mbeditor 0.13.1 → 0.14.0

data/app/services/mbeditor/file_history_service.rb

@@ -0,0 +1,222 @@
+# frozen_string_literal: true
+
+module Mbeditor
+  # Per-branch, per-file undo history: the ops the client couldn't replay from
+  # its own in-memory undo stack (a reload, a second tab) get persisted here as
+  # a base snapshot plus an appended op log, keyed by branch+path so switching
+  # branches doesn't cross-contaminate history.
+  #
+  # Built on LockedJsonFile — the same sidecar-lock + atomic-write primitive
+  # EditorStateService uses — rather than a hand-rolled flock loop that wrote
+  # in place with truncate/rewind. A crash mid-write there truncated history
+  # instead of leaving the previous file untouched.
+  class FileHistoryService
+    LockTimeoutError  = LockedJsonFile::LockTimeoutError
+    BaseRequiredError = Class.new(StandardError)
+    BaseTooLargeError = Class.new(StandardError)
+
+    # v1 (no "v") began tracking before the file content had arrived, so it
+    # recorded the whole-file load as an insert-at-origin op against an empty
+    # base — once per open. v2 begins tracking once the load has landed, so the
+    # load is the base and only real edits are ops. Legacy files are migrated on
+    # read (migrate_legacy!); legacy writes are normalized in #append.
+    FORMAT_VERSION  = 2
+    MAX_OPS         = 10_000
+    COMPACT_TARGET  = 5_000
+    MAX_AGE_SECONDS = 7 * 24 * 3600
+    BASE_MAX_BYTES  = EditorStateService::STATE_MAX_BYTES
+    # Op count alone doesn't bound size: a few huge pastes can outweigh MAX_OPS
+    # tiny edits, so compaction also triggers on the serialized payload size.
+    MAX_BYTES       = 4 * 1024 * 1024
+
+    def initialize(workspace_root, lock_timeout: EditorStateService::DEFAULT_LOCK_TIMEOUT, max_bytes: MAX_BYTES)
+      @root = workspace_root
+      @lock_timeout = lock_timeout
+      @max_bytes = max_bytes
+    end
+
+    # Returns { "base" => ..., "ops" => [...] }, or nil if there is no history
+    # or it aged out (an aged-out file is pruned as a side effect).
+    def read(branch, rel_path)
+      path = history_path(branch, rel_path)
+      return nil unless File.exist?(path)
+
+      data = JSON.parse(File.read(path))
+
+      if data["t"] && (Time.now.utc - Time.parse(data["t"])) > MAX_AGE_SECONDS
+        FileUtils.rm_f(path)
+        return nil
+      end
+
+      data = migrate_legacy!(path, data)
+      return nil unless data
+
+      { "base" => data["base"], "ops" => data["ops"] || [] }
+    rescue JSON::ParserError
+      FileUtils.rm_f(path)
+      nil
+    end
+
+    # Appends ops, seeding the history with `base` on the first write for this
+    # branch+path. `base_given` distinguishes "no base param at all" (an
+    # error, except on a non-first write) from an explicit empty base (a
+    # legitimate first snapshot — e.g. a file that is empty on disk, tracked
+    # from "" before the first edit).
+    #
+    # `version` is the client's format version. A legacy client (absent or <
+    # FORMAT_VERSION) sends base "" plus the whole-file load as its first op;
+    # that is folded into the base here so the bad shape never reaches disk.
+    def append(branch, rel_path, ops:, base: nil, base_given: false, version: nil)
+      ops  = Array(ops)
+      base = base.to_s
+
+      if version.to_i < FORMAT_VERSION && base_given && base.empty?
+        base = ops.shift[4].to_s if load_op?(ops.first)
+        ops  = ops.reject { |op| load_op?(op) }
+      end
+
+      file = LockedJsonFile.new(history_path(branch, rel_path), lock_timeout: @lock_timeout, error_class: LockTimeoutError)
+
+      file.with_lock do
+        existing = file.read
+
+        if existing.empty?
+          raise BaseRequiredError unless base_given
+          raise BaseTooLargeError if base.bytesize > BASE_MAX_BYTES
+
+          existing = {
+            "branch" => branch,
+            "path"   => rel_path,
+            "base"   => base,
+            "ops"    => [],
+            "v"      => FORMAT_VERSION,
+            "t"      => Time.now.utc.iso8601
+          }
+        end
+
+        existing["v"]   = FORMAT_VERSION
+        existing["ops"] = (existing["ops"] || []) + ops
+        existing["t"]   = Time.now.utc.iso8601
+
+        payload = existing.to_json
+        if existing["ops"].length > MAX_OPS || payload.bytesize > @max_bytes
+          compact_until_bounded!(existing)
+          payload = existing.to_json
+        end
+
+        file.write(payload)
+      end
+      nil
+    end
+
