ligarb 0.5.0 → 0.7.0

data/lib/ligarb/review_store.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require "time"
 require "securerandom"
 require "fileutils"
 
@@ -8,82 +9,103 @@ module Ligarb
   class ReviewStore
     def initialize(base_dir)
       @dir = File.join(base_dir, ".ligarb", "reviews")
+      @mutex = Mutex.new
       FileUtils.mkdir_p(@dir)
     end
 
     def list
-      Dir.glob(File.join(@dir, "*.json")).map { |f| read_json(f) }
-        .compact
-        .sort_by { |r| r["created_at"] }
-        .map { |r| summary(r) }
+      @mutex.synchronize do
+        Dir.glob(File.join(@dir, "*.json")).map { |f| read_json(f) }
+          .compact
+          .sort_by { |r| r["created_at"] }
+          .map { |r| summary(r) }
+      end
     end
 
     def get(id)
-      path = file_path(id)
-      return nil unless File.exist?(path)
-      read_json(path)
+      @mutex.synchronize do
+        get_unlocked(id)
+      end
     end
 
     def create(context:, message:)
-      id = SecureRandom.uuid
-      now = Time.now.utc.iso8601
-
-      review = {
-        "id" => id,
-        "status" => "open",
-        "created_at" => now,
-        "context" => context,
-        "messages" => [
-          { "role" => "user", "content" => message, "timestamp" => now }
-        ]
-      }
-
-      write_json(id, review)
-      review
+      @mutex.synchronize do
+        id = SecureRandom.uuid
+        now = Time.now.utc.iso8601
+
+        review = {
+          "id" => id,
+          "status" => "open",
+          "created_at" => now,
+          "context" => context,
+          "messages" => [
+            { "role" => "user", "content" => message, "timestamp" => now }
+          ]
+        }
+
+        write_json(id, review)
+        review
+      end
     end
 
     def add_message(id, role:, content:)
-      review = get(id)
-      return nil unless review
-
-      review["messages"] << {
-        "role" => role,
-        "content" => content,
-        "timestamp" => Time.now.utc.iso8601
-      }
-
-      write_json(id, review)
-      review
+      @mutex.synchronize do
+        review = get_unlocked(id)
+        return nil unless review
+
+        review["messages"] << {
+          "role" => role,
+          "content" => content,
+          "timestamp" => Time.now.utc.iso8601
+        }
+
+        write_json(id, review)
+        review
+      end
     end
 
     def update_context_files(id, files)
-      review = get(id)
-      return nil unless review
-
-      existing = review.dig("context", "uploaded_files") || []
-      review["context"]["uploaded_files"] = existing + files
-      write_json(id, review)
-      review
+      @mutex.synchronize do
+        review = get_unlocked(id)
+        return nil unless review
+
+        existing = review.dig("context", "uploaded_files") || []
+        review["context"]["uploaded_files"] = existing + files
+        write_json(id, review)
+        review
+      end
     end
 
     def update_status(id, status)
-      review = get(id)
-      return nil unless review
-
-      review["status"] = status
-      write_json(id, review)
-      review
+      @mutex.synchronize do
+        review = get_unlocked(id)
+        return nil unless review
+
+        review["status"] = status
+        write_json(id, review)
+        review
+      end
     end
 
     def delete(id)
-      path = file_path(id)
-      return false unless File.exist?(path)
-      File.delete(path)
-      true
+      @mutex.synchronize do
+        path = file_path(id)
+        return false unless File.exist?(path)
+        File.delete(path)
+        true
+      end
     end
 
     private
 
+    def get_unlocked(id)
+      path = file_path(id)
+      return nil unless File.exist?(path)
+      review = read_json(path)
+      review["file_path"] = path if review
+      review
+    end
+
     def file_path(id)
       File.join(@dir, "#{id}.json")
     end

data/lib/ligarb/server.rb

@@ -14,7 +14,7 @@ module Ligarb
 
     BookEntry = Struct.new(:slug, :config, :config_path, :build_dir, :store, :claude, keyword_init: true)
 
-    def initialize(config_paths, port: 3000)
+    def initialize(config_paths, port: 3000, multi: false)
       @port = port
       @assets_dir = File.join(File.dirname(__FILE__), "..", "..", "assets")
       @sse_clients = [] # [[slug, queue], ...]
@@ -37,7 +37,11 @@ module Ligarb
         )
       end
 
