mbeditor 0.12.9 → 0.13.1

data/app/channels/mbeditor/channel_authentication.rb

@@ -19,6 +19,13 @@ module Mbeditor
     # True when the connection is allowed (or no hook is configured); otherwise
     # rejects the subscription and returns false.
     def mbeditor_authenticated?
+      # The same gate the controllers apply. Without it the cable channels were
+      # reachable in any environment, hook or no hook.
+      unless Array(Mbeditor.configuration.allowed_environments).map(&:to_sym).include?(Rails.env.to_sym)
+        mbeditor_reject_subscription
+        return false
+      end
+
       hook = mbeditor_auth_hook
       return true unless hook
 

data/app/channels/mbeditor/collaboration_channel.rb

@@ -21,11 +21,14 @@ module Mbeditor
       return reject if @path.empty? && respond_to?(:reject, true)
 
       stream_from stream_name if respond_to?(:stream_from)
+      CollaborationDocStore.join(room_key)
+      @joined = true
       transmit_initial_state
     end
 
     def unsubscribed
-      # no-op
+      CollaborationDocStore.leave(room_key) if @joined
+      @joined = false
     end
 
     def doc_update(data)
@@ -66,7 +69,10 @@ module Mbeditor
       return unless respond_to?(:transmit, true)
 
       state = CollaborationDocStore.state_for(room_key)
-      transmit({ "type" => "sync", "snapshot" => state[:snapshot], "deltas" => state[:deltas] })
+      # Exactly one client per empty room is told to seed it from disk; see
+      # CollaborationDocStore.claim_seed. Everyone else waits for that content.
+      transmit({ "type" => "sync", "snapshot" => state[:snapshot], "deltas" => state[:deltas],
+                 "seed" => CollaborationDocStore.claim_seed(room_key) })
     end
 
     # A room is identified by workspace *and* relative path. Keying on the path

data/app/channels/mbeditor/editor_channel.rb

@@ -50,8 +50,10 @@ module Mbeditor
     def save_state(data)
       state = data["state"] || data
       EditorStateService.new(workspace_root).write_state(state)
-    rescue StandardError
-      # Never let a state-save failure crash the WebSocket connection
+    rescue StandardError => e
+      # Never let a state-save failure crash the WebSocket connection — but a
+      # silently dropped save looked exactly like a working one.
+      Rails.logger.warn("[mbeditor] EditorChannel#save_state failed: #{e.class}: #{e.message}")
     end
 
     def save_branch_state(data)
@@ -62,8 +64,9 @@ module Mbeditor
       # A misbehaving client sent a malformed branch name. Don't crash the
       # connection, but log it so the misconfiguration is observable.
       Rails.logger.warn("[mbeditor] EditorChannel#save_branch_state: rejected invalid branch name #{branch.inspect}")
-    rescue StandardError
+    rescue StandardError => e
       # Never let a state-save failure crash the WebSocket connection
+      Rails.logger.warn("[mbeditor] EditorChannel#save_branch_state failed: #{e.class}: #{e.message}")
     end
 
     def start_log_tail(data)

data/app/controllers/mbeditor/application_controller.rb

@@ -6,6 +6,11 @@ require "pathname"
 module Mbeditor
   class ApplicationController < ActionController::Base
     protect_from_forgery with: :exception
+    # Before the auth hook, and on every controller: a disallowed environment is
+    # "this engine is not here", so it must 404 without running the host app's
+    # authenticate_with proc. Declaring it per-controller meant LogsController
+    # missed it entirely and served the environment's log file anywhere.
+    before_action :ensure_allowed_environment!
     before_action :run_authentication
 
     private

data/app/controllers/mbeditor/editors_controller.rb

@@ -12,7 +12,6 @@ require "uri"
 module Mbeditor
   class EditorsController < ApplicationController
     skip_before_action :verify_authenticity_token
-    before_action :ensure_allowed_environment!
     before_action :verify_mbeditor_client, unless: -> { request.get? || request.head? }
 