+    # Deletes history files for branches no longer in active_branches.
+    def prune(active_branches:)
+      hist_dir = @root.join("tmp", "mbeditor_history")
+      return unless File.directory?(hist_dir)
+
+      Dir.glob(File.join(hist_dir, "*.json")) do |hist_file|
+        data = begin
+          JSON.parse(File.read(hist_file))
+        rescue JSON::ParserError => e
+          Rails.logger.error("[mbeditor] FileHistoryService#prune: skipping corrupt history file #{hist_file}: #{e.message}")
+          nil
+        end
+        next unless data.is_a?(Hash) && data["branch"]
+
+        FileUtils.rm_f(hist_file) unless active_branches.include?(data["branch"])
+      end
+      nil
+    end
+
+    private
+
+    def history_path(branch, rel_path)
+      branch_hash = Digest::SHA256.hexdigest(branch.to_s)[0, 16]
+      file_hash   = Digest::SHA256.hexdigest(rel_path.to_s)[0, 16]
+      @root.join("tmp", "mbeditor_history", "#{branch_hash}_#{file_hash}.json")
+    end
+
+    # Rewrites a v1 history into the v2 shape and returns it, or nil if there is
+    # nothing left to replay (the file is then removed). A v2 file is returned
+    # untouched. Writes are atomic (rename), so a concurrent reader never sees a
+    # half-written file; the rewrite is idempotent, so a racing append that also
+    # normalizes is harmless.
+    def migrate_legacy!(path, data)
+      return data if data["v"].to_i >= FORMAT_VERSION
+
+      base = data["base"].to_s
+      ops  = Array(data["ops"])
+
+      if base.empty? && load_op?(ops.first)
+        # The first load is exactly equivalent to the base it was applied to.
+        base = ops.shift[4].to_s
+        # Every later load starts another session whose preceding edits already
+        # reproduce it. Left in place they concatenate the file onto itself;
+        # dropping them reconstructs the last session's edits over the first
+        # session's content.
+        ops = ops.reject { |op| load_op?(op) }
+      end
+
+      migrated = data.merge("base" => base, "ops" => ops, "v" => FORMAT_VERSION)
+
+      if base.empty? && ops.empty?
+        FileUtils.rm_f(path)
+        nil
+      else
+        LockedJsonFile.new(path, lock_timeout: @lock_timeout, error_class: LockTimeoutError).write(migrated)
+        migrated
+      end
+    end
+
+    # A whole-file load as the v1 client recorded it: an insertion at the very
+    # start of the document. Its text is the file content at that open.
+    def load_op?(op)
+      return false unless op.is_a?(Array) && op.length >= 5
+
+      op[0].to_i == 1 && op[1].to_i == 1 && op[2].to_i == 1 && op[3].to_i == 1
+    end
+
+    # Folds ops into the base until both the op count and the serialized size
+    # are back under budget. Stops early when the op log is empty — a base that
+    # alone exceeds the budget (a very large file) can't be shrunk further
+    # without the current file contents, which the service does not have.
+    def compact_until_bounded!(data)
+      data["ops"] ||= []
+      loop do
+        break if data["ops"].length <= MAX_OPS && data.to_json.bytesize <= @max_bytes
+        break if data["ops"].empty?
+
+        data["base"] = compact_ops(data["base"], data["ops"].shift(COMPACT_TARGET))
+      end
+    end
+
+    # Replays a batch of ops against `base` to fold them into a new snapshot
+    # once the op log outgrows MAX_OPS, so history keeps a bounded number of
+    # ops without losing anything: base + remaining ops still reconstructs the
+    # same document. Each op is [startLine, startCol, endLine, endCol, insertedText],
+    # 1-based, matching Monaco's model.onDidChangeContent ranges.
+    def compact_ops(base, ops)
+      text = base.to_s
+      ops.each do |op|
+        sl, sc, el, ec, ins = op[0].to_i, op[1].to_i, op[2].to_i, op[3].to_i, op[4].to_s
+        lines = text.split("\n", -1)
+        sl0  = [[sl - 1, 0].max, [lines.length - 1, 0].max].min
+        el0  = [[el - 1, 0].max, [lines.length - 1, 0].max].min
+        sc0  = sc - 1
+        ec0  = ec - 1
+        prefix    = (lines[sl0] || "")[0, sc0] || ""
+        suffix    = (lines[el0] || "")[ec0..] || ""
+        ins_lines = ins.split("\n", -1)
+        new_seg   = if ins_lines.length <= 1
+          [prefix + (ins_lines[0] || "") + suffix]
+        else
+          [prefix + ins_lines[0]] + ins_lines[1..-2] + [ins_lines[-1] + suffix]
+        end
+        text = (lines[0...sl0] + new_seg + lines[(el0 + 1)..]).join("\n")
+      end
+      text
+    rescue StandardError
+      base.to_s
+    end
+  end
+end

