canopus 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dac47b89af1ba7edf042a4fadccd34541f9d5911398fa083e503171df18fe387
-  data.tar.gz: 659e1e6e40f34404ab9d31c8a106792051e8f255e7195b806189124b63d661a9
+  metadata.gz: 0cac04162944df2688afdf9c176a5fc0da5ae0d6bc624ea0435b83616ebcf57e
+  data.tar.gz: 95f7cc4d18be4aa3174d539096dc9365dd341ab94c339a3e236ec746f250c604
 SHA512:
-  metadata.gz: b6a72df6cb9b0846584044cb6f480003f50452c170f54f14aff7b1a53b4801c2824d1acfb4e5f0a2e2e3d16a10631dad64e4f57be5d76ee3a9b567e83b0ecf34
-  data.tar.gz: 2b447543c35849039cdf37b2a2bd78dbe10b57be8fee85468059c1bcb503ef8ce1fc9aace832d07c148d22dd0892f2931e6413ed67c54767ce20e341d525953c
+  metadata.gz: 81ebc4d784dace467207f064df0004978397b7364a320c4a6cdfba16668fa6b3770e22e967dc9fa774986fb6bff4eccc96fa6a0e7b0b051088c7294623d8b03d
+  data.tar.gz: 1e480cb252250bf58ab4c868c03ef1757b1db20d472c78814c467645e3a502478b5b4863b0a1842472b42aefb20847abfbe2b8c395aa72418600f34c2252176c

data/CHANGELOG.md

@@ -2,58 +2,41 @@
 
 ## Unreleased
 
+- Fix Windows terminal reads that could stop before the child process returned output.
+- Complete the API v2 plugin host with declarative UI vocabulary, storage, external providers, and trust-aware operations.
+
+## 0.6.0 — 2026-09-19
+
+- Add the Gienah-backed API v2 plugin host and declarative plugin panels.
+
 ## 0.5.0 — 2026-09-19
 