     IMAGE_EXTENSIONS = %w[png jpg jpeg gif svg ico webp bmp avif].freeze
@@ -21,6 +20,8 @@ module Mbeditor
     RUBY_DEFS_WARM_MUTEX = Mutex.new
     TOTAL_LINES_CACHE_MAX = 50
     TOTAL_LINES_MUTEX = Mutex.new
+    GIT_STATUS_TTL = 3
+    GIT_STATUS_MUTEX = Mutex.new
     # Kept below Rack's multipart_part_limit (128 file parts in Rack 3.2), which
     # is enforced during param parsing — outside the action, where this
     # controller's rescue cannot turn it into a clean 422. A batch larger than
@@ -47,6 +48,28 @@ module Mbeditor
           cache.delete(cache.keys.first) while cache.length > TOTAL_LINES_CACHE_MAX
         end
       end
+
+      # git_status is polled every 5s by every open tab and costs two git
+      # subprocesses. A 3s TTL collapses the duplicates while staying inside one
+      # poll interval; any mutation drops it outright (broadcast_files_changed).
+      def cached_git_status(root)
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        GIT_STATUS_MUTEX.synchronize do
+          entry = (@git_status_cache ||= {})[root]
+          return entry[:value] if entry && (now - entry[:ts]) < GIT_STATUS_TTL
+        end
+
+        value = yield
+        GIT_STATUS_MUTEX.synchronize do
+          (@git_status_cache ||= {})[root] = { ts: now, value: value }
+        end
+        value
+      end
+
+      def invalidate_git_status(root)
+        GIT_STATUS_MUTEX.synchronize { (@git_status_cache ||= {}).delete(root) }
+        nil
+      end
     end
 
     # GET /mbeditor — renders the IDE shell
@@ -73,6 +96,11 @@ module Mbeditor
         blameAvailable: AvailabilityProbe.git(workspace_root),
         redmineEnabled: Mbeditor.configuration.redmine_enabled == true,
         testAvailable: test_available?,
+        # The client derives its request timeout from this. Two independently
+        # hard-coded numbers is how you get the browser aborting a run the
+        # server is still happily executing, reported as a generic network
+        # error instead of the server's own message.
+        testTimeout: (Mbeditor.configuration.test_timeout || 180).to_i,
         actionCableEnabled: action_cable_enabled?,
         jsSyntaxCheckAvailable: JsSyntaxCheckService.available?,
         rubyLspAvailable: AvailabilityProbe.ruby_lsp(workspace_root),
@@ -84,8 +112,18 @@ module Mbeditor
     end
 
     # GET /mbeditor/files — recursive file tree
+    # refresh=1 means "my view of the workspace is stale, drop your caches" —
+    # the client sends it after an external `git checkout`, which rewrites the
+    # tree without going through any mutation endpoint, so nothing here knows
+    # to invalidate. Without it the 15s tree TTL kept serving the old branch's
+    # file list, and the search cache the old branch's hits.
     def files
-      render json: FileTreeService.build(workspace_root)
+      if params[:refresh].present?
+        FileTreeService.invalidate(workspace_root.to_s)
+        SearchReplaceService.invalidate_cache(workspace_root.to_s)
+      end
+      tree = FileTreeService.cached_json(workspace_root)
+      render json: tree[:body] if stale?(etag: tree[:digest], public: false)
     end
 
     # GET /mbeditor/state — load workspace state
@@ -216,8 +254,17 @@ module Mbeditor
         existing = f.size > 0 ? (JSON.parse(f.read) rescue {}) : {}
 
         if existing.empty?
+          # An empty base is a legitimate one, and in practice the usual one:
+          # the client starts tracking when the editor mounts, which is before
+          # the file content has arrived, so the load itself is recorded as the
+          # first op against an empty document. Rejecting "" meant the initial
+          # POST for every file 400'd and no history was ever written at all.
+          # Only an absent base is an error.
+          unless params.key?(:base)
+            return render json: { error: 'base required for initial history' }, status: :bad_request
+          end
+
           base = params[:base].to_s
-          return render json: { error: 'base required for initial history' }, status: :bad_request if base.empty?
           return render json: { error: 'base too large' }, status: :content_too_large if base.bytesize > STATE_MAX_BYTES
           existing = { 'branch' => branch, 'path' => rel, 'base' => base, 'ops' => [], 't' => Time.now.utc.iso8601 }
         end
@@ -307,15 +354,20 @@ module Mbeditor
     end
 
