coverband 6.2.0 → 6.2.2

data/lib/coverband/configuration.rb

@@ -14,6 +14,8 @@ module Coverband
       :view_tracker, :defer_eager_loading_data,
       :track_routes, :track_redirect_routes, :route_tracker,
       :track_translations, :translations_tracker,
+      :track_query_bursts, :query_burst_tracker,
+      :query_burst_query_count_threshold, :query_burst_sql_time_threshold_ms,
       :trackers, :csp_policy, :hide_settings,
       :mcp_enabled
 
@@ -81,6 +83,10 @@ module Coverband
       @route_tracker = nil
       @track_translations = false
       @translations_tracker = nil
+      @track_query_bursts = false
+      @query_burst_tracker = nil
+      @query_burst_query_count_threshold = 30
+      @query_burst_sql_time_threshold_ms = 100.0
       @web_debug = false
       @report_on_exit = true
       @use_oneshot_lines_coverage = ENV["ONESHOT"] || false
@@ -140,6 +146,11 @@ module Coverband
         end
         trackers << Coverband.configuration.view_tracker
       end
+
+      if Coverband.configuration.track_query_bursts
+        Coverband.configuration.query_burst_tracker = Coverband::Collectors::QueryBurstTracker.new
+        trackers << Coverband.configuration.query_burst_tracker
+      end
       trackers.each { |tracker| tracker.railtie! }
     rescue Redis::CannotConnectError => e
       Coverband.configuration.logger.info "Redis is not available (#{e}), Coverband not configured"
@@ -213,6 +224,9 @@ module Coverband
         Coverband::Adapters::WebServiceStore.new(service_url)
       else
         begin
+          # Redis gem automatically enables TLS when the scheme is 'rediss://'
+          # For serverless ElastiCache or other TLS-required Redis instances, use:
+          #   REDIS_URL=rediss://your-endpoint:6379
           Coverband::Adapters::RedisStore.new(Redis.new(url: redis_url), redis_store_options)
         rescue Redis::CannotConnectError => error
           logger.info "Redis is not available (#{error}), defaulting to NullStore"

data/lib/coverband/mcp/http_handler.rb

@@ -2,7 +2,7 @@
 
 module Coverband
   module MCP
-    # Rack middleware that adds MCP HTTP endpoint support.
+    # Rack middleware that adds MCP HTTP endpoint support using StreamableHTTPTransport.
     # Can be used to wrap the existing Coverband::Reporters::Web app
     # or mounted standalone.
     #
@@ -10,7 +10,7 @@ module Coverband
     #   map "/coverage" do
     #     run Coverband::MCP::HttpHandler.new(Coverband::Reporters::Web.new)
     #   end
-    #   # MCP endpoint available at POST /coverage/mcp
+    #   # MCP endpoint available at /coverage/mcp with full Streamable HTTP transport support
     #
     # Usage standalone:
     #   map "/mcp" do
@@ -23,6 +23,7 @@ module Coverband
       def initialize(app = nil)
         @app = app
         @server = nil
+        @transport = nil
       end
 
       def call(env)
@@ -40,17 +41,22 @@ module Coverband
       private
 
       def mcp_request?(request)
-        request.post? && request.path_info.end_with?(MCP_PATH)
+        # Accept GET, POST, DELETE, OPTIONS for StreamableHTTPTransport protocol
+        %w[GET POST DELETE OPTIONS].include?(request.request_method) &&
+          request.path_info.end_with?(MCP_PATH)
       end
 
       def handle_mcp_request(request)
+        # Handle CORS preflight
+        return cors_preflight_response if request.request_method == "OPTIONS"
+
         # Check authentication if MCP password is configured
         unless authenticate_mcp_request(request)
           return [401, {
             "Content-Type" => "application/json",
             "Access-Control-Allow-Origin" => "*",
-            "Access-Control-Allow-Methods" => "POST, OPTIONS",
-            "Access-Control-Allow-Headers" => "Content-Type, Authorization",
+            "Access-Control-Allow-Methods" => "GET, POST, DELETE, OPTIONS",
+            "Access-Control-Allow-Headers" => "Content-Type, Authorization, Accept, Mcp-Session-Id",
             "WWW-Authenticate" => 'Bearer realm="Coverband MCP"'
           }, [JSON.generate({
             "error" => "Authentication required",
@@ -58,29 +64,21 @@ module Coverband
           })]]
         end
 
