mbeditor 0.13.1 → 0.14.0

data/app/services/mbeditor/ruby_lsp_result_translator.rb

@@ -0,0 +1,226 @@
+# frozen_string_literal: true
+
+module Mbeditor
+  # Translates ruby-lsp results for the definition/hover/completion/raw-passthrough
+  # kinds into the shapes their existing consumers expect. Diagnostics have
+  # their own translator (LspDiagnosticsTranslator) with a different interface
+  # — no workspace_root, a different result shape — and are not handled here;
+  # see CLAUDE.md's "Ruby intelligence: ruby-lsp" section for why the two
+  # conventions live side by side.
+  #
+  # +workspace_root+ is a Pathname, the same one EditorsController#workspace_root
+  # resolves. This is the trust boundary every one of these methods sits on:
+  # an in-workspace file:// URI becomes a workspace-relative path, anything
+  # else is dropped — a reference in a gem is not something this editor can
+  # open, and a path outside the root is not something it should hand to the
+  # browser at all.
+  module RubyLspResultTranslator
+    module_function
+
+    # Recursion bound for #raw: the payload comes from a subprocess, and a
+    # cyclic or pathologically nested one must not take the request thread
+    # down with it.
+    MAX_LSP_DEPTH = 32
+
+    URI_KEYS = %w[uri targetUri].freeze
+
+    # URI::DEFAULT_PARSER became the RFC3986 parser in Ruby 4.0, where #unescape
+    # is deprecated; URI::RFC2396_PARSER only exists from Ruby 3.4. The gem
+    # supports >= 3.0, so take whichever this Ruby has.
+    URI_UNESCAPER = defined?(URI::RFC2396_PARSER) ? URI::RFC2396_PARSER : URI::DEFAULT_PARSER
+
+    LSP_COMPLETION_KINDS = {
+      2 => "Method", 3 => "Function", 4 => "Constructor", 5 => "Field",
+      6 => "Variable", 7 => "Class", 8 => "Interface", 9 => "Module",
+      10 => "Property", 14 => "Keyword", 15 => "Snippet", 21 => "Constant"
+    }.freeze
+
+    # ruby-lsp renders its "Definitions" line as VS Code file links, e.g.
+    # `[user.rb](file:///abs/path/user.rb#L3,1-9,4)`. Monaco renders those as
+    # links but clicking one does nothing, since nothing can open a file:// URI
+    # here. Point in-workspace links at the `mbeditor.openDefinition` Monaco
+    # command (registered in editor_plugins.js) and demote gem/stdlib links —
+    # which the editor cannot open at all — to plain code spans.
+    LSP_HOVER_FILE_LINK = %r{\[([^\]\n]+)\]\(file://([^)\s#]+)(?:\#L(\d+),\d+(?:-\d+,\d+)?)?\)}
+
+    def definition(result, workspace_root:)
+      { results: translate_lsp_locations(result, workspace_root) }
+    end
+
+    def hover(result, workspace_root:)
+      { markdown: translate_lsp_hover(result, workspace_root) }
+    end
+
+    def completion(result)
+      { suggestions: translate_lsp_completions(result) }
+    end
+
+    # The one trust boundary for every raw-passthrough method (references,
+    # documentHighlight, documentSymbol, foldingRange, formatting,
+    # signatureHelp, selectionRange, prepareRename). Walks the LSP response and
+    # rewrites each file:// URI to a workspace-relative path, dropping any
+    # object that points outside the workspace.
+    def raw(result, workspace_root:)
+      { result: sanitize_lsp_uris(result, workspace_root) }
+    end
+
+    def sanitize_lsp_uris(node, workspace_root, depth = 0)
+      return nil if depth > MAX_LSP_DEPTH
+
+      case node
+      when Array
+        node.filter_map { |child| sanitize_lsp_uris(child, workspace_root, depth + 1) }
+      when Hash
+        sanitized = {}
+        node.each do |key, value|
+          if URI_KEYS.include?(key) && value.is_a?(String)
+            rel = workspace_relative_uri(value, workspace_root)
+            # A URI we can't place inside the workspace disqualifies its object.
+            return nil unless rel
+
+            sanitized[key] = rel
+          else
+            child = sanitize_lsp_uris(value, workspace_root, depth + 1)
+            sanitized[key] = child unless child.nil? && !value.nil?
+          end
+        end
+        sanitized
+      when String
+        sanitize_lsp_markdown(node, workspace_root)
+      else
+        node
+      end
+    end
+
+    # URIs also turn up *inside* strings: ruby-lsp's signatureHelp and hover
+    # documentation embed a "Definitions" line of file:// markdown links. Those
+    # would leak absolute host paths and render as links that go nowhere, so
+    # they get the same treatment hover already gives them.
+    def sanitize_lsp_markdown(text, workspace_root)
+      return text unless text.include?("file://")
+
+      rewritten = rewrite_lsp_hover_links(text, workspace_root)
+      return rewritten unless rewritten.include?("file://")
+
+      # Backstop for any file:// URI that wasn't in markdown-link form. An
+      # absolute host path must never reach the browser, linkable or not.
+      rewritten.gsub(%r{file://\S*}) do |raw|