data/app/services/mbeditor/git_info_service.rb

@@ -43,8 +43,14 @@ module Mbeditor
       end
 
       begin
+        started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         compute(repo_path)
       ensure
+        # One record per git-info wave, and only for the thread that owns the
+        # computation: `ms` is the wall time of the whole concurrent fan-out.
+        # Each git subprocess inside it is recorded separately by ProcessRunner.
+        AuditLog.record(:git_wave,
+                        ms: ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round)
         done = GIT_INFO_MUTEX.synchronize { @git_info_flights.delete(repo_path) }
         done&.close
       end

data/app/services/mbeditor/js_syntax_check_service.rb

@@ -165,10 +165,16 @@ module Mbeditor
     MUTEX = Mutex.new
     private_constant :MUTEX
 
+    # ponytail: one shared V8 context behind one global lock, so concurrent
+    # saves queue; a check skipped under contention is advisory-only. Hold a
+    # small pool of contexts if skips ever become common.
+    LOCK_WAIT_SECONDS = 0.1
+
     class << self
       def available?
         return false if Mbeditor.configuration.js_syntax_check == false
         return false unless defined?(::MiniRacer)
+        return false if @context == :broken
 
         !babel_source_path.nil?
       end
@@ -178,7 +184,7 @@ module Mbeditor
       def check(source)
         return nil unless available?
 
-        MUTEX.synchronize do
+        with_lock(nil) do
           begin
             ctx = context
             return nil unless ctx
@@ -224,7 +230,7 @@ module Mbeditor
         program = JsProgramService.call(workspace_root.to_s)
         globals = JsGlobalsService.call(workspace_root.to_s)
 
-        MUTEX.synchronize do
+        with_lock([]) do
           begin
             ctx = context
             return [] unless ctx
@@ -257,27 +263,47 @@ module Mbeditor
 