-        body = request.body.read
-        json_request = JSON.parse(body)
-        response = mcp_server.handle_json(json_request)
-
-        # response might already be a JSON string, so check before converting
-        response_body = response.is_a?(String) ? response : response.to_json
-
-        [
-          200,
-          {
-            "content-type" => "application/json",
-            "access-control-allow-origin" => "*",
-            "access-control-allow-methods" => "POST, OPTIONS",
-            "access-control-allow-headers" => "Content-Type"
-          },
-          [response_body]
-        ]
-      rescue JSON::ParserError => e
-        error_response(400, "Invalid JSON: #{e.message}")
+        # Delegate to StreamableHTTPTransport which handles the full MCP HTTP protocol
+        # (GET for SSE streams, POST for requests/responses, DELETE for cleanup, etc.)
+        transport.handle_request(request)
       rescue => e
         error_response(500, "Server error: #{e.message}")
       end
 
+      def cors_preflight_response
+        [204, {
+          "Access-Control-Allow-Origin" => "*",
+          "Access-Control-Allow-Methods" => "GET, POST, DELETE, OPTIONS",
+          "Access-Control-Allow-Headers" => "Content-Type, Authorization, Accept, Mcp-Session-Id"
+        }, []]
+      end
+
       def authenticate_mcp_request(request)
         # If no MCP password is configured, allow access
         mcp_password = Coverband.configuration.mcp_password
@@ -98,8 +96,11 @@ module Coverband
         token == mcp_password
       end
 
-      def mcp_server
-        @server ||= Server.new
+      def transport
+        @transport ||= begin
+          server = ::Coverband::MCP::Server.new
+          ::MCP::Server::Transports::StreamableHTTPTransport.new(server.mcp_server)
+        end
       end
 
       def error_response(status, message)

data/lib/coverband/reporters/web.rb

@@ -32,7 +32,9 @@ module Coverband
 
       def init_web
         full_path = Gem::Specification.find_by_name("coverband").full_gem_path
-        @file_server = Rack::Files.new(
+        # Rack::Files was introduced in Rack 2.0; Rack 1.x uses Rack::File
+        rack_file_server = defined?(Rack::Files) ? Rack::Files : Rack::File
+        @file_server = rack_file_server.new(
           File.expand_path("public", full_path)
         )
       end
@@ -151,10 +153,13 @@ module Coverband
       def display_abstract_tracker(tracker)
         notice = "<strong>Notice:</strong> #{Rack::Utils.escape_html(request.params["notice"])}<br/>"
         notice = request.params["notice"] ? notice : ""
+        used_keys_sort = tracker_used_keys_sort_mode(tracker)
         options = {
           tracker: tracker,
           notice: notice,
-          base_path: base_path
+          base_path: base_path,
+          used_keys_sort: used_keys_sort,
+          sorted_used_keys: sorted_tracker_used_keys(tracker, used_keys_sort)
         }
         Coverband::Utils::HTMLFormatter.new(nil, options).format_abstract_tracker!
       end
@@ -227,6 +232,27 @@ module Coverband
 
       private
 
+      def tracker_used_keys_sort_mode(tracker)
+        requested_sort = request.params["used_sort"]
+        return requested_sort if %w[alpha last_active].include?(requested_sort)
+
+        views_tracker?(tracker) ? "last_active" : "alpha"
+      end
+
+      def sorted_tracker_used_keys(tracker, used_keys_sort)
+        used_keys = tracker.used_keys
+        sorted_pairs = if used_keys_sort == "last_active"
+          used_keys.sort_by { |_key, time_at| -time_at.to_i }
+        else
+          used_keys.sort_by { |key, _time_at| key.to_s }
+        end
+        sorted_pairs.to_h
+      end
+
+      def views_tracker?(tracker)
+        tracker.route == Coverband::Collectors::ViewTracker::REPORT_ROUTE
+      end
+
       def coverband_headers(content_type: "text/html")
         web_headers = {
           "content-type" => content_type