-- Configure automatic pairs and selection surrounding globally or per language without affecting paste, completion, or Vim insertion.
-
-- Add command-palette actions for cursors at every selected line start or end and selections for every regular-expression match.
-
-- Add rectangular Alt-drag selection and Ctrl-Alt-Up/Down cursor insertion across wrapped Unicode text.
-
-- Track shell commands and working directories through Tarazed OSC 133/7 integration, fold output, show exit status, and navigate command boundaries or failed commands.
-- Split the terminal panel horizontally or vertically, restore its layout and profiles, and inject editor integration variables.
-- Add `--wait` for blocking editor invocations such as `EDITOR="canopus --wait"`.
-- Periodically save bounded private snapshots of dirty buffers and offer valid crash recovery on the next startup.
-- Require Zaniah 0.5.2 so equal-position inline overlays preserve source order on every platform.
-- Delegate language-server protocol transport and lifecycle handling to Sadr.
-- Delegate terminal emulation and POSIX/Windows PTY handling to Tarazed; the editor UI is unchanged.
-- Delegate project walking and content search to Alkaid while retaining Canopus's search and replace UI.
-- Show language-server diagnostics as severity-colored wave underlines and optional line-end messages.
-- Collect LSP, task, and test diagnostics in one bounded registry with a filterable Problems panel and status counts.
-- Run opt-in formatting and configured source actions before saving without letting language-server failures block the write.
-- Route each language through ordered language servers, aggregate completion, diagnostics, and code actions, and restart individual servers.
-- Search symbols from every active routed language server with Cmd-T/Ctrl-T and fall back to bounded Alkaid project search.
-- Load bounded JSONC debug configurations, expand explicit launch variables, and resolve configured adapters.
-- Persist bounded conditional breakpoints with coalesced writes and keep their lines aligned through edits, undo, and redo.
-- Toggle breakpoints from the gutter and edit conditions, hit counts, log messages, and enabled state from its context menu.
-- Start Megrez-backed debug sessions, configure enabled breakpoints, and highlight safe workspace stop locations.
-- Browse stack frames, lazily expand fresh variable paths, reevaluate watches, and list breakpoints in the Debug panel.
-- Evaluate selected-frame REPL and hover expressions and show bounded, ordered adapter output in the Debug Console.
-- Run bounded JSONC project tasks through Tarazed PTYs in interactive, color-preserving Output tabs.
-- Publish bounded single-line, multi-line, and watch task problem matches through the shared diagnostics registry.
-- Keep regex-backed task diagnostics responsive on Ruby 3.1 with one deferred complete-line retry before fail-closed disabling.
-- Discover bounded Minitest and RSpec declarations with Alkaid and Prism and browse them in the Tests panel.
-- Run discovered tests from the gutter, display bounded results, and publish navigable failure diagnostics.
-- Preserve registration order for equal-priority decorations across Ruby versions and platforms.
-- Show cached, viewport-scoped language-server inlay hints inline with clickable label locations.
-- Show cached language-server code lenses above source lines and resolve them only when visible.
-- Highlight language-server read, write, and text occurrences for each visible editor caret.
-- Prefer language-server folding ranges with asynchronous Antares structure fallback.
-- Expand and shrink multiple selections from language-server ranges or asynchronous Antares structure data.
-- Validate rename targets asynchronously before opening the dialog when the language server supports preparation.
-- Underline and safely open language-server document links, resolving targets only when clicked.
-- Turn validated language-server linked ranges into multiple selections from the command palette, with a bounded HTML/XML tag fallback.
-- Browse call and type hierarchies in a lazily loaded side panel.
-- Color nested bracket pairs from Antares structure data and draw display-aware active indentation guides.
-- Render configurable space, tab, and ideographic-space markers without changing display coordinates.
-- Keep the active declaration chain visible with cached LSP symbols and an Antares fallback.
-- Navigate files and the cached declaration hierarchy from editor breadcrumbs.
-- Add an opt-in GUI minimap with shared, edit-aware line textures and Git, search, and diagnostic overview marks.
-- Route LSP, snippet, and extension completion through a bounded provider registry with stable fuzzy ranking.
-- Stage Git files, hunks, and lines and create or amend commits from the Source Control panel.
-- Compare Git changes and revisions inline or side by side, with word highlights and per-file history.
-- Resolve text merge regions in base/ours/theirs panes, stage the completed file atomically, and advance to the next conflict.
-- Browse and search bounded commit graphs, run cancellable authenticated remote transfers, and show cached inline blame on clean or edited buffers.
+### Editing and navigation
+
+- Configure automatic pairs and selection surrounding globally or per language, and edit matching HTML/XML tags together when no language server provides linked ranges.
+- Add rectangular selection, vertical cursor insertion, and multi-cursor commands for selected line starts, line ends, and regular-expression matches, including wrapped Unicode text.
+- Add encoding detection, newline conversion, large-file handling, `.editorconfig` support, automatic save modes, persistent undo, and crash recovery.
+- Add breadcrumbs, an optional minimap, whitespace markers, nested bracket colors, active indentation guides, and language-aware folding and selection expansion.
+- Add inline diagnostics, inlay hints, code lenses, reference highlights, safe document links, rename preparation, and call/type hierarchies.
+
+### Language tooling and debugging
+
+- Support multiple language servers with merged completion, diagnostics, code actions, workspace symbols, and restart recovery; collect results in a filterable Problems panel and run configured formatting or source actions before saving.
+- Add JSONC debug configurations, persistent conditional breakpoints, debug sessions, stack and variable inspection, watches, REPL and hover evaluation, and a Debug Console.
+
+### Terminal, tasks, and tests
+
+- Add shell integration for command boundaries, exit statuses, collapsible output, and working directories, plus split terminal layouts, profiles, and `--wait` for blocking editor invocations.
+- Add interactive project tasks with problem matching in Output tabs, test discovery, and gutter-driven test execution with navigable failure diagnostics.
+
+### Git
+
+- Add source-control staging for files, hunks, and lines; commit and amend support; rich diff and merge-conflict views; history and blame; and authenticated remote operations.
+
+### Settings, plugins, and distribution
+
+- Add schema-driven settings editing and diagnostics, keymap presets, workspace trust, and a plugin registry with theme imports and sandboxed plugins.
+- Add bundled Ruby to packages together with signed package verification, installers, and update feeds.
 
 ## 0.4.0 — 2026-09-15
 

data/README.md

@@ -31,32 +31,14 @@ installable.
 