     # GET /mbeditor/raw?path=... — send raw file directly (for images)
+    #
+    # ?download=1 flips the disposition to attachment, which is the whole of
+    # the explorer's "Download" action: the browser's own save dialog does the
+    # rest, so there is no separate endpoint and no client-side blob.
     def raw
       path = resolve_path(params[:path])
       return render json: { error: "Forbidden" }, status: :forbidden unless path
       return render json: { error: "Not found" }, status: :not_found unless File.file?(path)
 
-      size = File.size(path)
-      return render_file_too_large(size) if size > FileOperationService::MAX_FILE_SIZE_BYTES
+      stat = File.stat(path)
+      return render_file_too_large(stat.size) if stat.size > FileOperationService::MAX_FILE_SIZE_BYTES
+      return unless stale?(last_modified: stat.mtime, public: false)
 
-      send_file path, disposition: "inline"
+      send_file path, disposition: params[:download].present? ? "attachment" : "inline"
     end
 
     # POST /mbeditor/file — save file
@@ -325,7 +377,7 @@ module Mbeditor
       return render json: { error: "Cannot write to this path" }, status: :forbidden if path_blocked_for_operations?(path)
 
       result = FileOperationService.new(workspace_root).save(path, params[:code].to_s)
-      broadcast_files_changed([path])
+      broadcast_files_changed([path], structural: false)
       broadcast_file_saved(path)
       render json: result
     rescue FileOperationService::FileTooLargeError
@@ -838,7 +890,7 @@ module Mbeditor
       )
 
       if result.key?(:error)
-        render json: { error: result[:error] }, status: :unprocessable_entity
+        render json: { error: result[:error] }, status: :unprocessable_content
       else
         render json: result
       end
@@ -848,10 +900,14 @@ module Mbeditor
 
     # GET /mbeditor/git_status
     def git_status
-      output, status = GitService.run_git(workspace_root.to_s, "status", "--porcelain")
-      branch = GitService.current_branch(workspace_root.to_s) || ""
-      files = GitService.parse_porcelain_status(output)
-      render json: { ok: status.success?, files: files, branch: branch }
+      root = workspace_root.to_s
+      payload = self.class.cached_git_status(root) do
+        output, status = GitService.run_git(root, "status", "--porcelain")
+        { ok: status.success?,
+          files: GitService.parse_porcelain_status(output),
+          branch: GitService.current_branch(root) || "" }
+      end
+      render json: payload
     rescue StandardError => e
       render json: { error: e.message }, status: :unprocessable_content
     end
@@ -868,6 +924,9 @@ module Mbeditor
       path = resolve_monaco_asset_path(relative)
       return head :not_found unless path
 
+      # ~14 MB of bundle, re-sent on every page load without this.
+      return unless stale?(last_modified: File.mtime(path), public: false)
+
       send_file path, disposition: "inline", type: Mime::Type.lookup_by_extension(File.extname(path).delete_prefix(".")) || "application/octet-stream"
     end
 
