mbeditor 0.11.0 → 0.12.0

data/app/services/mbeditor/availability_probe.rb

@@ -117,35 +117,94 @@ module Mbeditor
     # installing e.g. rubocop or ripgrep while the server runs is picked up.
     NEGATIVE_PROBE_TTL = 60
 
-    def self.rg
-      probe_cached("rg") do
-        _out, _err, status = Open3.capture3("rg", "--version")
-        status.success?
+    # "Not found" is false for the boolean probes and nil for rg_command, which
+    # answers with a path instead. Both have to expire, or a tool installed
+    # after boot would never be picked up.
+    def self.negative_probe?(value)
+      value == false || value.nil?
+    end
+    private_class_method :negative_probe?
+
+    # Install prefixes checked when a bare "rg" isn't on the server's PATH.
+    # Homebrew (arm64 and intel), Linux distro packages, linuxbrew, cargo.
+    RG_FALLBACK_PATHS = [
+      "/opt/homebrew/bin/rg",
+      "/usr/local/bin/rg",
+      "/usr/bin/rg",
+      "/home/linuxbrew/.linuxbrew/bin/rg",
+      "~/.cargo/bin/rg"
+    ].freeze
+
+    # The ripgrep executable to run, or nil when there is none.
+    #
+    # Resolution order: config.ripgrep_command, then a bare "rg" on PATH, then
+    # the usual install prefixes. That last step is the point — see the note on
+    # config.ripgrep_command. Falling back to git grep costs 10-30x, and
+    # without this it happened silently whenever the server's PATH differed
+    # from the shell's.
+    def self.rg_command
+      probe_cached("rg_command") do
+        configured = Mbeditor.configuration.ripgrep_command.to_s.strip
+        candidates = configured.empty? ? ["rg", *RG_FALLBACK_PATHS] : [configured]
+
+        candidates.filter_map { |c| c.include?("/") ? File.expand_path(c) : c }
+                  .find { |path| runnable_rg?(path) }
       end
     end
 
+    def self.runnable_rg?(path)
+      # A bare name is left to PATH resolution; an explicit path that isn't
+      # there is skipped without paying for a failed spawn.
+      return false if path.include?("/") && !File.executable?(path)
+
+      _out, _err, status = Open3.capture3(path, "--version")
+      status.success?
+    rescue StandardError
+      false
+    end
+    private_class_method :runnable_rg?
+
+    def self.rg
+      !rg_command.nil?
+    end
+
     def self.reset!
       MUTEX.synchronize { @cache = {} }
       nil
     end
 
+    # The probe itself runs OUTSIDE the lock. Every probe here spawns a
+    # subprocess, and a missing tool is re-probed once a minute forever
+    # (NEGATIVE_PROBE_TTL) — holding MUTEX across that spawn made one absent
+    # tool serialise every other availability check in the process, on a path
+    # that ruby-lsp and every search request go through.
+    #
+    # Racing threads may now run the same probe concurrently. That is fine:
+    # probes are read-only and idempotent, so the loser just overwrites an
+    # identical answer.
     def self.probe_cached(key)
-      MUTEX.synchronize do
+      now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      cached = MUTEX.synchronize do
         @cache ||= {}
-        entry = @cache[key]
-        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-
-        if entry.nil? || (entry[:value] == false && (now - entry[:ts]) > NEGATIVE_PROBE_TTL)
-          value = begin
-            yield
-          rescue StandardError
-            false
-          end
-          entry = @cache[key] = { value: value, ts: now }
-        end
+        @cache[key]
+      end
 
-        entry[:value]
+      if cached && !(negative_probe?(cached[:value]) && (now - cached[:ts]) > NEGATIVE_PROBE_TTL)
+        return cached[:value]
       end
+
+      value = begin
+        yield
+      rescue StandardError
+        false
+      end
+
+      MUTEX.synchronize do
+        @cache ||= {}
+        @cache[key] = { value: value, ts: Process.clock_gettime(Process::CLOCK_MONOTONIC) }
+      end
+
+      value
     end
     private_class_method :probe_cached
   end

data/app/services/mbeditor/code_search_service.rb

@@ -8,6 +8,15 @@ module Mbeditor
   class CodeSearchService
     JS_GLOBS = %w[*.js *.jsx *.ts *.tsx *.js.jsx *.js.erb *.jsx.erb].freeze
 