 ## Features
 
-- Native GPU windows on macOS, Linux, and Windows, plus TUI and headless modes
-- Persistent buffers, tabs, splits, sessions, and explicit save-conflict handling
-- LSP completion, diagnostics, hover, document and workspace symbols, formatting, prevalidated rename, and code actions
-- Bounded debug console output, stopped-frame REPL evaluation, and safe identifier hover evaluation
-- Filterable Problems tree for LSP, task, and test diagnostics, with error and warning status counts
-- Automatic read, write, and text highlights for the symbol at each visible editor's caret
-- Clickable LSP document links with on-demand resolution and safe HTTP or local-file navigation
-- LSP folding ranges with an asynchronous Antares fallback
-- LSP-aware selection expansion with an asynchronous Antares fallback
-- LSP linked-range selection for starting a multi-cursor edit from the command palette
-- Rectangular selection with Alt-drag and vertical cursor insertion
-- Multi-cursor expansion to selected line starts, line ends, or every regular-expression match
-- Lazy call and type hierarchy trees with bidirectional navigation
-- Menkar-based encoding detection, newline display and conversion, and encoding-aware saves
-- Ranked, extensible completion and inline-completion provider registry
-- Viewport-scoped LSP inlay hints with clickable label locations
-- Nested bracket colors and active indentation guides backed by Antares structure analysis
-- Optional GPU minimap with shared line textures, viewport navigation, and overview markers
-- Resizable integrated terminal with tabs, horizontal/vertical splits, profiles, scrollback, OSC 133 command history, colors, and clickable links
-- Bounded JSONC project tasks with color-preserving, interactive Output tabs
-- Git diff and staging, searchable commit graphs, cancellable fetch/pull/push, inline blame, and branch switching
-- Editable project-wide search results and safe project file operations
-- Optional Vim-compatible modes, motions, operators, registers, macros, and Ex commands
-- Layered JSONC settings, keymaps, themes, snippets, and trusted Ruby plugins
-- Overlay-aware wrapping and coordinates for inline hints and block decorations
-- Rendered panel and decoration nodes expose stable `test_id` conventions for UI tests
+- Native GPU windows on macOS, Linux, and Windows, with TUI and headless modes
+- Language-aware editing with LSP completion, diagnostics, code actions, navigation, and multiple language-server support
+- Multi-cursor and rectangular editing, Vim bindings, linked editing, and encoding-aware file handling
+- An integrated terminal with tabs, splits, profiles, shell integration, and `EDITOR="canopus --wait"` support
+- An integrated Git workflow with diff, staging, commits, history, merge-conflict resolution, and remote operations
+- Built-in debugging, interactive tasks, test discovery, and a filterable Problems panel
+- Workspace persistence for tabs, splits, and sessions, plus automatic save, undo history, and crash recovery
+- Extensible JSONC settings, keymaps, themes, and trusted plugins with permission controls and an optional OS sandbox
 
 ## Installation
 
@@ -148,157 +130,44 @@ Run `settings.open` from the command palette to edit project settings. User
 settings live at `$XDG_CONFIG_HOME/canopus/settings.jsonc` or
 `~/.config/canopus/settings.jsonc`.
 