       private
 
-      def context
-        @context ||= begin
-          path = babel_source_path
-          return nil unless path
-
-          ctx = ::MiniRacer::Context.new(timeout: EVAL_TIMEOUT_MS)
-          ctx.eval(File.read(path))
-          ctx.eval("if (typeof Babel === 'undefined') { throw new Error('Babel global missing'); }")
-          @checks_run = 0
-          ctx
-        rescue StandardError
-          @context = nil
-          nil
+      # Skipping the lock costs a lint run, never correctness.
+      def with_lock(unavailable)
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + LOCK_WAIT_SECONDS
+        until MUTEX.try_lock
+          return unavailable if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+
+          sleep 0.005
         end
+
+        begin
+          yield
+        ensure
+          MUTEX.unlock
+        end
+      end
+
+      def context
+        return nil if @context == :broken
+        return @context if @context
+
+        path = babel_source_path
+        return nil unless path
+
+        ctx = ::MiniRacer::Context.new(timeout: EVAL_TIMEOUT_MS)
+        ctx.eval(File.read(path))
+        ctx.eval("if (typeof Babel === 'undefined') { throw new Error('Babel global missing'); }")
+        @checks_run = 0
+        @context = ctx
+      rescue StandardError => e
+        # A bundle that will not evaluate will not evaluate on the next save
+        # either; re-reading multi-MB of babel per save is pure waste.
+        @context = :broken
+        Rails.logger&.warn("[mbeditor] babel asset #{path.inspect} failed to load, JS syntax check disabled: #{e.message}")
+        nil
       end
 
       def reset_context!
         # Dropping the reference leaks the V8 isolate until the GC finalizer
         # runs; dispose releases it now.
         begin
-          @context&.dispose
+          @context.dispose if @context.respond_to?(:dispose)
         rescue StandardError
           nil
         end