-      @multi = @books.size > 1
+      @multi = multi || @books.size > 1
+
+      @operation_queue = Queue.new
+      @operation_thread = Thread.new { operation_worker }
+      @operation_thread.abort_on_exception = true
     end
 
     def start
@@ -49,6 +53,7 @@ module Ligarb
 
       server = WEBrick::HTTPServer.new(
         Port: @port,
+        BindAddress: "127.0.0.1",
         Logger: WEBrick::Log.new($stderr, WEBrick::Log::INFO),
         AccessLog: [[File.open(File::NULL, "w"), WEBrick::AccessLog::COMMON_LOG_FORMAT]],
         RequestBodyMaxSize: 50 * 1024 * 1024
@@ -77,6 +82,27 @@ module Ligarb
 
     private
 
+    # ── Operation Queue ──
+
+    def operation_worker
+      loop do
+        job = @operation_queue.pop
+        job.call
+      end
+    end
+
+    def enqueue_sync(&block)
+      result_queue = Queue.new
+      @operation_queue.push(-> {
+        result_queue.push(block.call)
+      })
+      result_queue.pop
+    end
+
+    def enqueue_async(&block)
+      @operation_queue.push(-> { block.call })
+    end
+
     # ── SSE (Server-Sent Events) ──
 
     def close_sse_clients
@@ -220,7 +246,8 @@ module Ligarb
       file_path = File.join(build_dir, path)
       file_path = File.realpath(file_path) rescue nil
 
-      if file_path && file_path.start_with?(File.realpath(build_dir)) && File.file?(file_path)
+      real_build_dir = File.realpath(build_dir)
+      if file_path && (file_path.start_with?(real_build_dir + "/") || file_path == real_build_dir) && File.file?(file_path)
         res.body = File.binread(file_path)
         res["Content-Type"] = mime_type(file_path)
       else
@@ -238,7 +265,7 @@ module Ligarb
 
       api_base = @multi ? "/_ligarb/#{book.slug}" : "/_ligarb"
       page_base = @multi ? "/#{book.slug}/" : "/"
-      config_tag = %(<script>window._ligarbAPI='#{api_base}';window._ligarbBase='#{page_base}';</script>)
+      config_tag = %(<script>window._ligarbAPI='#{escape_js_string(api_base)}';window._ligarbBase='#{escape_js_string(page_base)}';</script>)
 
       js_tags = [config_tag] + %w[serve.js review.js].map { |f|
         %(<script src="/_ligarb/assets/#{f}"></script>)
@@ -251,10 +278,13 @@ module Ligarb
 
     def serve_index_page(res)
       books_data = @books.values.sort_by { |b| b.config.title }.map { |book|
+        html_path = File.join(book.build_dir, "index.html")
+        mtime = File.exist?(html_path) ? File.mtime(html_path).strftime("%Y-%m-%d %H:%M") : nil
         {
           slug: book.slug,
           title: book.config.title,
           author: book.config.author.to_s,
+          updated_at: mtime,
           toc: build_toc(book)
         }
       }
@@ -267,7 +297,7 @@ module Ligarb
         <head>
         <meta charset="utf-8">
         <meta name="viewport" content="width=device-width, initial-scale=1">
-        <title>ligarb</title>
+        <title>ligarb librarium</title>
         <style>
           * { margin: 0; padding: 0; box-sizing: border-box; }
           body { font-family: system-ui, -apple-system, sans-serif; color: #333; height: 100vh; display: flex; flex-direction: column; }
@@ -280,6 +310,7 @@ module Ligarb
           .idx-book.active { background: #eff6ff; border-left: 3px solid #2563eb; padding-left: 13px; }
           .idx-book-title { font-size: 15px; font-weight: 600; display: flex; align-items: center; gap: 8px; }
           .idx-book-author { font-size: 13px; color: #666; margin-top: 2px; }
+          .idx-book-updated { font-size: 12px; color: #999; margin-top: 2px; }
           .idx-badge { font-size: 11px; font-weight: 600; padding: 1px 7px; border-radius: 10px; white-space: nowrap; }
           .idx-badge-writing { background: #fff3e0; color: #e65100; animation: idx-pulse 1.5s ease-in-out infinite; }
           .idx-badge-done { background: #e8f5e9; color: #2e7d32; }
@@ -321,7 +352,7 @@ module Ligarb
         </style>
         </head>
         <body>
-        <div class="idx-header">Books</div>
+        <div class="idx-header">Machinascripta</div>
         <div class="idx-container">
           <div class="idx-books">
             <div class="idx-books-list" id="idx-books"></div>
@@ -363,7 +394,8 @@ module Ligarb
           var job = writeJobs.find(function(j) { return j.slug === book.slug && j.status === 'done'; });
           if (job) badge = ' <span class="idx-badge idx-badge-done">New!</span>';
           el.innerHTML = '<div class="idx-book-title">' + esc(book.title) + badge + '</div>' +
-            (book.author ? '<div class="idx-book-author">' + esc(book.author) + '</div>' : '');
+            (book.author ? '<div class="idx-book-author">' + esc(book.author) + '</div>' : '') +
+            (book.updated_at ? '<div class="idx-book-updated">' + esc(book.updated_at) + '</div>' : '');
           el.addEventListener('click', function() {
             if (activeEl) activeEl.classList.remove('active');
             el.classList.add('active');
@@ -606,8 +638,9 @@ module Ligarb
         </html>
       HTML
 