-When enabled (the default), `.editorconfig` is read per file between user and
-project settings. `indent_style`, `indent_size`, `tab_width`,
-`trim_trailing_whitespace`, `insert_final_newline`, and `max_line_length` are
-supported. Set `editorconfig` to `false` to disable it. Project settings keep
-precedence over `.editorconfig`; malformed, oversized, or symlinked config
-files are ignored.
+Settings are layered as defaults, user settings, project settings, explicit
+`--settings` values, and language overrides. Invalid saved values leave the
+previous valid settings active. `.editorconfig` is enabled by default between
+user and project settings and supports the common indentation, whitespace,
+final-newline, and line-length keys.
 
 ```jsonc
 {
   "theme": "auto",
   "font_size": 14,
   "vim_mode": false,
-  "use_tabs": false,
-  "auto_pairs": [["(", ")"], ["[", "]"], ["{", "}"], ["\"", "\""], ["'", "'"]],
-  "diagnostics": { "inline": true, "inline_max_length": 80, "severity": "warning" },
-  "inlay_hints": { "enabled": true, "parameter_names": true, "types": true, "max_length": 30 },
-  "code_lens": { "enabled": true },
-  "bracket_colorization": true,
-  "indent_guides": { "enabled": true, "active": true },
-  "render_whitespace": "boundary",
-  "render_ideographic_space": true,
-  "sticky_scroll": { "enabled": true, "max_lines": 5 },
-  "breadcrumbs": { "enabled": true },
-  "minimap": { "enabled": false, "width": 100, "show_diagnostics": true },
   "auto_save": "off",
-  "auto_save_delay": 1000,
-  "persistent_undo": { "enabled": true, "max_entries": 1000, "expire_days": 30 },
   "format_on_save": false,
-  "code_actions_on_save": [],
-  "format_on_save_timeout": 2000,
-  "git": { "inline_blame": "off", "autofetch": false, "autofetch_interval": 180 },
-  "recovery": { "enabled": true, "interval": 5000 },
-  "tabs": { "activate_on_close": "history", "reopen_history_limit": 20 },
-  "terminal": {
-    "working_directory": "project", "scrollback_lines": 10000, "shell_integration": true,
-    "profiles": { "bash": { "path": "/bin/bash", "args": ["--login"], "env": { "TERM_PROGRAM": "canopus" } } },
-    "default_profile": "bash"
-  },
-  "dock": {
-    "bottom": { "size": 280, "visible": false },
-    "panels": { "terminal": { "size": 280, "visible": false } }
-  },
-  "keymap": [
-    { "context": "Editor && !vim_mode", "bindings": { "ctrl-k ctrl-s": "file.save" } }
-  ],
+  "terminal": { "shell_integration": true },
   "languages": { "ruby": { "tab_size": 2, "auto_pairs": [] } },
   "language_servers": {
     "ruby": [
       { "command": ["ruby-lsp"], "features": ["completion", "definition", "hover", "formatting"] },
       { "command": ["rubocop", "--lsp"], "features": ["diagnostics", "codeAction"] }
     ]
-  },
-  "debug_adapters": {
-    "ruby": { "command": ["rdbg", "--open", "--stop-at-load"], "transport": "tcp" }
   }
 }
 ```
 