data/lib/coverband/utils/configuration_template.rb

@@ -7,6 +7,7 @@
 # Coverband.configure do |config|
 ####
 # set a redis URL and set it with with some reasonable timeouts
+# For TLS connections (e.g. AWS serverless ElastiCache), use rediss:// scheme
 ####
 # redis_url = ENV["COVERBAND_REDIS"] || ENV["REDIS_URL"] || "redis://localhost:6379"
 # config.store = Coverband::Adapters::RedisStore.new(
@@ -18,6 +19,9 @@
 #     reconnect_delay_max: ENV.fetch("REDIS_RECONNECT_DELAY_MAX", 2.5)
 #   )
 # )
+#
+# Example with TLS (rediss:// scheme automatically enables TLS):
+# redis_url = "rediss://my-elasticache.abcdef.cache.amazonaws.com:6379"
 
 # Allow folks to reset the coverband data via the web UI
 # config.web_enable_clear = true

data/lib/coverband/utils/file_list.rb

@@ -11,6 +11,7 @@ module Coverband
   module Utils
     class FileList < Array
       # Returns the count of lines that have coverage
+      # Using sum avoids intermediate array allocation compared to map.inject
       def covered_lines
         return 0.0 if empty?
 

data/lib/coverband/utils/html_formatter.rb

@@ -13,13 +13,15 @@ require "time"
 module Coverband
   module Utils
     class HTMLFormatter
-      attr_reader :notice, :base_path, :tracker, :page
+      attr_reader :notice, :base_path, :tracker, :page, :used_keys_sort, :sorted_used_keys
 
       def initialize(report, options = {})
         @notice = options.fetch(:notice, nil)
         @base_path = options.fetch(:base_path, "./")
         @tracker = options.fetch(:tracker, nil)
         @page = options.fetch(:page, nil)
+        @used_keys_sort = options.fetch(:used_keys_sort, nil)
+        @sorted_used_keys = options.fetch(:sorted_used_keys, nil)
         @coverage_result = Coverband::Utils::Results.new(report) if report
       end
 
@@ -180,7 +182,10 @@ module Coverband
 
       def link_to_source_file(source_file)
         data_loader_url = "#{base_path}load_file_details?filename=#{source_file.filename}"
-        %(<a href="##{id source_file}" class="src_link" title="#{shortened_filename source_file}" data-loader-url="#{data_loader_url}" onclick="src_link_click(this)">#{truncate(shortened_filename(source_file))}</a>)
+        full_filename = shortened_filename(source_file)
+        truncated_filename = truncate(full_filename)
+        # Include full filename in a hidden span so DataTables search can find it even when truncated
+        %(<a href="##{id source_file}" class="src_link" title="#{full_filename}" data-loader-url="#{data_loader_url}" onclick="src_link_click(this)">#{truncated_filename}<span style="display:none;">#{full_filename}</span></a>)
       end
 
       def truncate(text, length: 50)

data/lib/coverband/utils/tasks.rb

@@ -128,10 +128,28 @@ namespace :coverband do
 
   desc "Start MCP server for AI assistant integration (set COVERBAND_MCP_HTTP=true for HTTP mode)"
   task :mcp do
+    # In stdio mode, we must suppress all non-JSON-RPC output to stdout to comply with
+    # the MCP stdio transport spec. Otherwise, Rails logger and gem output will pollute
+    # the JSON-RPC stream and break clients like Claude Desktop.
+    # See https://github.com/danmayer/coverband/issues/625
+    use_stdio_mode = !ENV["COVERBAND_MCP_HTTP"]
+
+    original_stdout = nil
+    if use_stdio_mode
+      # Save original stdout and redirect stdout to stderr temporarily
+      original_stdout = $stdout
+      $stdout = $stderr
+    end
+
     if Rake::Task.task_defined?("environment")
       Rake.application["environment"].invoke
     end
 