-      html = html.sub("__BOOKS_JSON__", books_json)
-      html = html.sub("__WRITE_JOBS_JSON__", write_jobs_json)
+      # Escape </ to prevent script injection inside <script> tag
+      html = html.sub("__BOOKS_JSON__", books_json.gsub("</", '<\/'))
+      html = html.sub("__WRITE_JOBS_JSON__", write_jobs_json.gsub("</", '<\/'))
       res.body = html
       res["Content-Type"] = "text/html; charset=utf-8"
     end
@@ -668,7 +701,32 @@ module Ligarb
 
     # ── API routing ──
 
+    def csrf_safe?(req)
+      return true if req.request_method == "GET"
+
+      origin = req["Origin"]
+      if origin && !origin.empty?
+        return origin == "http://localhost:#{@port}" ||
+               origin == "http://127.0.0.1:#{@port}"
+      end
+
+      referer = req["Referer"]
+      if referer && !referer.empty?
+        uri = URI.parse(referer) rescue nil
+        return uri && %w[localhost 127.0.0.1].include?(uri.host) && uri.port == @port
+      end
+
+      false
+    end
+
     def handle_api(req, res)
+      unless csrf_safe?(req)
+        res.status = 403
+        res["Content-Type"] = "application/json; charset=utf-8"
+        res.body = JSON.generate({ error: "CSRF check failed: request must originate from localhost" })
+        return
+      end
+
       method = req.request_method
       path = req.path.sub(%r{^/_ligarb}, "")
 
@@ -831,9 +889,51 @@ module Ligarb
       end
 
       log "Approve: applying patches for review #{id}"
-      result = book.claude.apply_patches(review)
 
-      if result["error"]
+      result = enqueue_sync { book.claude.apply_patches(review) }
+
+      if result["error"] && result["error"].include?("rebuild failed")
+        # Build failed — feed the error back to Claude for a retry
+        log "Approve: build failed, requesting fix from Claude"
+        error_msg = result["error"]
+        book.store.add_message(id, role: "assistant", content: "Error: #{error_msg}")
+        sse_broadcast("review_updated", { id: id }, slug: book.slug)
+
+        retry_msg = "The patches were applied but the build failed with this error:\n\n" \
+                    "#{error_msg}\n\n" \
+                    "Please provide corrected patches that fix this issue."
+        book.store.add_message(id, role: "user", content: retry_msg)
+        sse_broadcast("review_updated", { id: id }, slug: book.slug)
+
+        # Re-run Claude with the updated conversation
+        review = book.store.get(id)
+        prompt = book.claude.review_prompt(review)
+        claude_result = book.claude.run(prompt)
+
+        if claude_result["error"]
+          log "Approve: retry Claude error: #{claude_result["error"]}"
+          book.store.add_message(id, role: "assistant", content: "Error: #{claude_result["error"]}")
+          book.store.update_status(id, "open")
+        else
+          log "Approve: Claude provided fix, retrying patches"
+          book.store.add_message(id, role: "assistant", content: claude_result["text"])
+          sse_broadcast("review_updated", { id: id }, slug: book.slug)
+
+          # Retry applying patches with the new response
+          review = book.store.get(id)
+          retry_result = enqueue_sync { book.claude.apply_patches(review) }
+
+          if retry_result["error"]
+            log "Approve: retry failed: #{retry_result["error"]}"
+            book.store.add_message(id, role: "assistant", content: "Retry failed: #{retry_result["error"]}")
+            book.store.update_status(id, "open")
+          else
+            log "Approve: retry succeeded: #{retry_result["text"]}"
+            book.store.add_message(id, role: "assistant", content: retry_result["text"])
+            book.store.update_status(id, "applied")
+          end
+        end
+      elsif result["error"]
         log "Approve: error: #{result["error"]}"
         book.store.add_message(id, role: "assistant", content: "Error: #{result["error"]}")
         book.store.update_status(id, "open")
@@ -883,13 +983,17 @@ module Ligarb
         log "Review: starting Claude review for #{review_id}"
         begin
           review = book.store.get(review_id)
-          return unless review
+          next unless review
 