-A legacy argument array such as `"ruby": ["ruby-lsp"]` still configures one
-server. With multiple servers, completion, diagnostics, and code actions are
-merged; workspace symbols are collected from every matching active server;
-other features use the first matching server in configuration order. Workspace
-symbol search falls back to bounded project-content search when no usable
-provider is active. Override `language.workspace_symbols` in `keymap` to change
-its Cmd-T / Ctrl-T binding.
-
-`render_whitespace` accepts `none`, `boundary`, `selection`, or `all`.
-`boundary` hides only single spaces between non-whitespace characters. Tabs use
-`→`, spaces use `·`, and ideographic spaces use `□`; the last remains visible
-independently when `render_ideographic_space` is enabled.
-
-`auto_pairs` replaces the opener/closer list for the current settings layer;
-set it to `[]` globally or for one language to disable automatic pairing and
-selection surrounding. Each opener and closer must be one Unicode grapheme.
-
-Sticky scroll keeps the declarations containing the first visible source byte
-above the editor body. It prefers cached LSP document symbols and falls back to
-cached Antares structure regions; `sticky_scroll.enabled` and
-`sticky_scroll.max_lines` can also be overridden per language.
-
-Breadcrumbs show the project-relative file, containing type, and callable above
-sticky scroll. Selecting an item opens its same-directory files or same-parent
-symbols in the palette. `breadcrumbs.enabled` can be overridden per language.
-
-The GUI-only minimap is disabled by default. When enabled, it reserves its
-configured width only in panes wide enough to keep the editor usable, reuses
-bounded low-resolution line textures across splits, and shows Git, search, and
-optionally diagnostic overview marks. Click or drag it to center that source
-position without moving the selection. All minimap options can be overridden
-per language.
-
-Closing a dirty tab asks whether to save, discard, or cancel. Reopening restores
-the file, selections, position, and pane while Canopus is running; discarded
-unsaved changes are never restored. Dock and panel visibility and sizes are also
-restored. Terminal session restoration, when enabled,
-starts fresh shells with the saved tab count and working directories and does
-not restore processes or scrollback.
-
-Dirty buffers are also written every five seconds to private, atomically
-replaced files under `.canopus/recovery/`. After an abnormal exit, the newest
-valid snapshot is offered at startup; normal exit removes this run's snapshot.
-Set `recovery.enabled` to `false` or change `recovery.interval` (milliseconds)
-in settings. Recovery files contain local unsaved text, so disable the feature
-for workspaces where even a mode-0600 local copy is unacceptable. Individual
-buffers over 10 MiB and snapshots over 64 MiB are not retained.
-
-Set `auto_save` to `after_delay` to save dirty named files after the debounce
-interval in `auto_save_delay` milliseconds, or to `on_focus_change` to save a
-file when switching away from it. Untitled, read-only, and conflicting files
-are skipped or reported without forcing a write.
-
-Persistent undo keeps up to `persistent_undo.max_entries` undo entries for
-clean regular files under `.canopus/undo/`. Records are project- and file
-identity-bound, expire after `expire_days`, and are ignored when corrupt or
-when the file changes. Dirty buffers remain in recovery storage instead.
-
-Settings are layered from defaults through user, project, explicit `--settings`,
-and language overrides. Invalid saved settings leave the previous valid values
-active. Keymap groups extend defaults; later matching bindings win, and `null`
-removes a default binding.
-
-Language servers are separate programs and are auto-detected or configured by
-argument array. See [Language servers](docs/lsp.md) for configuration and
-restart behavior.
-
-Debug launch definitions and the persistent, edit-aware breakpoint gutter
-are described in [Debug configurations](docs/debugging.md). `debug.start`
-selects and starts a configuration, and `debug.stop` ends the active session.
-When execution stops, the Debug panel provides safe stack navigation, lazy
-variables, per-stop watch evaluation (`debug.watch.add` /
-`debug.watch.remove`), and the breakpoint list. Variable expansion is restored
-by name path rather than adapter reference IDs.
-`debug.console.evaluate` accepts REPL input for the selected frame and
-`panel.debug_console` toggles ordered adapter output. Hovering a simple
-local, instance, class, or global variable while stopped evaluates it in the
-selected frame.
-Breakpoint files use an atomic rename
-for normal same-user workspace consistency; concurrent malicious workspace
-mutation is outside that guarantee.
-
-Project task definitions, variables, Output tabs, and reveal behavior are
-described in [Tasks](docs/tasks.md). `task.run` opens the task picker,
-`task.stop` stops the selected running Output tab, and `panel.output` toggles
-the panel. Single-line, multi-line, and watch problem matchers publish task
-output into the shared Problems panel and editor diagnostics.
-
-The [Test explorer](docs/testing.md) discovers Minitest and RSpec declarations
-with a bounded Alkaid walk and Prism AST inspection. `panel.test` opens the
-tree and `test.refresh` rescans it. Gutter buttons run static tests in bounded
-Task Output tabs and show running, passed, failed, or skipped state; selecting
-a failed test opens its reported failure line.
+The example shows the settings most people change first. Use `auto_pairs`,
+`render_whitespace`, `inlay_hints`, `code_lens`, `minimap`, `breadcrumbs`,
+`persistent_undo`, `recovery`, `terminal.profiles`, `keymap`, and per-language
+overrides for more control. Set `auto_pairs` to `[]` to disable automatic
+pairing for a language.
+
+Language servers can be configured with one command array or multiple server
+entries. Completion, diagnostics, and code actions are merged across matching
+servers; workspace symbols use all of them, while other capabilities use the
+first matching server. See [Language servers](docs/lsp.md).
+
+Debugging, tasks, and test discovery have dedicated guides:
+[Debug configurations](docs/debugging.md), [Tasks](docs/tasks.md), and
+[Test explorer](docs/testing.md).
 
 Plugins require explicit trust and permissions:
 
@@ -312,6 +181,9 @@ The default separate process also requests Saiph's OS sandbox. Set
 supported backend, or to `"off"` to retain the legacy process-only isolation.
 The legacy `process` permission is accepted as an alias for `exec`.
 
+Manifest-based isolated plugins use the Gienah host and declarative Zaniah UI;
+see [Plugins](docs/plugins.md).
+
 ## Documentation
 