+    # Minified bundles are skipped, matching JsProgramService and
+    # JsGlobalsService (which use the same [.-]min.ext convention as a Regexp).
+    # A bundle's globals are one-letter names inside a closure, so it can never
+    # hold the definition being looked for — but it is usually the largest file
+    # in the workspace and one enormous line, which is the worst case for the
+    # -E alternation these lookups run. Pure cost, no results.
+    MINIFIED_GLOBS = %w[*.min.js *.min.jsx *.min.ts *.min.tsx
+                        *-min.js *-min.jsx *-min.ts *-min.tsx].freeze
+
     class << self
       def call(pattern, workspace_root, globs: JS_GLOBS)
         root = workspace_root.to_s
@@ -45,23 +54,33 @@ module Mbeditor
       end
 
       def run_rg(pattern, workspace_root, globs)
-        args = ["rg", "--no-heading", "-n", "--color=never"]
+        args = [SearchReplaceService.rg_command, "--no-heading", "-n", "--color=never"]
         # Matches SearchReplaceService: both search paths honour the same
         # config so definition lookups and project search can't disagree about
         # which files exist.
         args << "--no-ignore" unless SearchReplaceService.respect_gitignore?
         args += ["-e", pattern]
         args += globs.flat_map { |g| ["-g", g] }
+        MINIFIED_GLOBS.each { |g| args << "--glob=!#{g}" }
         excluded_paths.each { |p| args << "--glob=!#{p}" }
         args << workspace_root
         run_command(args)
       end
 
+      # Exclusions must reach git as :(exclude) pathspecs, not just be filtered
+      # out of the results afterwards: without them git walks node_modules and
+      # every other excluded tree in full before we throw the matches away.
+      #
+      # No LC_ALL=C here. It is not free — the C locale sends git's -E engine
+      # down a slower path (measured 2.2x on this workspace), and the patterns
+      # built above are always -E.
       def run_git_grep(pattern, workspace_root, globs)
         gitignore_flag = SearchReplaceService.respect_gitignore? ? "--untracked" : "--no-index"
         args = ["git", "-C", workspace_root, "grep", "-I", "-n", "--no-color", gitignore_flag, "-E", "-e", pattern, "--"]
         args += globs
-        lines = run_command(args, env: { "LC_ALL" => "C" })
+        args += MINIFIED_GLOBS.map { |g| ":(exclude)#{g}" }
+        args += excluded_paths.map { |p| ":(exclude)#{p}" }
+        lines = run_command(args)
         # git grep prints workspace-relative paths; callers expect absolute
         # (they re-relativize against workspace_root).
         lines.map { |l| "#{workspace_root}/#{l}" }
@@ -69,7 +88,8 @@ module Mbeditor
 
       def run_grep(pattern, workspace_root, globs)
         includes = globs.map { |g| "--include=#{g}" }
-        args = ["grep", "-I", "-rn", "--color=never", "-E", pattern] + includes
+        excludes = MINIFIED_GLOBS.map { |g| "--exclude=#{g}" }
+        args = ["grep", "-I", "-rn", "--color=never", "-E", pattern] + includes + excludes
         excluded_paths.reject { |p| p.include?("/") }.select { |d| d.match?(/\A[\w.-]+\z/) }.each do |d|
           args << "--exclude-dir=#{d}"
         end