-          unless book.claude.installed?
+          case book.claude.installed?
+          when :not_found
             book.store.add_message(review_id, role: "assistant",
               content: "Error: 'claude' command not found. Install Claude Code to enable AI reviews.")
-            sse_broadcast("review_updated", { id: review_id }, slug: book.slug)
-            return
+            next
+          when :version_failed
+            book.store.add_message(review_id, role: "assistant",
+              content: "Error: 'claude' command was found but failed to run. Check your Claude Code installation.")
+            next
           end
 
           prompt = book.claude.review_prompt(review)
@@ -968,8 +1072,8 @@ module Ligarb
 
       sse_broadcast("write_updated", write_jobs_data, slug: nil)
 
-      # Background thread for writing
-      Thread.new do
+      # Run write job via operation queue (async)
+      enqueue_async do
         begin
           log "Write: starting for '#{directory}' (title: #{title})"
           require_relative "writer"
@@ -980,6 +1084,16 @@ module Ligarb
           require_relative "builder"
           Builder.new(book_yml_path).build
 
+          # Git init + commit for the generated book
+          unless system("git", "rev-parse", "--git-dir", out: File::NULL, err: File::NULL, chdir: target_dir)
+            gitignore = File.join(target_dir, ".gitignore")
+            File.write(gitignore, "# Generated by ligarb - remove lines as needed\nbuild/\n.ligarb/\n") unless File.exist?(gitignore)
+            system("git", "init", chdir: target_dir, out: File::NULL, err: File::NULL)
+          end
+          system("git", "add", "-A", chdir: target_dir, out: File::NULL, err: File::NULL)
+          system("git", "commit", "-m", "[ligarb] Generate book: #{title}",
+                 chdir: target_dir, out: File::NULL, err: File::NULL)
+
           # Register the new book
           config = Config.new(book_yml_path)
           book = BookEntry.new(
@@ -1022,6 +1136,8 @@ module Ligarb
 
     # ── Helpers ──
 
+    MAX_UPLOAD_FILE_SIZE = 10 * 1024 * 1024 # 10MB per file
+
     def save_uploaded_files(files_array, base_dir)
       return [] unless files_array.is_a?(Array) && !files_array.empty?
 
@@ -1033,13 +1149,19 @@ module Ligarb
         data = file["data"].to_s
         next if name.empty? || data.empty?
 
+        decoded = Base64.decode64(data)
+        if decoded.bytesize > MAX_UPLOAD_FILE_SIZE
+          log "Upload rejected: #{name} exceeds #{MAX_UPLOAD_FILE_SIZE} bytes"
+          next
+        end
+
         # Sanitize filename
         safe_name = File.basename(name).gsub(/[^a-zA-Z0-9._-]/, "_")
         short_id = SecureRandom.hex(4)
         filename = "#{short_id}-#{safe_name}"
         dest = File.join(upload_dir, filename)
 
-        File.binwrite(dest, Base64.decode64(data))
+        File.binwrite(dest, decoded)
         { "path" => File.expand_path(dest), "label" => name }
       end
     end
@@ -1072,6 +1194,11 @@ module Ligarb
       str.to_s.gsub("&", "&amp;").gsub("<", "&lt;").gsub(">", "&gt;").gsub('"', "&quot;")
     end
 
+    def escape_js_string(str)
+      str.to_s.gsub('\\', '\\\\\\\\').gsub("'", "\\\\'").gsub('"', '\\\\"')
+         .gsub("\n", "\\n").gsub("\r", "\\r").gsub("</", '<\\/')
+    end
+
     def mime_type(path)
       case File.extname(path).downcase
       when ".html" then "text/html; charset=utf-8"