+        workspace_relative_uri(raw.sub(/[)\]\s].*\z/m, ""), workspace_root) || "(external)"
+      end
+    end
+
+    def workspace_relative_uri(uri, workspace_root)
+      return nil unless uri.start_with?("file://")
+
+      # ruby-lsp percent-escapes its URIs; workspace_root is a raw path. A
+      # checkout with a space (or any other escaped character) in its path
+      # matched nothing here, so every result was silently dropped.
+      path = URI_UNESCAPER.unescape(uri.delete_prefix("file://"))
+      prefix = "#{workspace_root}/"
+      return nil unless path.start_with?(prefix)
+
+      path.delete_prefix(prefix)
+    end
+
+    def translate_lsp_locations(result, workspace_root)
+      items = result.is_a?(Array) ? result : [result].compact
+      root = workspace_root.to_s
+      items.filter_map do |loc|
+        next unless loc.is_a?(Hash)
+
+        uri   = loc["uri"] || loc["targetUri"]
+        range = loc["range"] || loc["targetSelectionRange"] || loc["targetRange"]
+        next unless uri.to_s.start_with?("file://")
+
+        fpath = URI_UNESCAPER.unescape(uri.delete_prefix("file://"))
+        # Drop gem/stdlib locations the editor can't open; an empty list makes
+        # the frontend fall back to the legacy services (ri covers stdlib).
+        next unless fpath.start_with?("#{root}/")
+
+        start_line = (range&.dig("start", "line") || 0) + 1
+        {
+          file: fpath.delete_prefix("#{root}/"),
+          line: start_line,
+          # Columns and the end of the range are additive: existing consumers
+          # only read :file and :line, but peek-definition needs a real range
+          # to highlight rather than the start of the line.
+          col: (range&.dig("start", "character") || 0) + 1,
+          endLine: (range&.dig("end", "line") || range&.dig("start", "line") || 0) + 1,
+          endCol: (range&.dig("end", "character") || range&.dig("start", "character") || 0) + 1
+        }
+      end
+    end
+
+    def translate_lsp_hover(result, workspace_root)
+      contents = result.is_a?(Hash) ? result["contents"] : nil
+      return nil if contents.nil?
+
+      markdown =
+        case contents
+        when Hash  then contents["value"].to_s
+        when Array then contents.map { |c| c.is_a?(Hash) ? c["value"].to_s : c.to_s }.join("\n\n")
+        else contents.to_s
+        end
+
+      neutralize_comment_headings(rewrite_lsp_hover_links(markdown, workspace_root))
+    end
+
+    # ruby-lsp renders a doc comment by stripping exactly one leading "# " from
+    # each line, then hands the result to the editor as markdown. A `##`-opened
+    # doc block — a very common Ruby convention — therefore arrives as
+    # "# Title" and renders as an <h1> filling the hover.
+    #
+    # Ruby comments are not markdown, so escape a `#` that opens a line and let
+    # it render as the text it is. Fenced code blocks are left alone: `#` inside
+    # them is Ruby source, not a heading, and needs no escaping.
+    #
+    # This deliberately diverges from other ruby-lsp clients, which show the
+    # heading.
+    def neutralize_comment_headings(markdown)
+      in_fence = false
+      markdown.lines.map do |line|
+        in_fence = !in_fence if line.start_with?("```")
+        next line if in_fence || line.start_with?("```")
+
+        line.sub(/\A(\s*)(#+)(?=\s|\z)/) { "#{Regexp.last_match(1)}\\#{Regexp.last_match(2)}" }
+      end.join
+    end
+
+    def rewrite_lsp_hover_links(markdown, workspace_root)
+      prefix = "#{workspace_root}/"
+      markdown.gsub(LSP_HOVER_FILE_LINK) do
+        label, raw_path, line = Regexp.last_match(1), Regexp.last_match(2), Regexp.last_match(3).to_i
+        # Percent-decode by hand: URI's unescape helpers are deprecated on new
+        # Rubies and their replacements are missing on the old ones we support.
+        # (Must come after reading the other captures — gsub resets last_match.)
+        path = raw_path.gsub(/%\h\h/) { |esc| esc[1..].hex.chr }.force_encoding(Encoding::UTF_8)
+
+        if path.start_with?(prefix)
+          args = [path.delete_prefix(prefix), line.positive? ? line : 1]
+          "[#{label}](command:mbeditor.openDefinition?#{ERB::Util.url_encode(args.to_json)})"
+        else
+          "`#{label}`"
+        end
+      end
+    end
+
+    def translate_lsp_completions(result)
+      items = result.is_a?(Hash) ? Array(result["items"]) : Array(result)
+      items.first(100).filter_map do |item|
+        next unless item.is_a?(Hash)
+
+        {
+          label: item["label"].to_s,
+          kind: lsp_completion_kind(item["kind"]),
+          insertText: (item.dig("textEdit", "newText") || item["insertText"] || item["label"]).to_s,
+          detail: item["detail"].to_s,
+          isSnippet: item["insertTextFormat"] == 2
+        }
+      end
+    end
+
+    def lsp_completion_kind(kind)
+      LSP_COMPLETION_KINDS[kind] || "Text"
+    end
+  end
+end