data/app/services/mbeditor/collaboration_doc_store.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+module Mbeditor
+  # Thread-safe, in-memory cache of opaque Yjs bytes per active file. It never
+  # interprets the bytes (no Ruby CRDT): it only buffers the latest snapshot plus
+  # recent deltas so a late-joiner can sync instantly. Modeled on the existing
+  # TTL caches (GitInfoService, AvailabilityProbe): Mutex + monotonic clock.
+  module CollaborationDocStore
+    module_function
+
+    MUTEX = Mutex.new
+    private_constant :MUTEX
+
+    # Grace window (seconds): a room with no activity for longer than this is
+    # evicted by sweep!. Because every op refreshes last_activity, a room that
+    # just went empty survives this long, so a quick reopen recovers its buffer.
+    GRACE_TTL = 300
+
+    # Hard cap on cached rooms. Exceeding it evicts the least-recently-active
+    # room, so process memory stays bounded even if rooms are never swept.
+    ROOM_CAP = 200
+
+    # Idle GC rides on traffic: every write/read attempts a sweep, but the scan
+    # runs at most once per this interval so a busy room doesn't pay for it on
+    # every op. With no explicit scheduler, memory stays bounded over a long
+    # session as long as some activity continues. Kept well under GRACE_TTL so an
+    # idle room is reclaimed soon after its grace window elapses.
+    SWEEP_INTERVAL = 60
+
+    def record_update(path, bytes, now: monotonic)
+      MUTEX.synchronize do
+        room = touch(path, now)
+        room[:deltas] << bytes
+      end
+      nil
+    end
+
+    def replace_snapshot(path, bytes, now: monotonic)
+      MUTEX.synchronize do
+        room = touch(path, now)
+        room[:snapshot] = bytes
+        room[:deltas] = []
+      end
+      nil
+    end
+
+    def state_for(path, now: monotonic)
+      MUTEX.synchronize do
+        room = rooms[path]
+        if room
+          room[:last_activity] = now
+          result = { snapshot: room[:snapshot], deltas: room[:deltas].dup }
+        else
+          result = { snapshot: nil, deltas: [] }
+        end
+        maybe_sweep(now)
+        result
+      end
+    end
+
+    def sweep!(now: monotonic, grace: GRACE_TTL)
+      MUTEX.synchronize { evict_idle(now, grace) }
+      nil
+    end
+
+    def reset!
+      MUTEX.synchronize do
+        @rooms = {}
+        @last_sweep = nil
+      end
+      nil
+    end
+
+    def rooms
+      @rooms ||= {}
+    end
+    private_class_method :rooms
+
+    def touch(path, now)
+      new_room = !rooms.key?(path)
+      room = (rooms[path] ||= { snapshot: nil, deltas: [] })
+      room[:last_activity] = now
+      maybe_sweep(now)
+      evict_lru if new_room && rooms.size > ROOM_CAP
+      room
+    end
+    private_class_method :touch
+
+    # Opportunistic idle GC, throttled to one scan per SWEEP_INTERVAL. Callers hold
+    # MUTEX. The room that just touched its own last_activity has age 0, so a sweep
+    # never reclaims the room driving it.
+    def maybe_sweep(now)
+      return if @last_sweep && (now - @last_sweep) < SWEEP_INTERVAL
+
+      @last_sweep = now
+      evict_idle(now, GRACE_TTL)
+    end
+    private_class_method :maybe_sweep
+
+    def evict_idle(now, grace)
+      rooms.delete_if { |_path, room| (now - room[:last_activity]) > grace }
+    end
+    private_class_method :evict_idle
+
+    def evict_lru
+      oldest = rooms.min_by { |_path, room| room[:last_activity] }
+      rooms.delete(oldest.first) if oldest
+    end
+    private_class_method :evict_lru
+
+    def monotonic
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+    private_class_method :monotonic
+  end
+end

