build(deps-dev): bump rails-ai-context from 5.11.2 to 5.16.2

[dependabot]

Bumps rails-ai-context from 5.11.2 to 5.16.2.

Release notes

Sourced from rails-ai-context's releases.

v5.16.2

Fixed

• Standalone static tier works when installed via gem install. tool <name> --no-boot, tool <name> --help, and tool --list outside an app all died with cannot load such file -- active_support/.... The RubyGems binstub eagerly activates the whole dependency tree, so the exe's framework-path strip left every rails-family spec still flagged as activated and Gem.try_activate refused to re-add the stripped paths. The exe now stashes the stripped specs and splices their load paths back at every app-less require site (Bundler-pinned paths still win after a boot). Verified through the real binstub in an empty directory, in an app whose Gemfile does not include the gem, and on the boot-failed static fallback.
• Engine-mounted MCP survives mcp SDK 0.24. The SDK's SSE writer now calls stream.flush after every event, and ActionController::Live::Buffer defines no flush - every SSE-mode tools/call through mount RailsAiContext::Engine 500'd on all supported Rails versions (the payload still arrived, then the request died). The controller now hands the transport a flush-capable stream. Verified with live curl sessions on booted Rails 7.1 and 8.1 apps.
• Engine-mounted GET streams actually stay open. The transport registers the server-push stream and returns; Live then closed the response as soon as the action returned, so the SSE channel died instantly, notifications/tools/list_changed could never be delivered, and (once held open) clients would have waited up to 30s for response headers. The action now commits headers immediately with an SSE comment and holds the thread until the transport or the client closes the stream. SETUP.md documents the one-thread-per-connected-client cost.
• Helpers keep their namespaces. app/helpers/admin/dashboard_helper.rb was reported as DashboardHelper, and looking it up by its real constant name Admin::DashboardHelper failed. Module names now derive from the path under app/helpers (app/helpers/concerns stays its own root, matching the railties autoload glob), and exact path matches win before basename fallbacks so a top-level helper is not shadowed by a namespaced one.
• rails_validate checks qualified render targets in Ruby files. render partial: "posts/missing" in a controller or service passed level:"rails" silently (the partial check only ran for ERB). Bare render "posts/show" keeps template semantics in Ruby files, so the controller template-render idiom is not false-flagged. Tool descriptions now state exactly which column references are checked (validates/permit/callbacks).
• rails_review_changes describes untracked files. New files rendered as empty headings (a fresh app right after rails new plus install showed 20 of them); they now read _new file, N lines_, and only the HEAD flow makes that claim (a committed-then-reverted file against an older ref reads _no diff available_).
• Views resource resolves extension-less paths. Reading

... (truncated)

Changelog

Sourced from rails-ai-context's changelog.

[5.16.2] - 2026-07-17

Fixed

• Standalone static tier works when installed via gem install. tool <name> --no-boot, tool <name> --help, and tool --list outside an app all died with cannot load such file -- active_support/.... The RubyGems binstub eagerly activates the whole dependency tree, so the exe's framework-path strip left every rails-family spec still flagged as activated and Gem.try_activate refused to re-add the stripped paths. The exe now stashes the stripped specs and splices their load paths back at every app-less require site (Bundler-pinned paths still win after a boot). Verified through the real binstub in an empty directory, in an app whose Gemfile does not include the gem, and on the boot-failed static fallback.
• Engine-mounted MCP survives mcp SDK 0.24. The SDK's SSE writer now calls stream.flush after every event, and ActionController::Live::Buffer defines no flush - every SSE-mode tools/call through mount RailsAiContext::Engine 500'd on all supported Rails versions (the payload still arrived, then the request died). The controller now hands the transport a flush-capable stream. Verified with live curl sessions on booted Rails 7.1 and 8.1 apps.
• Engine-mounted GET streams actually stay open. The transport registers the server-push stream and returns; Live then closed the response as soon as the action returned, so the SSE channel died instantly, notifications/tools/list_changed could never be delivered, and (once held open) clients would have waited up to 30s for response headers. The action now commits headers immediately with an SSE comment and holds the thread until the transport or the client closes the stream. SETUP.md documents the one-thread-per-connected-client cost.
• Helpers keep their namespaces. app/helpers/admin/dashboard_helper.rb was reported as DashboardHelper, and looking it up by its real constant name Admin::DashboardHelper failed. Module names now derive from the path under app/helpers (app/helpers/concerns stays its own root, matching the railties autoload glob), and exact path matches win before basename fallbacks so a top-level helper is not shadowed by a namespaced one.
• rails_validate checks qualified render targets in Ruby files. render partial: "posts/missing" in a controller or service passed level:"rails" silently (the partial check only ran for ERB). Bare render "posts/show" keeps template semantics in Ruby files, so the controller template-render idiom is not false-flagged. Tool descriptions now state exactly which column references are checked (validates/permit/callbacks).
• rails_review_changes describes untracked files. New files rendered as empty headings (a fresh app right after rails new plus install showed 20 of them); they now read _new file, N lines_, and only the HEAD flow makes that claim (a committed-then-reverted file against an older ref reads _no diff available_).
• Views resource resolves extension-less paths. Reading

... (truncated)

Commits

• 3d3a588 chore: release v5.16.2 -- standalone static tier and mcp 0.24 compatibility
• 5247857 fix: real-world QA round 2 - standalone static tier, mcp 0.24 SSE compat, and...
• 2d144af fix: engine-mounted MCP on Rails 7.0-7.2 - stream SSE bodies via ActionContro...
• 3ed00e2 fix: real-world QA round - 40+ fixes across transports, static tier, introspe...
• 459a555 chore: release v5.15.0 -- static tier, app shapes, and the compatibility cont...
• b8ace51 Merge pull request #94 from crisnahine/shapes-phase3
• 8ca6cc9 docs: correct shape-matrix framing and two proof citations
• 8b2a625 docs: publish the compatibility matrix and version bounds
• 6e7a018 test: e2e one-file cost - a syntax-broken model does not kill the section
• 109377d feat: loud unsupported-version warning when standalone CLI meets Rails 9
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)