@@ -894,6 +953,7 @@ module Mbeditor
     def pwa_sw
       path = Mbeditor::Engine.root.join("public", "sw.js").to_s
       return render plain: "Not found", status: :not_found unless File.file?(path)
+      return unless stale?(last_modified: File.mtime(path), public: false)
 
       send_file path, disposition: "inline", type: "application/javascript"
     end
@@ -902,6 +962,7 @@ module Mbeditor
     def pwa_icon
       path = Mbeditor::Engine.root.join("public", "mbeditor-icon.svg").to_s
       return render plain: "Not found", status: :not_found unless File.file?(path)
+      return unless stale?(last_modified: File.mtime(path), public: false)
 
       send_file path, disposition: "inline", type: "image/svg+xml"
     end
@@ -1025,7 +1086,7 @@ module Mbeditor
 
         cmd = AvailabilityProbe.rubocop_command(workspace_root) + [AvailabilityProbe.rubocop_server_flag(workspace_root), "-A", "--no-color", tmpfile]
         env = { 'RUBOCOP_CACHE_ROOT' => File.join(Dir.tmpdir, 'rubocop') }
-        _out, _err, status = Open3.capture3(env, *cmd)
+        status = run_lint_command(env, cmd)[:exit_status]
 
         # exit 0 = no offenses, exit 1 = offenses corrected, exit 2 = error
         unless status.success? || status.exitstatus == 1
@@ -1040,6 +1101,26 @@ module Mbeditor
       render json: { error: e.message }, status: :unprocessable_content
     end
 
+    # POST /mbeditor/rubocop — whole-workspace `rubocop` run
+    #
+    # mode=autocorrect adds `-a` (safe corrections only) and writes to disk, so
+    # the response doubles as the post-correction offense list.
+    def rubocop_run
+      unless AvailabilityProbe.rubocop(workspace_root)
+        return render json: { ok: false, error: "RuboCop is not available", files: [] }, status: :unprocessable_content
+      end
+
+      mode = params[:mode].to_s == "autocorrect" ? :autocorrect : :check
+      result = RubocopRunService.run(workspace_root, mode: mode)
+      # `-a` writes to disk behind every open tab's back. No path list: a
+      # whole-project run can touch anything, and the omitted-paths form makes
+      # the client re-check every open tab, which is exactly what's wanted.
+      broadcast_files_changed(nil, structural: false) if mode == :autocorrect && result[:ok]
+      render json: result
+    rescue StandardError => e
+      render json: { ok: false, error: e.message, files: [] }, status: :unprocessable_content
+    end
+
     # POST /mbeditor/test — run tests for the given file
     def run_test
       path = resolve_path(params[:path])
@@ -1068,7 +1149,7 @@ module Mbeditor
         test_file,
         framework: config.test_framework&.to_sym,
         command: config.test_command,
-        timeout: config.test_timeout || 60,
+        timeout: (config.test_timeout || 180).to_i,
         line: line
       )
 
@@ -1121,6 +1202,13 @@ module Mbeditor
     def model_schema
       model_name = params[:model].to_s.strip
       return render json: { error: "model required" }, status: :bad_request if model_name.blank?
+      # SchemaService interpolates the underscored name into app/models/<x>.rb,
+      # and Inflector.underscore leaves "../" intact. Same guard as
+      # module_members, widened to the "::" a namespaced model needs. Spaces
+      # are allowed because SchemaService strips them ("Order Item" → OrderItem).
+      unless model_name.delete(" ").match?(RUBY_CONSTANT_PATH)
+        return render json: { error: "Invalid model name" }, status: :bad_request
+      end
 
       schema = SchemaService.new(model_name, workspace_root.to_s).call
       if schema
@@ -1153,7 +1241,7 @@ module Mbeditor
 
         cmd = AvailabilityProbe.rubocop_command(workspace_root) + [AvailabilityProbe.rubocop_server_flag(workspace_root), "-A", "--no-color", tmpfile]
         env = { 'RUBOCOP_CACHE_ROOT' => File.join(Dir.tmpdir, 'rubocop') }
-        _out, _err, status = Open3.capture3(env, *cmd)
+        status = run_lint_command(env, cmd)[:exit_status]
         unless status.success? || status.exitstatus == 1
           return render json: { ok: false, content: code }
         end
@@ -1248,21 +1336,30 @@ module Mbeditor
       base.to_s
     end
 