data/app/services/mbeditor/file_import_service.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "pathname"
+
+module Mbeditor
+  # Writes files dragged into the explorer from outside the browser.
+  #
+  # Conflict handling is a two-pass protocol driven by the client. Pass one
+  # runs with on_conflict: :ask — every entry whose target is free is written,
+  # and the rest come back under :conflicts untouched. The client resolves
+  # them and re-sends just those entries with :overwrite or :rename. Because
+  # the existence check and the write happen inside the same call, the window
+  # is closed at the protocol level: the client never gets to check in one
+  # round trip and write in another. (File.exist? and File.open are still two
+  # syscalls, so this is not an atomic guarantee against other processes.)
+  #
+  # Callers must hand over target paths that have already cleared the
+  # controller's resolve_path / path_blocked_for_operations? guards; this
+  # service does no sandboxing of its own.
+  class FileImportService
+    MAX_FILE_SIZE_BYTES = FileOperationService::MAX_FILE_SIZE_BYTES
+    CONFLICT_MODES = %i[ask overwrite rename].freeze
+
+    def initialize(workspace_root)
+      @workspace_root = Pathname(workspace_root)
+    end
+
+    # entries: [{ target_path: <absolute String>, io: <#read, #rewind, #size> }]
+    # => { imported: [{path:, name:}], conflicts: [{path:}], errors: [{path:, error:}] }
+    def import(entries, on_conflict: :ask)
+      mode = on_conflict.to_s.to_sym
+      raise ArgumentError, "unknown on_conflict: #{on_conflict.inspect}" unless CONFLICT_MODES.include?(mode)
+
+      result = { imported: [], conflicts: [], errors: [] }
+      Array(entries).each { |entry| import_entry(entry, mode, result) }
+      result
+    end
+
+    private
+
+    def import_entry(entry, mode, result)
+      target = entry[:target_path].to_s
+      io     = entry[:io]
+
+      if io.size.to_i > MAX_FILE_SIZE_BYTES
+        return result[:errors] << {
+          path: relative_path(target),
+          error: "File is too large (limit is #{MAX_FILE_SIZE_BYTES / 1024 / 1024} MB)"
+        }
+      end
+
+      # A directory is never replaced, whatever the mode: overwriting one would
+      # mean deleting a subtree the user cannot see from the drop.
+      if File.directory?(target)
+        return result[:errors] << {
+          path: relative_path(target),
+          error: "A folder already exists at this path"
+        }
+      end
+
+      # Every bail-out has run by now, and that ordering is load-bearing:
+      # free_path picks its counter by probing the filesystem, so a batch
+      # renaming onto one name only works because each write lands before the
+      # next entry probes. Any new early return belongs above this line.
+      if File.exist?(target)
+        case mode
+        when :ask
+          return result[:conflicts] << { path: relative_path(target) }
+        when :rename
+          target = free_path(target)
+        end
+      end
+
+      write(target, io)
+      result[:imported] << { path: relative_path(target), name: File.basename(target) }
+    rescue SystemCallError, IOError => e
+      result[:errors] << { path: relative_path(entry[:target_path].to_s), error: e.message }
+    end
+
+    def write(target, io)
+      FileUtils.mkdir_p(File.dirname(target))
+      io.rewind
+      File.open(target, "wb") { |f| IO.copy_stream(io, f) }
+    end
+
+    # "logo.png" -> "logo 2.png" -> "logo 3.png" ...
+    def free_path(target)
+      dir  = File.dirname(target)
+      ext  = File.extname(target)
+      base = File.basename(target, ext)
+      counter = 2
+      counter += 1 while File.exist?(File.join(dir, "#{base} #{counter}#{ext}"))
+      File.join(dir, "#{base} #{counter}#{ext}")
+    end
+
+    def relative_path(path)
+      Pathname(path).relative_path_from(@workspace_root).to_s
+    rescue ArgumentError
+      path
+    end
+  end
+end

data/app/services/mbeditor/git_combined_diff_service.rb

@@ -22,6 +22,14 @@ module Mbeditor
       branch_diff
     end
 
+    # What the last #call actually compared against, for the UI to display.
+    # Set by #branch_diff; nil for :local scope.
+    attr_reader :base_ref
+
+    # Set when branch scope could not establish a base branch at all, so the
+    # caller can say why instead of rendering an empty diff as "No changes".
+    attr_reader :error
+
     private
 
     def local_diff
@@ -30,19 +38,42 @@ module Mbeditor
     end
 
     def branch_diff
-      branch  = GitService.current_branch(repo_path)
-      base_sha, = GitService.find_branch_base(repo_path, branch)
+      branch = GitService.current_branch(repo_path)
+      base_sha, ref = GitService.find_branch_base(repo_path, branch)
 
       if base_sha.present?
+        @base_ref = ref
         out, status = GitService.run_git(repo_path, "diff", "#{base_sha}..HEAD")
         return status.success? ? cap_diff(out) : ""
       end
 
