error_response("download requires dest_path", path: nil) unless dest_path
 
       uri = build_uri(path, params)
-      headers = @headers.dup
+      headers = configured_headers(uri).dup
       cookie = cookie_header
       headers["Cookie"] = cookie if @cookies_enabled && cookie
       headers = origin_headers(uri, headers)
@@ -542,11 +550,21 @@ module Tina4
     end
 
     def apply_headers(request, extra_headers)
-      @headers.merge(extra_headers).each do |key, value|
+      configured_headers(request.uri).merge(extra_headers).each do |key, value|
         request[key] = value
       end
     end
 
+    # Headers configured on the client belong to its base origin, like the
+    # token: a target on another origin gets only the cross-origin-safe ones. A
+    # client with no base has no origin to bind them to, and sends them to the
+    # URL each call names.
+    def configured_headers(uri)
+      return @headers if @base_url.empty? || uri.nil? || same_origin?(uri, URI.parse(@base_url))
+
+      keep_cross_origin(@headers)
+    end
+
     # Execute the request with opt-in retry/backoff. Returns an APIResponse.
     #
     # With @max_retries > 0, a transport error (APIResponse#status == 0, the
@@ -591,7 +609,7 @@ module Tina4
     end
 
     # Perform a real HTTP round-trip via Net::HTTP, following redirects in a
-    # bounded loop and stripping Authorization/Cookie on a cross-origin hop.
+    # bounded loop and carrying only API_KEEP_ON_CROSS_ORIGIN headers onto a cross-origin hop.
     # When stream_to is given, a 2xx body is streamed to that path in chunks
     # (never buffered whole) and no file is written on a non-2xx status.
     #
@@ -668,7 +686,7 @@ module Tina4
 
         if location
           new_uri = URI.join(current_uri.to_s, location)
-          current_headers = strip_cross_origin(current_headers) unless same_origin?(current_uri, new_uri)
+          current_headers = keep_cross_origin(current_headers) unless same_origin?(current_uri, new_uri)
           # 301/302/303 downgrade a non-GET/HEAD to GET and drop the body
           # (matches urllib); 307/308 preserve method + body.
           if [301, 302, 303].include?(redirect_code) && !%w[GET HEAD].include?(current_method)
@@ -787,6 +805,10 @@ module Tina4
       headers.reject { |key, _| API_STRIP_ON_CROSS_ORIGIN.include?(key.to_s.downcase) }
     end
 
+    def keep_cross_origin(headers)
+      headers.select { |key, _| API_KEEP_ON_CROSS_ORIGIN.include?(key.to_s.downcase) }
+    end
+
     # Fetch a value from a Hash trying each key as both a symbol and a string.
     def result_value(result, *keys)
       keys.each do |key|

data/lib/tina4/cli.rb

@@ -757,6 +757,19 @@ module Tina4
 
     # ── migrate ───────────────────────────────────────────────────────────
 
+    # The migrate commands cannot do their job without a database, so they
+    # fail. Tina4.initialize! logs a connection error and leaves
+    # Tina4.database nil, and returning here used to exit 0 -- a deploy whose
+    # database URL was wrong, or missing, went on as though it had migrated.
+    def exit_without_database
+      if ENV["TINA4_DATABASE_URL"].to_s.strip.empty?
+        warn "No database configured. Set TINA4_DATABASE_URL in your .env file."
+      else
+        warn "Database unavailable: TINA4_DATABASE_URL is set but could not be opened (see the error above)."
+      end
+      exit 1
+    end
+
     def cmd_migrate(argv)
       options = {}
       parser = OptionParser.new do |opts|
@@ -769,11 +782,7 @@ module Tina4
       require_relative "../tina4"
       Tina4.initialize!(Dir.pwd)
 
-      db = Tina4.database
-      unless db
-        puts "No database configured. Set TINA4_DATABASE_URL in your .env file."
-        return
-      end
+      db = Tina4.database || exit_without_database
 
       migration = Tina4::Migration.new(db)
 
@@ -856,11 +865,7 @@ module Tina4
       require_relative "../tina4"
       Tina4.initialize!(Dir.pwd)
 
-      db = Tina4.database
-      unless db
-        puts "No database configured. Set TINA4_DATABASE_URL in your .env file."
-        return
-      end
+      db = Tina4.database || exit_without_database
 
       migration = Tina4::Migration.new(db)
       info = migration.status
@@ -899,11 +904,7 @@ module Tina4
       require_relative "../tina4"
       Tina4.initialize!(Dir.pwd)
 
-      db = Tina4.database
-      unless db
-        puts "No database configured. Set TINA4_DATABASE_URL in your .env file."
-        return
-      end
+      db = Tina4.database || exit_without_database
 
       migration = Tina4::Migration.new(db)
       results = migration.rollback(options[:steps])

data/lib/tina4/version.rb

@@ -7,5 +7,5 @@
 
 
 module Tina4
-  VERSION = "3.13.144"
+  VERSION = "3.13.146"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.144
+  version: 3.13.146
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-02 00:00:00.000000000 Z
+date: 2026-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sqlite3