-    def broadcast_files_changed(changed_paths = nil)
+    # structural: false means "these files' contents changed, the tree did not"
+    # — a save or a replace-in-files. The client uses it to skip re-walking the
+    # whole workspace and rebuilding its quick-open index on every save, which
+    # is work no content change can invalidate. Defaults to true so a new call
+    # site that says nothing keeps the conservative behaviour.
+    def broadcast_files_changed(changed_paths = nil, structural: true)
       root = workspace_root.to_s
       FileTreeService.invalidate(root)
       SearchReplaceService.invalidate_cache(root)
-      JsGlobalsService.invalidate(root)
-      JsProgramService.invalidate(root)
-      Thread.new do
-        GitInfoService.invalidate(root)
-      rescue => e
-        Rails.logger.warn("[mbeditor] GitInfoService.invalidate failed: #{e}")
+      if js_related_paths?(changed_paths)
+        JsGlobalsService.invalidate(root)
+        JsProgramService.invalidate(root)
       end
+      # Cheap, and it means editing config/routes.rb refreshes the inline route
+      # hints on the next look rather than after the TTL.
+      RouteService.invalidate
+      # Both are mutex-guarded Hash#deletes; a thread per save cost more than
+      # the work it deferred.
+      GitInfoService.invalidate(root)
+      self.class.invalidate_git_status(root)
 
       return unless defined?(ActionCable.server)
 
-      payload = { type: "files_changed" }
+      payload = { type: "files_changed", structural: structural }
       rel = Array(changed_paths).compact.map { |p| relative_path(p.to_s) }.reject(&:empty?)
       payload[:paths] = rel if rel.any?
       ActionCable.server.broadcast("mbeditor_editor", payload)
@@ -1270,6 +1367,20 @@ module Mbeditor
       # Never let a broadcast failure affect the HTTP response
     end
 
+    # Everything either JS cache indexes: JsProgramService::SOURCE_EXT plus the
+    # .erb-templated variants CodeSearchService::JS_GLOBS feeds JsGlobalsService.
+    JS_SOURCE_NAME = /\.(js|jsx|mjs|cjs|ts|tsx)(\.erb)?\z/i
+
+    # Rebuilding the JS program costs ~93ms/MB, so saving a .rb file must not
+    # throw it away. A path with no extension at all — a directory, a rename
+    # target — stays conservative, as does an omitted path list.
+    def js_related_paths?(changed_paths)
+      paths = Array(changed_paths).compact.map(&:to_s).reject(&:empty?)
+      return true if paths.empty?
+
+      paths.any? { |p| File.extname(p).empty? || p.match?(JS_SOURCE_NAME) }
+    end
+
     # Tells every peer that this file's shared buffer was just saved to disk so
     # they can reset that tab's clean baseline and clear its dirty indicator.
     # Rides the same global stream as broadcast_files_changed and is equally
@@ -1431,10 +1542,16 @@ module Mbeditor
     end
 
     def run_with_timeout(env, cmd, stdin_data:)
+      run_lint_command(env, cmd, stdin_data: stdin_data)[:stdout]
+    end
+
+    # Same lint_timeout ceiling as #lint. quick_fix, format_file and haml-lint
+    # used to spawn with Open3.capture3 and no timeout at all, so a wedged
+    # rubocop held a request thread until the client gave up.
+    def run_lint_command(env, cmd, stdin_data: nil)
       timeout_seconds = Mbeditor.configuration.lint_timeout&.to_i
       timeout = timeout_seconds && timeout_seconds > 0 ? timeout_seconds : nil
-      result = ProcessRunner.call(cmd, timeout: timeout, env: env, stdin_data: stdin_data)
-      result[:stdout]
+      ProcessRunner.call(cmd, timeout: timeout, env: env, stdin_data: stdin_data)
     end
 
     def apply_rename_changes(result, open_paths)
@@ -1468,7 +1585,7 @@ module Mbeditor
         end
       end
 
-      broadcast_files_changed(written.map { |rel| File.join(workspace_root, rel) }) if written.any?
+      broadcast_files_changed(written.map { |rel| File.join(workspace_root, rel) }, structural: false) if written.any?
       { ok: true, written: written, rejected: rejected, edits: edits_for_open }
     end
 