 - [Language servers](docs/lsp.md)
@@ -320,6 +192,7 @@ The legacy `process` permission is accepted as an alias for `exec`.
 - [Vim mode](docs/vim.md)
 - [Snippets](docs/snippets.md)
 - [Completion providers](docs/providers.md)
+- [Plugins](docs/plugins.md)
 - [Workspace edits](docs/workspace_edits.md)
 - [Packaging](docs/distribution.md)
 - [Profiling and local crash reports](docs/performance.md)

data/docs/plugins.md

@@ -0,0 +1,62 @@
+# Plugins
+
+Canopus supports two plugin APIs. Existing Ruby plugins use `Workspace#plugins`
+and remain available for compatibility. New plugins use the isolated Gienah
+host and a `plugin.json` manifest.
+
+```json
+{
+  "id": "word-count",
+  "name": "Word Count",
+  "version": "0.1.0",
+  "api_version": 2,
+  "entry": "plugin.rb",
+  "activation": ["onCommand:word-count.refresh"],
+  "capabilities": ["buffer.read", "ui.panel"],
+  "contributes": {
+    "commands": [{"id": "word-count.refresh", "title": "Refresh word count"}],
+    "panels": [{"id": "word-count", "title": "Word Count", "dock": "right"}]
+  }
+}
+```
+
+The host discovers manifests without starting processes. A workspace must be
+trusted before a manifest is activated. Capabilities are denied by default;
+`process.exec`, filesystem, and network access additionally require Saiph.
+
+Plugin entrypoints use Gienah's SDK and communicate with Canopus through the
+declared host methods:
+
+```ruby
+require "gienah"
+
+Gienah::Plugin.on("ui/event") { |event| Gienah::Plugin.call("workspace/notify", "text" => event["id"]) }
+Gienah::Plugin.export("word-count.refresh") do
+  text = Gienah::Plugin.call("buffer/text")
+  Gienah::Plugin.call("ui/render", "panel" => "word-count", "tree" => {
+    "type" => "text", "props" => {"value" => "#{text.split.size} words"}, "children" => []
+  })
+  nil
+end
+Gienah::Plugin.run
+```
+
+Panels use the allow-listed declarative vocabulary (`column`, `row`, `spacer`,
+`scroll`, `divider`, `text`, `icon`, `badge`, `progress`, `code`, `button`,
+`checkbox`, `text_field`, `select`, `list`, `tree`, and `section`). Raw colors,
+images, fonts, and coordinates are not accepted. UI rendering is cached in the
+editor, so a slow plugin cannot block a frame. Completion providers have a
+200 ms response budget.
+
+The host also exposes `storage/get`, `storage/set`, `process/exec`,
+`net/fetch`, `ui/status`, `ui/quick_pick`, `ui/input`, and `ui/confirm`.
+Storage is scoped to the workspace and plugin ID. Network requests must match
+the manifest's `net:` host pattern, and dangerous operations remain gated by
+the manifest capability and workspace trust.
+
+`buffer/text` limits an unbounded request to 1 MiB; larger documents must be
+read with a byte range. Calling `buffer/subscribe` with the active buffer URI
+starts diff notifications for that plugin only. The host sends
+`buffer/didChange`, `buffer/didOpen`, `buffer/didSave`, `buffer/didClose`, and
+throttled `selection/didChange` notifications for the subscribed buffer, plus
+`workspace/didChangeFiles` and `settings/didChange` to subscribed plugins.

data/lib/canopus/decoration.rb

@@ -123,7 +123,7 @@ module Canopus
         unless item.row.nil? || (item.row.is_a?(Integer) && item.row >= 0)
           raise ArgumentError, "decoration row must be nonnegative"
         end
-        unless item.range.nil? || (item.range.is_a?(Range) && item.range.begin.is_a?(Integer) && item.range.end.is_a?(Integer))
+        unless item.range.nil? || (item.range.is_a?(Range) && item.range.begin.is_a?(Integer) && item.range.end.is_a?(Integer) && item.range.begin >= 0 && item.range.end >= item.range.begin)
           raise ArgumentError, "decoration range must contain integer offsets"
         end
         raise ArgumentError, "decoration click handler must be callable" unless item.on_click.nil? || item.on_click.respond_to?(:call)

data/lib/canopus/plugins/api.rb

@@ -15,7 +15,11 @@ module Canopus
       end
       def text
         permit!("read_buffer")
-        @workspace.editor.buffer.text.dup.freeze
+        buffer = @workspace.editor&.buffer
+        raise Canopus::Error, "buffer is not available" unless buffer
+        raise Canopus::Error, "plugin buffer text exceeds 1 MiB" if buffer.rope.bytesize > Plugins::BUFFER_CONTEXT_LIMIT
+
+        buffer.text.dup.freeze
       end
       def replace(range, text)
         permit!("edit_buffer")