+    if use_stdio_mode
+      # Restore stdout for JSON-RPC communication over stdio
+      $stdout = original_stdout
+    end
+
     begin
       require "coverband/mcp"
     rescue LoadError

data/lib/coverband/version.rb

@@ -5,5 +5,5 @@
 # use format "4.2.1.rc.1" ~> 4.2.1.rc to prerelease versions like v4.2.1.rc.2 and v4.2.1.rc.3
 ###
 module Coverband
-  VERSION = "6.2.0"
+  VERSION = "6.2.2"
 end

data/lib/coverband.rb

@@ -21,6 +21,7 @@ require "coverband/collectors/view_tracker"
 require "coverband/collectors/view_tracker_service"
 require "coverband/collectors/route_tracker"
 require "coverband/collectors/translation_tracker"
+require "coverband/collectors/query_burst_tracker"
 require "coverband/reporters/base"
 require "coverband/reporters/console_report"
 require "coverband/integrations/background"
@@ -101,14 +102,14 @@ module Coverband
   end
 
   # Track a key with the specified tracker.
-  # @param tracker_type [Symbol] The type of tracker to use (e.g., :view_tracker, :translations_tracker, :routes_tracker)
+  # @param tracker_type [Symbol] The type of tracker to use (e.g., :view_tracker, :translations_tracker, :routes_tracker, :query_burst_tracker)
   # @param key [String] The key to track
   # @return [Boolean] True if tracking was successful, false otherwise
   # @raise [ArgumentError] If the tracker_type is not supported
   def self.track_key(tracker_type, key)
     return false unless key
 
-    supported_trackers = [:view_tracker, :translations_tracker, :routes_tracker]
+    supported_trackers = [:view_tracker, :translations_tracker, :routes_tracker, :query_burst_tracker]
 
     unless supported_trackers.include?(tracker_type)
       raise ArgumentError, "Unsupported tracker type: #{tracker_type}. Must be one of: #{supported_trackers.join(", ")}"

data/public/application.css

@@ -867,3 +867,30 @@ td:has(> span.green) {
   background-color: #fbf0c0; }
 .source_table .skipped:nth-child(even) {
   background-color: #fbffcf; }
+
+/* Dead-code review session */
+#dcs-toolbar { margin: 8px 0 12px 0; padding: 8px 10px; background: #f4f4f4; border: 1px solid #ddd; border-radius: 4px; font-size: 0.85em; }
+#dcs-toolbar label { margin: 0 10px; cursor: pointer; }
+#dcs-toolbar button { margin: 0 4px; cursor: pointer; }
+.dcs-badge { background: #666; color: #fff; border-radius: 8px; padding: 1px 8px; margin: 0 6px; }
+#dcs-chips { margin-top: 6px; display: none; }
+.dcs-chip { display: inline-block; background: #e8e8e8; border: 1px solid #ccc; border-radius: 10px; padding: 1px 6px; margin: 2px; font-family: monospace; }
+.dcs-chip-x { border: none; background: transparent; cursor: pointer; font-weight: bold; margin-left: 4px; }
+.dcs-seg { position: relative; }
+.dcs-actions { display: none; white-space: nowrap; }
+.dcs-seg:hover > .dcs-actions { display: inline; }
+.dcs-actions button { border: none; background: #ddd; border-radius: 3px; cursor: pointer; font-size: 0.85em; padding: 0 3px; margin-left: 2px; line-height: 1.2; }
+.dcs-actions button:hover { background: #bbb; }
+#dcs-mark-popup { position: absolute; z-index: 10000; background: #fff; border: 1px solid #999; border-radius: 4px; box-shadow: 0 2px 8px rgba(0,0,0,0.3); padding: 10px; width: 320px; }
+#dcs-mark-popup .dcs-popup-path { font-family: monospace; font-weight: bold; margin-bottom: 6px; word-break: break-all; }
+#dcs-mark-popup textarea { width: 100%; box-sizing: border-box; }
+#dcs-mark-popup .dcs-popup-actions { margin-top: 6px; text-align: right; }
+#dcs-modal-overlay { position: fixed; inset: 0; background: rgba(0,0,0,0.5); z-index: 10001; }
+#dcs-modal { background: #fff; border-radius: 6px; width: 80%; max-width: 900px; max-height: 80%; overflow: auto; margin: 5% auto; padding: 16px; }
+#dcs-modal-head { display: flex; justify-content: space-between; margin-bottom: 10px; }
+#dcs-modal-table { width: 100%; border-collapse: collapse; }
+#dcs-modal-table th, #dcs-modal-table td { border-bottom: 1px solid #eee; padding: 4px 8px; text-align: left; }
+#dcs-modal-foot { margin-top: 12px; text-align: right; }
+#dcs-modal-foot button { margin-left: 8px; }
+.dcs-mono { font-family: monospace; }
+.dcs-comment-edit { width: 100%; box-sizing: border-box; }