+      # No base branch resolved. Comparing against the upstream is only
+      # meaningful when this branch IS a base branch (develop vs origin/develop
+      # = "not yet pushed"). For a feature branch the upstream is
+      # origin/<same-branch>, so that diff compares the branch to itself and is
+      # reliably empty — which is how "Changes in Branch" came to show nothing
+      # on a branch that was many commits ahead of develop.
       upstream = GitService.upstream_branch(repo_path)
-      return "" unless upstream.present?
+      if GitService.base_branch?(branch) && upstream.present?
+        @base_ref = upstream
+        out, status = GitService.run_git(repo_path, "diff", "#{upstream}..HEAD")
+        return status.success? ? cap_diff(out) : ""
+      end
 
-      out, status = GitService.run_git(repo_path, "diff", "#{upstream}..HEAD")
-      status.success? ? cap_diff(out) : ""
+      @error = base_unavailable_message(branch)
+      ""
+    end
+
+    def base_unavailable_message(branch)
+      if GitService.base_branch?(branch)
+        return "#{branch.inspect} is itself a base branch and has no upstream to compare against, " \
+               "so there is nothing to show here. Use \"Changes\" for uncommitted work."
+      end
+
+      candidates = Mbeditor.configuration.base_branch_candidates.join(", ")
+      "Could not determine a base branch to compare #{branch.inspect} against. " \
+        "None of these exist locally: #{candidates}. " \
+        "Fetch the base branch (git fetch origin) or set config.mbeditor.base_branch_candidates."
     end
 
     def cap_diff(out)

data/app/services/mbeditor/git_info_service.rb

@@ -143,6 +143,12 @@ module Mbeditor
         unpushedCommits: unpushed_commits,
         branchCommits: branch_commits,
         branchBaseRef: base_ref,
+        # The merge-base sha the unpushedFiles list was actually computed
+        # against. The frontend needs this to diff an individual file against
+        # the same baseline — passing the ref name would compare the file to
+        # the tip of the base branch, and passing the upstream would compare
+        # the branch to itself.
+        branchBaseSha: diff_base,
         redmineTicketId: redmine_ticket_id
       }
       store_git_info(repo_path, payload)

data/app/services/mbeditor/git_service.rb

@@ -55,13 +55,20 @@ module Mbeditor
       [parts[0].to_i, parts[1].to_i]
     end
 
-    # Returns [merge_base_sha, ref_name] of the first candidate base branch found,
-    # or [nil, nil] if none can be determined.  Candidates are tried in preference
-    # order; skips the current branch and refs whose merge-base equals HEAD.
+    # Returns [merge_base_sha, ref_name] of the first candidate base branch that
+    # exists, or [nil, nil] when none does.
+    #
+    # Candidates are tried in preference order and the FIRST one that resolves
+    # wins, even when the merge-base turns out to be HEAD itself. That case
+    # means the branch is fully contained in its base — an empty "changes in
+    # branch" diff is then the truthful answer, and walking on to a
+    # lower-preference candidate would report a larger, wrong diff instead.
+    #
+    # A candidate naming the current branch is skipped: `develop` is not its own
+    # base. Callers handle that case by comparing against the upstream instead
+    # (see GitCombinedDiffService#branch_diff).
     def find_branch_base(repo_path, current_branch, candidates: nil)
       candidates ||= Mbeditor.configuration.base_branch_candidates
-      head_sha_out, = run_git(repo_path, "rev-parse", "HEAD")
-      head_sha = head_sha_out.strip
 
       candidates.each do |ref|
         short = ref.delete_prefix("origin/")
@@ -75,7 +82,6 @@ module Mbeditor
 
         sha = base_out.strip
         next unless sha.match?(/\A[0-9a-f]{40}\z/)
-        next if sha == head_sha
 
         return [sha, ref]
       end
@@ -85,6 +91,16 @@ module Mbeditor
       [nil, nil]
     end
 