data/app/services/mbeditor/lint_service.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+require "tempfile"
+require "tmpdir"
+require "json"
+
+module Mbeditor
+  # The module CONTEXT.md's glossary already names: mbeditor's linting
+  # toolchain, rubocop (diagnostics via --stdin; autocorrect via a
+  # workspace-local tempfile so rubocop's config discovery finds the host
+  # app's .rubocop.yml) and haml-lint (diagnostics only). Every subprocess
+  # runs through ProcessRunner.
+  #
+  # Diagnostics come back Monaco-marker-shaped (startLine/copName/…) rather
+  # than as a neutral intermediate — matching LspDiagnosticsTranslator, the
+  # sibling module for ruby-lsp diagnostics, which does the same. Client-side
+  # JS linting (JsSyntaxCheckService) and the Monaco-edit shaping in
+  # EditorsController#compute_text_edit are presentation-layer concerns and
+  # stay out of this module.
+  module LintService
+    module_function
+
+    def rubocop_diagnostics(workspace_root, path, code)
+      cmd = AvailabilityProbe.rubocop_command(workspace_root) +
+            [AvailabilityProbe.rubocop_server_flag(workspace_root), "--stdin", path.to_s, "--format", "json", "--no-color"]
+      output = run(cmd, env: rubocop_env, stdin_data: code)[:stdout]
+
+      idx = output.index("{")
+      result = idx ? JSON.parse(output[idx..]) : {}
+      result = {} unless result.is_a?(Hash)
+      offenses = result.dig("files", 0, "offenses") || []
+
+      markers = offenses.map do |offense|
+        {
+          severity: cop_severity(offense["severity"]),
+          copName: offense["cop_name"],
+          correctable: offense["correctable"] == true,
+          message: "[#{offense['cop_name']}] #{offense['message']}",
+          startLine: offense.dig("location", "start_line") || offense.dig("location", "line"),
+          startCol: offense.dig("location", "start_column") || offense.dig("location", "column") || 1,
+          endLine: offense.dig("location", "last_line") || offense.dig("location", "line"),
+          endCol: offense.dig("location", "last_column") || offense.dig("location", "column") || 1,
+          # Same predicate the ruby-lsp path uses, so dead code fades whichever
+          # linter produced the offense. Plain rubocop JSON carries no
+          # code_description, so there's no codeHref to pass on here.
+          unnecessary: LspDiagnosticsTranslator.unnecessary?(offense["cop_name"])
+        }
+      end
+
+      { markers: markers, summary: result["summary"] }
+    end
+
+    def haml_diagnostics(workspace_root, code)
+      markers = []
+      Tempfile.create(["mbeditor_haml", ".haml"]) do |f|
+        f.write(code)
+        f.flush
+        cmd = AvailabilityProbe.haml_lint_command(workspace_root) + ["--reporter", "json", "--no-color", f.path]
+        output = run(cmd)[:stdout]
+        idx = output.index("{")
+        result = idx ? JSON.parse(output[idx..]) : {}
+        result = {} unless result.is_a?(Hash)
+        offenses = result.dig("files", 0, "offenses") || []
+        markers = offenses.map do |offense|
+          {
+            severity: haml_lint_severity(offense["severity"]),
+            message: "[#{offense['linter_name']}] #{offense['message']}",
+            startLine: offense.dig("location", "line"),
+            startCol: (offense.dig("location", "column") || 1) - 1,
+            endLine: offense.dig("location", "line"),
+            endCol: offense.dig("location", "column") || 1
+          }
+        end
+      end
+      markers
+    end
+
+    # Runs a full `rubocop -A` pass on +code+ (not the file on disk) via a
+    # workspace-local tempfile, and reports whether the pass completed.
+    # +ok: false+ means rubocop itself failed (exit status neither 0 nor 1),
+    # not that no offense was found — callers that care about an actual diff
+    # compare +content+ against the code they passed in.
+    def autocorrect(workspace_root, path, code)
+      ext = File.extname(File.basename(path))
+      Tempfile.create([".mbeditor_autocorrect_", ext], File.dirname(path)) do |f|
+        f.write(code)
+        f.flush
+        tmpfile = f.path
+
+        cmd = AvailabilityProbe.rubocop_command(workspace_root) +
+              [AvailabilityProbe.rubocop_server_flag(workspace_root), "-A", "--no-color", tmpfile]
+        status = run(cmd, env: rubocop_env)[:exit_status]
+
+        # exit 0 = no offenses, exit 1 = offenses corrected, exit 2 = error
+        next { ok: false, content: code } unless status.success? || status.exitstatus == 1
+
+        corrected = File.read(tmpfile, encoding: "UTF-8", invalid: :replace, undef: :replace)
+        { ok: true, content: corrected }
+      end
+    end
+
+    # Kept in step with LspDiagnosticsTranslator::SEVERITIES so a file linted
+    # through ruby-lsp and the same file linted through `rubocop --stdin` grade
+    # their offenses identically. rubocop's own `info` is the weakest level and
+    # maps to hint; convention/refactor fall through to info.
+    def cop_severity(severity)
+      case severity
+      when "error", "fatal" then "error"
+      when "warning" then "warning"
+      when "info" then "hint"
+      else "info"
+      end
+    end
+
+    def haml_lint_severity(severity)
+      case severity
+      when "error" then "error"
+      when "warning" then "warning"
+      else "info"
+      end
+    end
+
+    def rubocop_env
+      { "RUBOCOP_CACHE_ROOT" => File.join(Dir.tmpdir, "rubocop") }
+    end
+
+    # Same lint_timeout ceiling for every subprocess this module runs.
+    # quick_fix, format_file and haml-lint used to spawn with Open3.capture3
+    # and no timeout at all, so a wedged rubocop held a request thread until
+    # the client gave up.
+    def run(cmd, env: {}, stdin_data: nil)
+      timeout_seconds = Mbeditor.configuration.lint_timeout&.to_i
+      timeout = timeout_seconds && timeout_seconds > 0 ? timeout_seconds : nil
+      ProcessRunner.call(cmd, timeout: timeout, env: env, stdin_data: stdin_data)
+    end
+  end
+end