data/app/services/mbeditor/search_replace_service.rb

@@ -229,6 +229,7 @@ module Mbeditor
       end
 
       def scan(workspace_root, query, use_regex:, match_case:, whole_word:, excluded_paths:, paths:, max:, supersede: false)
+        started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         root = workspace_root.to_s
         tier = pick_tier(root)
         env, args = build_command(tier, root, query, use_regex: use_regex, match_case: match_case,
@@ -290,6 +291,13 @@ module Mbeditor
           complete: !timed_out && !superseded && results.length < max,
           superseded: superseded
         }
+      ensure
+        # One record per real search — cache hits never reach here. `backend` is
+        # the tier that actually ran, `hits` the number of matched lines. Never
+        # the query and never a path.
+        AuditLog.record(:search,
+                        ms: ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round,
+                        backend: tier, hits: results&.length || 0)
       end
 
       def pick_tier(root)

data/app/views/layouts/mbeditor/application.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="en">
+<html lang="en" data-theme="<%= @initial_theme || "vs-dark" %>"<%= " data-glass=\"1\"".html_safe if @initial_glass %>>
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />

data/lib/mbeditor/audit_log.rb

@@ -0,0 +1,203 @@
+# frozen_string_literal: true
+
+require "json"
+require "time"
+
+module Mbeditor
+  # A bounded, in-memory audit/telemetry log the developer can download and
+  # hand to an AI to analyse, plus the batches the browser ring pushes up.
+  #
+  # Lives in lib/ (required from lib/mbeditor.rb, NOT autoloaded) for the same
+  # reason as ExceptionLog: a Zeitwerk reload must not wipe the buffer you are
+  # about to download.
+  #
+  # The privacy guarantee is structural, not a scrubber. A field value is kept
+  # only when it is Numeric, true, false or a Symbol. A Symbol is authored in
+  # code and can never be user data; a String can, so Strings are rejected
+  # outright. The client mirrors this rule by dropping any argument to rec()
+  # whose typeof is not 'number'. Neither channel can carry a path, a file
+  # name, a URL or a line of source.
+  module AuditLog
+    MAX_ENTRIES = 5000
+
+    # One client batch. The browser ring holds 512, so this only bounds a
+    # forged or replayed POST.
+    MAX_INGEST = 2048
+
+    # Largest body the ingest endpoint will parse. 512 five-number entries plus
+    # the legend is well under this.
+    MAX_POST_BYTES = 1024 * 1024
+
+    ENTRY_LENGTH = 5
+
+    # Refuse to read back a file larger than the two rings could ever produce.
+    MAX_FILE_BYTES = 8 * 1024 * 1024
+
+    # Write-behind: at most one file write every PERSIST_INTERVAL seconds.
+    PERSIST_INTERVAL = 5
+
+    MUTEX = Mutex.new
+    private_constant :MUTEX
+
+    class << self
+      def enabled?
+        Mbeditor.configuration.audit_log != false
+      end
+
+      # Returns the recorded entry, or nil when nothing was recorded.
+      def record(event, **fields)
+        return nil unless enabled?
+        return nil unless event.is_a?(Symbol)
+
+        entry = { at: Time.now.utc.iso8601, event: event }
+        fields.each { |key, value| entry[key] = value if safe?(value) }
+
+        # try_lock, not synchronize, and no file write. ProcessRunner is the
+        # choke point every subprocess goes through, including AvailabilityProbe's
+        # concurrent probes, which are deliberately run outside that service's own
+        # mutex so they do not serialise (see CLAUDE.md). Blocking them on a
+        # telemetry lock would put that back. A dropped sample under contention
+        # is the right trade: contention is exactly when blocking would hurt, and
+        # an uncontended record — the normal case — never drops.
+        return nil unless MUTEX.try_lock
+
+        begin
+          load_unlocked
+          bound(@entries << entry)
+          @dirty = true
+        ensure
+          MUTEX.unlock
+        end
+        entry
+      # Every caller is an `ensure` block wrapping real work. A raise here would
+      # replace the exception that block is unwinding, so a telemetry failure
+      # would masquerade as the bug it was recording.