@@ -1545,6 +1662,11 @@ module Mbeditor
 
     URI_KEYS = %w[uri targetUri].freeze
 
+    # URI::DEFAULT_PARSER became the RFC3986 parser in Ruby 4.0, where #unescape
+    # is deprecated; URI::RFC2396_PARSER only exists from Ruby 3.4. The gem
+    # supports >= 3.0, so take whichever this Ruby has.
+    URI_UNESCAPER = defined?(URI::RFC2396_PARSER) ? URI::RFC2396_PARSER : URI::DEFAULT_PARSER
+
     def sanitize_lsp_uris(node, depth = 0)
       return nil if depth > MAX_LSP_DEPTH
 
@@ -1593,7 +1715,10 @@ module Mbeditor
     def workspace_relative_uri(uri)
       return nil unless uri.start_with?("file://")
 
-      path = uri.delete_prefix("file://")
+      # ruby-lsp percent-escapes its URIs; workspace_root is a raw path. A
+      # checkout with a space (or any other escaped character) in its path
+      # matched nothing here, so every result was silently dropped.
+      path = URI_UNESCAPER.unescape(uri.delete_prefix("file://"))
       prefix = "#{workspace_root}/"
       return nil unless path.start_with?(prefix)
 
@@ -1610,7 +1735,7 @@ module Mbeditor
         range = loc["range"] || loc["targetSelectionRange"] || loc["targetRange"]
         next unless uri.to_s.start_with?("file://")
 
-        fpath = uri.delete_prefix("file://")
+        fpath = URI_UNESCAPER.unescape(uri.delete_prefix("file://"))
         # Drop gem/stdlib locations the editor can't open; an empty list makes
         # the frontend fall back to the legacy services (ri covers stdlib).
         next unless fpath.start_with?("#{root}/")
@@ -1787,7 +1912,8 @@ module Mbeditor
       Tempfile.create(["mbeditor_haml", ".haml"]) do |f|
         f.write(code)
         f.flush
-        output, _err, _status = Open3.capture3(*AvailabilityProbe.haml_lint_command(workspace_root), "--reporter", "json", "--no-color", f.path)
+        cmd = AvailabilityProbe.haml_lint_command(workspace_root) + ["--reporter", "json", "--no-color", f.path]
+        output = run_lint_command({}, cmd)[:stdout]
         idx = output.index("{")
         result = idx ? JSON.parse(output[idx..]) : {}
         result = {} unless result.is_a?(Hash)

data/app/controllers/mbeditor/git_controller.rb

@@ -14,7 +14,6 @@ module Mbeditor
   # GET  /mbeditor/redmine/issue/:id
   class GitController < ApplicationController
     skip_before_action :verify_authenticity_token
-    before_action :ensure_allowed_environment!
 
     # GET /mbeditor/git/diff?file=<path>[&base=<sha>&head=<sha>]
     def diff
@@ -27,8 +26,9 @@ module Mbeditor
       head = nil if head == 'WORKING'
       # Allow full/short SHA hashes plus common git ref formats: branch names,
       # HEAD, remote tracking refs, parent notation (sha^, sha~N) and tags.
-      # @ is excluded to block reflog syntax like @{-1} or HEAD@{2}.
-      valid_ref = /\A[a-zA-Z0-9._\-\/\^~]+\z/
+      # @ is excluded to block reflog syntax like @{-1} or HEAD@{2}, and a
+      # leading - so the ref cannot be read as an option by the git it reaches.
+      valid_ref = /\A(?!-)[a-zA-Z0-9._\-\/\^~]+\z/
       if [base, head].any? { |s| s && (s.length > 200 || !s.match?(valid_ref)) }
         return render json: { error: 'Invalid ref' }, status: :bad_request
       end