data/public/application.js

@@ -33,8 +33,14 @@ $(document).ready(function () {
     ],
   }
 
+  tableOptions.fnDrawCallback = function (oSettings) {
+    if (window.deadCodeOnDraw) window.deadCodeOnDraw(oSettings);
+  };
+
   $(".file_list").dataTable(tableOptions);
 
+  initDeadCodeSession();
+
   // TODO: add support for searching on server side
   // best docs on our version of datatables 1.7 https://datatables.net/beta/1.7/examples/server_side/server_side.html
   if ($(".file_list.unsorted").length == 1) {
@@ -220,4 +226,244 @@ $(document).ready(function () {
   $("#loading").fadeOut();
   $("#wrapper").show();
   $(".dataTables_filter input").focus();
+
+  function initDeadCodeSession() {
+    if (!window.CoverbandDeadCode || !$(".file_list").length) return;
+    var D = window.CoverbandDeadCode;
+    var storageKey = "coverband_deadcode_session:" + ($(".file_list").data("coverageurl") || "/");
+    var state;
+    try {
+      state = D.parseState(window.localStorage.getItem(storageKey));
+    } catch (e) {
+      console && console.warn && console.warn("coverband dead-code session: localStorage unavailable", e);
+      state = D.emptyState();
+    }
+    if (!state.startedAt) state.startedAt = new Date().toISOString();
+
+    function saveState() {
+      try {
+        window.localStorage.setItem(storageKey, JSON.stringify(state));
+      } catch (e) { /* private mode etc.; session still works in-memory */ }
+    }
+    saveState();
+
+    var extractPath = D.extractPath;
+    var rowRuntime = D.rowRuntime;
+
+    // Custom filter: hide rows excluded by the session (DataTables 1.7 API)
+    $.fn.dataTableExt.afnFiltering.push(function (oSettings, aData, iDataIndex) {
+      if (!$(oSettings.nTable).hasClass("file_list")) return true;
+      return !D.isExcluded(state, extractPath(aData[0]), rowRuntime(aData));
+    });
+
+    function redrawTables() {
+      $(".file_list").each(function () {
+        $(this).dataTable().fnDraw();
+      });
+      updateBadges();
+    }
+
+    function updateBadges() {
+      var hidden = 0;
+      $(".file_list").each(function () {
+        var data = $(this).dataTable().fnGetData();
+        for (var i = 0; i < data.length; i++) {
+          if (D.isExcludedIgnoringMarks(state, extractPath(data[i][0]), rowRuntime(data[i]))) hidden++;
+        }
+      });
+      $("#dcs-hidden-count").text(hidden + " hidden");
+      $("#dcs-marked-count").text(state.markedPaths.length);
+      var chips = $("#dcs-chips").empty();
+      $.each(state.hiddenPaths, function (_i, entry) {
+        var chip = $('<span class="dcs-chip"></span>').text(entry);
+        $('<button class="dcs-chip-x" title="Unhide">&times;</button>')
+          .appendTo(chip)
+          .bind("click", function () {
+            D.removeHidden(state, entry);
+            saveState();
+            redrawTables();
+          });
+        chips.append(chip);
+      });
+      chips.toggle(state.hiddenPaths.length > 0 && chips.data("open") === true);
+      $("#dcs-chips-toggle").toggle(state.hiddenPaths.length > 0)
+        .text("Hidden items (" + state.hiddenPaths.length + ")");
+    }
+
+    // Toolbar
+    var toolbar = $(
+      '<div id="dcs-toolbar">' +
+      '  <strong>Dead-code session</strong>' +
+      '  <label><input type="checkbox" id="dcs-runtime-toggle"> Hide files with runtime % &gt; 0</label>' +
+      '  <span class="dcs-badge" id="dcs-hidden-count">0 hidden</span>' +
