fix: message leak, dead report tests, gem packaging (3.0 readiness backlog)

capybara-screenshot-diff.gemspec

@@ -15,9 +15,10 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = ">= 3.2"
   spec.license = "MIT"
   spec.metadata["allowed_push_host"] = "https://rubygems.org/"
-  spec.files = `git ls-files -z`.split("\x0").reject do |f|
-    f.match(%r{(^(\.|tmp|bin|test|spec|features|gemfiles|scripts|foo)/)|(^(\.|Dockerfile|CONTRIBUTING|README))})
-  end
+  # Allow-list: everything a consumer needs at runtime plus the shipped docs.
+  # Build/dev files (gems.rb, Rakefile, the gemspec itself, tests, CI) stay out.
+  spec.files = `git ls-files -z`.split("\x0")
+    .grep(%r{\A(lib/|docs/|README\.md\z|LICENSE\.txt\z|CHANGELOG\.md\z)})
 
   spec.bindir = "exe"
   spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }

lib/snap_diff/comparison_result.rb

@@ -67,8 +67,10 @@ def ratio
       meta[:difference_level]
     end
 
+    # Serializable difference metrics. The raw diff mask image is excluded —
+    # it is an image object, not a metric, and is reachable via #diff_mask.
     def to_h
-      {area_size: region_area_size, region: coordinates}.merge!(meta)
+      {area_size: region_area_size, region: coordinates}.merge!(meta.except(:diff_mask))
     end
 
     def coordinates

test/unit/reporters/default_test.rb

@@ -41,6 +41,22 @@ class Reporters::DefaultTest < ActiveSupport::TestCase
       assert_not reporter.heatmap_diff_path.exist?, "heatmap diff should be cleaned"
     end
 
+    test "failure message reports metrics without leaking image objects" do
+      driver = SnapDiff::Drivers::VipsDriver.new
+      comparison = build_comparison_for(driver, "a.png", "b.png")
+      difference = driver.find_difference_region(comparison)
+      difference.meta[:difference_level] = 0.42
+
+      message = SnapDiff::Reporters::Default.new(difference).generate
+      metrics = message.lines.first
+
+      assert_includes metrics, "area_size"
+      assert_includes metrics, "region"
+      assert_includes metrics, "difference_level"
+      assert_not_includes metrics, "Vips::Image"
+      assert_not_includes metrics, "0x"
+    end
+
     private
 
     def build_comparison_for(driver, *images)