+    # True when the branch is itself one of the configured base branches, in
+    # which case "changes in branch" means "commits not yet pushed" and
+    # comparing against its own upstream is correct rather than degenerate.
+    def base_branch?(current_branch, candidates: nil)
+      return false if current_branch.to_s.empty? || current_branch == "HEAD"
+
+      candidates ||= Mbeditor.configuration.base_branch_candidates
+      candidates.any? { |ref| ref == current_branch || ref.delete_prefix("origin/") == current_branch }
+    end
+
     # Parse `git status --porcelain` output.
     # Returns Array of { status: String, path: String }.
     def parse_porcelain_status(output)

data/app/services/mbeditor/lsp_diagnostics_translator.rb

@@ -11,24 +11,57 @@ module Mbeditor
     module_function
 
     # LSP DiagnosticSeverity -> the severity strings cop_severity also emits.
-    SEVERITIES = { 1 => "error", 2 => "warning", 3 => "info", 4 => "info" }.freeze
+    # Mirrors ruby-lsp's own RUBOCOP_TO_LSP_SEVERITY in reverse: rubocop's
+    # `info` becomes HINT(4) and convention/refactor become INFORMATION(3), so
+    # the two must map back to distinct editor severities.
+    SEVERITIES = { 1 => "error", 2 => "warning", 3 => "info", 4 => "hint" }.freeze
 
     # ruby-lsp appends this to non-correctable RuboCop messages; it's noise in
     # a Monaco hover.
     UNCORRECTABLE_SUFFIX = "This offense is not auto-correctable."
 
-    def call(result)
+    # Cops whose offense means "this code does nothing" rather than "this code
+    # is wrong". Monaco fades these out (MarkerTag.Unnecessary) instead of
+    # squiggling them, which is the whole point of greying out dead code.
+    #
+    # ruby-lsp emits no DiagnosticTag of its own, so the cop name is the only
+    # signal available — and it's the same signal on the plain-rubocop /lint
+    # path, which is why this predicate is public and shared by both.
+    #
+    # ponytail: name heuristic, not an enumeration. Upgrade path is an explicit
+    # cop list if a badly-named cop ever gets faded by mistake.
+    UNNECESSARY_COP = /Unused|Useless|Redundant|Unreachable|Deprecat/.freeze
+
+    # Prism reports the same dead code as Lint/UselessAssignment and
+    # Lint/UnreachableCode, but as a parser warning with no cop name — so both
+    # markers land on the same range. Fading only the RuboCop one leaves the
+    # Prism squiggle drawn on top and nothing looks greyed out at all.
+    UNNECESSARY_MESSAGE = /\Aassigned but unused variable|\Astatement not reached|\Aunused literal/.freeze
+
+    # Most actions a diagnostic can carry. RuboCop sends two (autocorrect and
+    # disable-for-this-line); the cap is a bound on a payload we don't control.
+    MAX_CODE_ACTIONS = 5
+
+    # Refuse to ship an absurd replacement into the browser. RuboCop's
+    # replacements are a few characters; anything near this is a bug or an
+    # attack, not a quick fix.
+    MAX_EDIT_BYTES = 64 * 1024
+
+    # +uri+ is the request's own document URI. Code actions are only accepted
+    # when every edit they carry targets exactly that document — see
+    # sanitize_code_actions.
+    def call(result, uri = nil)
       items = case result
               when Hash  then Array(result["items"])
               when Array then result
               else []
               end
 