+      '  <button type="button" id="dcs-marked-btn">Marked for deletion: <span id="dcs-marked-count">0</span></button>' +
+      '  <button type="button" id="dcs-chips-toggle">Hidden items</button>' +
+      '  <button type="button" id="dcs-reset">Reset session</button>' +
+      '  <div id="dcs-chips"></div>' +
+      '</div>'
+    );
+    $("#content").prepend(toolbar);
+
+    $("#dcs-runtime-toggle")
+      .prop("checked", state.hideRuntimeUsed)
+      .bind("change", function () {
+        state.hideRuntimeUsed = this.checked;
+        saveState();
+        redrawTables();
+      });
+
+    $("#dcs-chips-toggle").bind("click", function () {
+      var chips = $("#dcs-chips");
+      chips.data("open", chips.data("open") !== true);
+      updateBadges();
+    });
+
+    $("#dcs-reset").bind("click", function () {
+      if (!confirm("Reset session? This unhides everything (marked-for-deletion list is kept).")) return;
+      window.CoverbandDeadCode.clearHides(state);
+      $("#dcs-runtime-toggle").prop("checked", false);
+      saveState();
+      redrawTables();
+    });
+
+    // Exposed for Tasks 3-4 and the shared fnDrawCallback
+    window.deadCodeSession = {
+      D: D, state: state, saveState: saveState,
+      redrawTables: redrawTables, updateBadges: updateBadges,
+      extractPath: extractPath
+    };
+    window.deadCodeOnDraw = function (oSettings) {
+      if (window.deadCodeDecorate) window.deadCodeDecorate(oSettings);
+      updateBadges();
+    };
+
+    var escapeHtml = D.escapeHtml;
+
+    window.deadCodeDecorate = function (oSettings) {
+      $(oSettings.nTable).find("tbody td a.src_link").not(".dcs-done").each(function () {
+        var link = $(this);
+        var fullPath = link.attr("title");
+        if (!fullPath) return;
+        var segs = D.segmentPrefixes(fullPath);
+        var html = "";
+        for (var i = 0; i < segs.length; i++) {
+          html += '<span class="dcs-seg" data-prefix="' + escapeHtml(segs[i].prefix) + '">' +
+            escapeHtml(segs[i].label) +
+            '<span class="dcs-actions">' +
+            '<button type="button" class="dcs-hide" title="Hide ' + escapeHtml(segs[i].prefix) + (segs[i].isFile ? "" : " and everything under it") + '">&times;</button>' +
+            '<button type="button" class="dcs-mark" title="Mark ' + escapeHtml(segs[i].prefix) + ' for deletion">&#128465;</button>' +
+            '</span></span>' + (segs[i].isFile ? "" : "/");
+        }
+        link.html(html).addClass("dcs-done");
+
+        link.find(".dcs-hide").bind("click", function (e) {
+          e.preventDefault();
+          e.stopPropagation();
+          D.addHidden(state, $(this).closest(".dcs-seg").attr("data-prefix"));
+          saveState();
+          redrawTables();
+          return false;
+        });
+        link.find(".dcs-mark").bind("click", function (e) {
+          e.preventDefault();
+          e.stopPropagation();
+          openMarkPopup($(this).closest(".dcs-seg").attr("data-prefix"), e.pageX, e.pageY);
+          return false;
+        });
+      });
+    };
+
+    function closeMarkPopup() { $("#dcs-mark-popup").remove(); }
+
+    function openMarkPopup(prefix, x, y) {
+      closeMarkPopup();
+      var popup = $(
+        '<div id="dcs-mark-popup">' +
+        '  <div class="dcs-popup-path"></div>' +
+        '  <textarea id="dcs-mark-comment" rows="2" placeholder="Optional comment (why is this dead?)"></textarea>' +
+        '  <div class="dcs-popup-actions">' +