data/app/controllers/mbeditor/logs_controller.rb

@@ -6,7 +6,9 @@ module Mbeditor
     # Reads the active environment's log file incrementally. Used for the
     # initial load (no offset) and as the HTTP polling fallback (with offset).
     def tail
-      offset = params[:offset].present? ? params[:offset].to_i : nil
+      # Clamped: a negative offset reaches IO#seek and raises Errno::EINVAL,
+      # which surfaced as a 500 on a param the client fully controls.
+      offset = params[:offset].present? ? [params[:offset].to_i, 0].max : nil
       result = LogTailService.new(log_path).read_since(offset)
       render json: result
     end

data/app/services/mbeditor/collaboration_doc_store.rb

@@ -27,10 +27,55 @@ module Mbeditor
     # idle room is reclaimed soon after its grace window elapses.
     SWEEP_INTERVAL = 60
 
+    # Hard cap on buffered deltas per room; a long editing session on one file
+    # would otherwise grow it without limit. Over the cap the oldest go, which
+    # costs a late joiner an incomplete replay — it then waits for the next
+    # snapshot instead of syncing from the buffer.
+    MAX_DELTAS = 500
+
+    # Grant the right to seed a room's shared document from disk, to exactly one
+    # client. Without this every client that finds the room empty inserts the whole
+    # file at offset 0, and Yjs merges those inserts into two concatenated copies —
+    # the file appended to itself. That happens whenever two editor tabs attach to
+    # a room the server has no state for: a fresh room, or one that was evicted
+    # while both were idle. The claim is per room, so the loser waits for the
+    # winner's content instead of inventing its own.
+    def claim_seed(path, now: monotonic)
+      MUTEX.synchronize do
+        room = touch(path, now)
+        next false if room[:seed_claimed] || room[:snapshot] || !room[:deltas].empty?
+
+        room[:seed_claimed] = true
+      end
+    end
+
+    # Subscriber accounting. A room with a live subscriber must never be evicted:
+    # eviction empties the server's copy while clients still hold content, and the
+    # next client to attach would be granted a seed it must not perform.
+    def join(path, now: monotonic)
+      MUTEX.synchronize { touch(path, now)[:subscribers] += 1 }
+      nil
+    end
+
+    def leave(path, now: monotonic)
+      MUTEX.synchronize do
+        room = rooms[path]
+        next unless room
+
+        room[:subscribers] -= 1 if room[:subscribers] > 0
+        # The claimer can leave before it ever seeds (a tab closed during the
+        # handshake). Releasing the claim on an empty, empty-handed room keeps the
+        # next opener from deferring to content that will never arrive.
+        room[:seed_claimed] = false if room[:subscribers].zero? && room[:snapshot].nil? && room[:deltas].empty?
+      end
+      nil
+    end
+
     def record_update(path, bytes, now: monotonic)
       MUTEX.synchronize do
         room = touch(path, now)
         room[:deltas] << bytes
+        room[:deltas].shift while room[:deltas].size > MAX_DELTAS
       end
       nil
     end
@@ -78,7 +123,7 @@ module Mbeditor
 
     def touch(path, now)
       new_room = !rooms.key?(path)
-      room = (rooms[path] ||= { snapshot: nil, deltas: [] })
+      room = (rooms[path] ||= { snapshot: nil, deltas: [], subscribers: 0, seed_claimed: false })
       room[:last_activity] = now
       maybe_sweep(now)
       evict_lru if new_room && rooms.size > ROOM_CAP
@@ -98,12 +143,13 @@ module Mbeditor
     private_class_method :maybe_sweep
 
     def evict_idle(now, grace)
-      rooms.delete_if { |_path, room| (now - room[:last_activity]) > grace }
+      rooms.delete_if { |_path, room| room[:subscribers].zero? && (now - room[:last_activity]) > grace }
     end
     private_class_method :evict_idle
 
     def evict_lru
-      oldest = rooms.min_by { |_path, room| room[:last_activity] }
+      idle = rooms.reject { |_path, room| room[:subscribers].positive? }
+      oldest = (idle.empty? ? rooms : idle).min_by { |_path, room| room[:last_activity] }
       rooms.delete(oldest.first) if oldest
     end
     private_class_method :evict_lru