-      markers = items.filter_map { |diag| translate_one(diag) }
+      markers = items.filter_map { |diag| translate_one(diag, uri) }
       { markers: markers, summary: { "offense_count" => markers.length } }
     end
 
-    def translate_one(diag)
+    def translate_one(diag, uri = nil)
       return nil unless diag.is_a?(Hash)
 
       range      = diag["range"] || {}
@@ -41,6 +74,7 @@ module Mbeditor
 
       cop_name = extract_code(diag["code"])
       message  = clean_message(diag["message"])
+      fixes    = sanitize_code_actions(diag, uri)
 
       {
         severity: SEVERITIES.fetch(diag["severity"], "info"),
@@ -53,10 +87,70 @@ module Mbeditor
         source: rubocop_source?(diag["source"]) ? "rubocop" : diag["source"].to_s.downcase,
         message: cop_name.empty? ? message : "[#{cop_name}] #{message}",
         startLine: start_line, startCol: start_col,
-        endLine: end_line, endCol: end_col
+        endLine: end_line, endCol: end_col,
+        unnecessary: unnecessary?(cop_name, message),
+        # RuboCop >= 1.64 ships a docs URL per cop; Monaco renders it as a link
+        # on the marker's code. Absent for non-RuboCop diagnostics.
+        # NB: the LSP wire key is camelCase.
+        codeHref: diag.dig("codeDescription", "href")
+      }.tap { |marker| marker[:fixes] = fixes if fixes.any? }
+    end
+
+    # ruby-lsp embeds the complete edits for each RuboCop fix in the diagnostic
+    # itself. Its textDocument/codeAction handler does nothing but echo these
+    # back (see Requests::CodeActions#perform), so lifting them here lets the
+    # editor apply a fix with no further request at all -- no codeAction call
+    # and no `rubocop -A` subprocess.
+    #
+    # This is a trust boundary: the payload arrives from a subprocess and is
+    # applied to the user's buffer. An action is taken only if every edit in it
+    # targets the very document we asked about.
+    def sanitize_code_actions(diag, uri)
+      return [] if uri.nil?
+
+      Array(diag.dig("data", "code_actions")).first(MAX_CODE_ACTIONS).filter_map do |action|
+        next unless action.is_a?(Hash)
+
+        changes = Array(action.dig("edit", "documentChanges"))
+        next if changes.empty?
+        # Any edit aimed at another file disqualifies the whole action. RuboCop
+        # fixes are always single-file, so this rejects nothing legitimate.
+        next unless changes.all? { |c| c.is_a?(Hash) && c.dig("textDocument", "uri") == uri }
+
+        edits = changes.flat_map { |c| Array(c["edits"]) }.filter_map { |edit| sanitize_edit(edit) }
+        next if edits.empty?
+
+        { title: action["title"].to_s, edits: edits }
+      end
+    end
+
+    # One LSP TextEdit -> the 1-based shape the rest of the marker uses.
+    def sanitize_edit(edit)
+      return nil unless edit.is_a?(Hash)
+
+      text = edit["newText"].to_s
+      return nil if text.bytesize > MAX_EDIT_BYTES
+
+      range = edit["range"]
+      return nil unless range.is_a?(Hash)
+
+      {
+        startLine: (range.dig("start", "line") || 0) + 1,
+        startCol:  (range.dig("start", "character") || 0) + 1,
+        endLine:   (range.dig("end", "line") || range.dig("start", "line") || 0) + 1,
+        endCol:    (range.dig("end", "character") || range.dig("start", "character") || 0) + 1,
+        text: text
       }
     end
 
+    def unnecessary?(cop_name, message = nil)
+      return true if UNNECESSARY_COP.match?(cop_name.to_s)
+
+      # Only consult the message when there is no cop to go on, so a RuboCop
+      # offense is never faded because of a phrase inside its description.
+      cop_name.to_s.empty? && UNNECESSARY_MESSAGE.match?(message.to_s)
+    end
+
     def rubocop_source?(source)
       source.to_s.match?(/rubocop/i)
     end