+        '    <button type="button" id="dcs-mark-confirm">Mark for deletion</button>' +
+        '    <button type="button" id="dcs-mark-cancel">Cancel</button>' +
+        '  </div>' +
+        '</div>'
+      );
+      popup.find(".dcs-popup-path").text(prefix);
+      popup.css({ left: Math.min(x, $(window).width() - 340) + "px", top: (y + 8) + "px" });
+      $("body").append(popup);
+      $("#dcs-mark-comment").focus();
+      $("#dcs-mark-cancel").bind("click", closeMarkPopup);
+      $("#dcs-mark-confirm").bind("click", function () {
+        D.addMark(state, prefix, $("#dcs-mark-comment").val(), new Date().toISOString());
+        saveState();
+        closeMarkPopup();
+        redrawTables();
+      });
+    }
+
+    function closeMarkedModal() { $("#dcs-modal-overlay").remove(); }
+
+    function downloadCSV() {
+      var blob = new Blob([D.toCSV(state.markedPaths)], { type: "text/csv;charset=utf-8" });
+      var a = document.createElement("a");
+      a.href = URL.createObjectURL(blob);
+      a.download = D.csvFilename(new Date());
+      document.body.appendChild(a);
+      a.click();
+      document.body.removeChild(a);
+      URL.revokeObjectURL(a.href);
+    }
+
+    function openMarkedModal() {
+      closeMarkedModal();
+      var overlay = $('<div id="dcs-modal-overlay"><div id="dcs-modal">' +
+        '<div id="dcs-modal-head"><strong>Marked for deletion</strong>' +
+        '<button type="button" id="dcs-modal-close">&times;</button></div>' +
+        '<table id="dcs-modal-table"><thead><tr>' +
+        '<th>Path</th><th>Comment</th><th>Marked at</th><th></th>' +
+        '</tr></thead><tbody></tbody></table>' +
+        '<div id="dcs-modal-foot">' +
+        '<button type="button" id="dcs-csv">Download CSV</button>' +
+        '<button type="button" id="dcs-start-over">Start over</button>' +
+        '</div></div></div>');
+      var tbody = overlay.find("tbody");
+      if (state.markedPaths.length === 0) {
+        tbody.append('<tr><td colspan="4"><em>Nothing marked yet.</em></td></tr>');
+      }
+      $.each(state.markedPaths.slice(), function (_i, m) {
+        var tr = $("<tr></tr>");
+        $('<td class="dcs-mono"></td>').text(m.path).appendTo(tr);
+        var commentInput = $('<input type="text" class="dcs-comment-edit">').val(m.comment)
+          .bind("change", function () {
+            D.updateComment(state, m.path, $(this).val());
+            saveState();
+          });
+        $("<td></td>").append(commentInput).appendTo(tr);
+        $('<td class="dcs-mono"></td>').text(m.markedAt).appendTo(tr);
+        $("<td></td>").append(
+          $('<button type="button" title="Unmark">&times;</button>').bind("click", function () {
+            D.removeMark(state, m.path);
+            saveState();
+            redrawTables();
+            openMarkedModal(); // rebuild
+          })
+        ).appendTo(tr);
+        tbody.append(tr);
+      });
+      $("body").append(overlay);
+      $("#dcs-modal-close").bind("click", closeMarkedModal);
+      overlay.bind("click", function (e) { if (e.target === this) closeMarkedModal(); });
+      $("#dcs-csv").bind("click", downloadCSV);
+      $("#dcs-start-over").bind("click", function () {
+        if (!confirm("Clear the entire marked-for-deletion list?")) return;
+        D.clearMarks(state);
+        saveState();
+        redrawTables();
+        openMarkedModal();
+      });
+    }
+
+    $("#dcs-marked-btn").bind("click", openMarkedModal);
+
+    redrawTables();
+  }
 });