data/app/services/mbeditor/locked_json_file.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module Mbeditor
+  # Sidecar-lock + atomic-write primitive for a single JSON file on disk.
+  # Extracted from EditorStateService so FileHistoryService could stop
+  # hand-rolling its own flock loop and, worse, writing in place with
+  # truncate/rewind — a crash mid-write there truncated history instead of
+  # leaving the previous file untouched.
+  class LockedJsonFile
+    LockTimeoutError    = Class.new(StandardError)
+    LOCK_RETRY_INTERVAL = 0.01
+
+    def initialize(path, lock_timeout:, error_class: LockTimeoutError)
+      @path = path
+      @lock_timeout = lock_timeout
+      @error_class = error_class
+    end
+
+    # Readers take no lock at all: every write lands by rename, so a read sees
+    # either the whole previous file or the whole new one — never the empty
+    # window a truncate-then-write leaves, which readers would otherwise have
+    # to swallow as {}.
+    def read
+      return {} unless File.exist?(@path)
+
+      raw = File.read(@path)
+      raw.empty? ? {} : JSON.parse(raw)
+    end
+
+    # The file is replaced by rename, not edited in place, so a crash mid-write
+    # leaves the previous contents intact rather than a truncated file.
+    def write(payload)
+      FileUtils.mkdir_p(File.dirname(@path))
+      tmp = "#{@path}.tmp"
+      File.write(tmp, payload.is_a?(String) ? payload : payload.to_json)
+      File.rename(tmp, @path)
+    end
+
+    # The lock sits on a sidecar file, not on the data file itself: the data
+    # file is replaced by rename, so a lock held on the inode it had before
+    # the write would exclude nobody afterwards.
+    #
+    # Acquires the lock without blocking forever: a blocking acquire would let
+    # a single stuck holder (e.g. a request paused at a breakpoint mid-write)
+    # wedge every later writer indefinitely, so this retries a non-blocking
+    # flock with a bounded deadline and raises rather than hanging the worker.
+    def with_lock
+      FileUtils.mkdir_p(File.dirname(@path))
+      File.open("#{@path}.lock", File::RDWR | File::CREAT) do |f|
+        lock_exclusive!(f)
+        yield
+      end
+    end
+
+    private
+
+    def lock_exclusive!(file)
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @lock_timeout
+      until file.flock(File::LOCK_EX | File::LOCK_NB)
+        if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+          raise @error_class, "could not acquire lock within #{@lock_timeout}s"
+        end
+        sleep LOCK_RETRY_INTERVAL
+      end
+    end
+  end
+end

data/app/services/mbeditor/process_runner.rb

@@ -11,10 +11,34 @@ module Mbeditor
     CHUNK_BYTES = 64 * 1024
     private_constant :CHUNK_BYTES
 
+    # Known subprocess executables, by basename, mapped to a fixed audit Symbol.
+    # Anything unlisted — including a host-configured command like
+    # `rubocop_command` — is :other. Interning the executable string instead
+    # would launder host data through the audit log's Symbol-only guard.
+    TOOL_SYMBOLS = {
+      "git" => :git,
+      "rg" => :rg,
+      "grep" => :grep,
+      "rubocop" => :rubocop,
+      "haml-lint" => :haml_lint,
+      "haml_lint" => :haml_lint,
+      "rspec" => :rspec,
+      "rails" => :rails,
+      "bundle" => :bundle,
+      "ruby" => :ruby
+    }.freeze
+    private_constant :TOOL_SYMBOLS
+
+    def tool_symbol(cmd)
+      TOOL_SYMBOLS[File.basename(Array(cmd).first.to_s)] || :other
+    end
+    private_class_method :tool_symbol
+
     # +max_bytes+ bounds how much of each stream is kept in memory (nil =
     # unbounded). Anything past the cap is still read and discarded — stopping
     # would block the child on a full pipe and hang the wait below.
     def call(cmd, timeout: nil, env: {}, stdin_data: nil, chdir: nil, max_bytes: nil)
+      started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
       out = +""
       err = +""
       exit_status = nil
@@ -61,6 +85,14 @@ module Mbeditor
       raise TimeoutError, "process timed out after #{timeout}s" if timed_out
 
       { stdout: out, stderr: err, exit_status: exit_status }
+    ensure
+      # One record per spawn: `tool` is the mapped Symbol for a known
+      # executable (never the raw command), `ms` wall time, `status` a
+      # code-authored outcome — never the process's own output.
+      AuditLog.record(:subprocess,
+                      tool: tool_symbol(cmd),
+                      ms: ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round,
+                      status: timed_out ? :timeout : (exit_status&.success? ? :ok : :error))
     end
 
     def read_capped(io, max_bytes)