data/lib/ligarb/template.rb

@@ -35,12 +35,72 @@ module Ligarb
       b.local_variable_set(:footer, config.effective_footer)
       b.local_variable_set(:index_tree, build_index_tree(index_entries, chapters))
       b.local_variable_set(:bibliography, bibliography)
+      b.local_variable_set(:multilang, false)
+      b.local_variable_set(:langs, [])
+
+      ERB.new(template, trim_mode: "-").result(b)
+    end
+
+    # Render a single HTML with all languages, switchable via JS
+    def render_multilang(langs:, assets:, hub_data:)
+      css = File.read(@css_path)
+      template = File.read(@template_path)
+
+      first = langs.first
+      first_config = first[:config]
+
+      custom_css = if first_config.style_path && File.exist?(first_config.style_path)
+                     File.read(first_config.style_path)
+                   end
+
+      # Build per-language template data
+      lang_data = langs.map do |ld|
+        cfg = ld[:config]
+        {
+          lang: ld[:lang],
+          title: cfg.title,
+          author: cfg.author,
+          language: cfg.language,
+          chapters: ld[:chapters],
+          structure: ld[:structure],
+          repository: cfg.repository,
+          appendix_label: cfg.appendix_label,
+          ai_generated: cfg.ai_generated,
+          footer: cfg.effective_footer,
+          index_tree: build_index_tree(ld[:index_entries], ld[:chapters]),
+          bibliography: ld[:bibliography],
+        }
+      end
+
+      b = binding
+      # Use first language's values as defaults for shared template vars
+      b.local_variable_set(:title, first_config.title)
+      b.local_variable_set(:author, first_config.author)
+      b.local_variable_set(:language, first_config.language)
+      b.local_variable_set(:chapters, first[:chapters])
+      b.local_variable_set(:structure, first[:structure])
+      b.local_variable_set(:css, css)
+      b.local_variable_set(:custom_css, custom_css)
+      b.local_variable_set(:assets, assets)
+      b.local_variable_set(:repository, first_config.repository)
+      b.local_variable_set(:appendix_label, first_config.appendix_label)
+      b.local_variable_set(:ai_generated, first_config.ai_generated)
+      b.local_variable_set(:footer, first_config.effective_footer)
+      b.local_variable_set(:index_tree, build_index_tree(first[:index_entries], first[:chapters]))
+      b.local_variable_set(:bibliography, first[:bibliography])
+      b.local_variable_set(:multilang, true)
+      b.local_variable_set(:langs, lang_data)
 
       ERB.new(template, trim_mode: "-").result(b)
     end
 
     private
 
+    # HTML-escape helper for ERB templates (available via binding)
+    def h(s)
+      ERB::Util.html_escape(s.to_s)
+    end
+
     # Build a sorted tree structure for the index.
     # Returns: { "A" => [ { term: "Algorithm", refs: [...] },
     #                      { term: "Array", refs: [...], children: [ { term: "sort", refs: [...] } ] } ],

data/lib/ligarb/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Ligarb
-  VERSION = "0.5.0"
+  VERSION = "0.7.0"
 end

data/lib/ligarb/writer.rb

@@ -41,6 +41,8 @@ module Ligarb
         Builder.new(book_yml_path).build
       end
 
+      git_commit_initial(output_dir, brief["title"]) if git_available?(output_dir)
+
       book_yml_path
     end
 
@@ -90,15 +92,38 @@ module Ligarb
       puts "Created #{path}"
       puts "Created #{claude_md}" if created_claude_md
       brief_arg = directory ? " #{path}" : ""
+      unless system("git", "rev-parse", "--git-dir", out: File::NULL, err: File::NULL, chdir: target)
+        gitignore = File.join(target, ".gitignore")
+        unless File.exist?(gitignore)
+          File.write(gitignore, "# Generated by ligarb - remove lines as needed\nbuild/\n.ligarb/\n")
+        end
+        system("git", "init", chdir: target)
+        puts "Initialized git repository"
+      end
+
       puts "Edit brief.yml, then run 'ligarb write#{brief_arg}' to generate the book."
     end
 
     private
 
+    def git_available?(dir)
+      system("git", "rev-parse", "--git-dir", out: File::NULL, err: File::NULL, chdir: dir)
+    end
+
+    def git_commit_initial(dir, title)
+      system("git", "add", "-A", chdir: dir, out: File::NULL, err: File::NULL)
+      system("git", "commit", "-m", "[ligarb] Generate book: #{title}",
+             chdir: dir, out: File::NULL, err: File::NULL)
+    end
+
     def check_claude_installed!
-      unless system("claude", "--version", out: File::NULL, err: File::NULL)
+      claude_path = ENV["PATH"].to_s.split(File::PATH_SEPARATOR).find { |dir| File.executable?(File.join(dir, "claude")) }
+      unless claude_path
         raise WriterError, "'claude' command not found. Install Claude Code first."
       end
+      unless system("claude", "--version", out: File::NULL, err: File::NULL)
+        raise WriterError, "'claude' command was found but failed to run. Check your Claude Code installation."
+      end
     end
 
     def load_brief