data/app/services/mbeditor/duplicate_content_scanner.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+require "find"
+
+module Mbeditor
+  # Finds files that look like they were written back to disk with their own
+  # content appended to themselves.
+  #
+  # The corruption this detects came from the collaborative buffer: two clients
+  # that each found an empty shared document seeded it from disk, and Yjs merged
+  # both inserts at offset 0 into two concatenated copies. That bug is fixed
+  # (CollaborationDocStore.claim_seed), but files saved while it was live are
+  # still on disk, so there has to be a way to find them.
+  #
+  # Two signals, cheapest first:
+  #
+  #   * :exact          — the file is byte-for-byte X + X. What a duplicated save
+  #                       produces before anyone edits it again.
+  #   * :repeated_block — the first ANCHOR_LINES lines of the file occur again
+  #                       later, verbatim. Survives edits made after the
+  #                       corruption, which is the common case for a file noticed
+  #                       days later.
+  #
+  # Report-only. Nothing here writes.
+  class DuplicateContentScanner
+    ANCHOR_LINES  = 10
+    MIN_LINES     = 20 # below this, a repeat is unremarkable
+    MAX_FILE_SIZE = 5 * 1024 * 1024
+
+    Finding = Struct.new(:path, :reason, :line, :lines, keyword_init: true)
+
+    def self.check(content)
+      return nil if content.nil? || content.empty?
+
+      lines = content.lines
+      return nil if lines.size < MIN_LINES
+
+      half = content.bytesize / 2
+      if content.bytesize.even? && content.byteslice(0, half) == content.byteslice(half, half)
+        return { reason: :exact, line: (lines.size / 2) + 1 }
+      end
+
+      at = repeated_anchor_line(lines)
+      at ? { reason: :repeated_block, line: at } : nil
+    end
+
+    # Line number (1-based) of a later verbatim recurrence of the file's opening
+    # block, or nil. The anchor starts at the first non-blank line so a leading
+    # blank does not shift it out of alignment with its copy.
+    def self.repeated_anchor_line(lines)
+      start = lines.index { |l| !l.strip.empty? }
+      return nil if start.nil? || (start + ANCHOR_LINES) > lines.size
+
+      anchor = lines[start, ANCHOR_LINES]
+      # A block of identical lines (padding, a long table) repeats for boring
+      # reasons; require the anchor itself to carry some variety.
+      return nil if anchor.uniq.size < 3
+
+      idx = ((start + 1)..(lines.size - ANCHOR_LINES)).find { |i| lines[i, ANCHOR_LINES] == anchor }
+      idx && (idx + 1)
+    end
+    private_class_method :repeated_anchor_line
+
+    def initialize(root, excluded: Mbeditor.configuration.excluded_paths)
+      @root = File.expand_path(root.to_s)
+      @matcher = ExclusionMatcher.new(excluded, root: @root)
+    end
+
+    def call
+      findings = []
+      Find.find(@root) do |path|
+        rel = path == @root ? "" : path.delete_prefix("#{@root}/")
+        if File.directory?(path)
+          Find.prune if !rel.empty? && @matcher.excluded?(rel)
+          next
+        end
+        next if @matcher.excluded?(rel)
+        next unless File.file?(path) && File.size(path).between?(1, MAX_FILE_SIZE)
+
+        content = read_text(path)
+        next unless content
+
+        hit = self.class.check(content)
+        next unless hit
+
+        findings << Finding.new(path: rel, reason: hit[:reason], line: hit[:line], lines: content.lines.size)
+      end
+      findings.sort_by { |f| [f.reason == :exact ? 0 : 1, f.path] }
+    end
+
+    private
+
+    # nil for anything that is not readable UTF-8 text — a NUL byte is the same
+    # binary test the rest of the editor uses.
+    def read_text(path)
+      content = File.read(path, encoding: "UTF-8")
+      return nil unless content.valid_encoding?
+      return nil if content.include?("\0")
+
+      content
+    rescue SystemCallError
+      nil
+    end
+  end
+end