+      rescue StandardError => e
+        Rails.logger.debug("[mbeditor] audit record failed: #{e.class}: #{e.message}")
+        nil
+      end
+
+      # A batch from the browser ring. Returns the number of entries kept.
+      #
+      # Deliberately takes no legend. The legend is a constant of the browser
+      # bundle, so shipping it up here would be the one channel in this module
+      # that accepts an arbitrary String, and the guarantee above would be a
+      # claim rather than a property. The download handler merges it in client
+      # side instead, where it never crosses the wire at all.
+      def ingest(events)
+        return nil unless enabled?
+        return nil unless events.is_a?(Array)
+
+        kept = events.first(MAX_INGEST).select { |entry| client_entry?(entry) }
+
+        MUTEX.synchronize do
+          load_unlocked
+          bound(@client_events.concat(kept))
+          @dirty = true
+        end
+        persist!
+        kept.length
+      rescue StandardError => e
+        Rails.logger.debug("[mbeditor] audit ingest failed: #{e.class}: #{e.message}")
+        nil
+      end
+
+      # Persisting is driven from ingest and payload, never from record: the
+      # client flush is already batched and the download is a deliberate act,
+      # whereas record runs inside every request and subprocess.
+      #
+      # The download payload. Persists unconditionally first, so the file on
+      # disk always matches what the developer just downloaded.
+      def payload
+        persist!(force: true)
+        MUTEX.synchronize do
+          load_unlocked
+          {
+            schema: 1,
+            generatedAt: Time.now.utc.iso8601,
+            client: { events: @client_events.dup },
+            server: { events: @entries.dup }
+          }
+        end
+      end
+
+      def clear!
+        MUTEX.synchronize do
+          @loaded = true
+          @entries = []
+          @client_events = []
+          @dirty = false
+          @persisted_at = nil
+        end
+        path = file_path
+        File.delete(path) if path && File.exist?(path)
+        nil
+      rescue SystemCallError, IOError
+        nil
+      end
+
+      private
+
+      def safe?(value)
+        value.is_a?(Numeric) || value == true || value == false || value.is_a?(Symbol)
+      end
+
+      # Numbers only, fixed width. A string, a nested object or a short array
+      # is dropped rather than repaired.
+      def client_entry?(entry)
+        entry.is_a?(Array) && entry.length == ENTRY_LENGTH &&
+          entry.all? { |value| value.is_a?(Numeric) && value.finite? }
+      end
+
+      def bound(ring)
+        ring.shift while ring.length > MAX_ENTRIES
+        ring
+      end
+
+      # Serialises under the lock and writes outside it: the file runs to a
+      # megabyte and a request should never wait on that IO.
+      def persist!(force: false)
+        json = MUTEX.synchronize do
+          load_unlocked
+          next nil unless force || (@dirty && Time.now.to_f - (@persisted_at || 0) >= PERSIST_INTERVAL)
+
+          @dirty = false
+          @persisted_at = Time.now.to_f
+          JSON.generate("schema" => 1, "client" => @client_events, "server" => @entries)
+        end
+        return if json.nil?
+
+        path = file_path
+        File.write(path, json) if path
+        nil
+      rescue SystemCallError, IOError => e
+        Rails.logger.debug("[mbeditor] audit log persist failed: #{e.class}: #{e.message}")
+      end
+
+      # Loaded once, lazily. Surviving a page reload is the point of persisting,
+      # and the server process may have restarted in between.
+      def load_unlocked
+        return if @loaded
+
+        @loaded = true
+        @entries = []
+        @client_events = []
+
+        path = file_path
+        return unless path && File.exist?(path) && File.size(path) <= MAX_FILE_BYTES
+
+        data = JSON.parse(File.read(path))
+        return unless data.is_a?(Hash)
+
+        @entries = bound(Array(data["server"]).grep(Hash).map { |raw| raw.transform_keys(&:to_sym) })
+        @client_events = bound(Array(data["client"]).select { |raw| client_entry?(raw) })
+      rescue JSON::ParserError, SystemCallError, IOError => e
+        Rails.logger.debug("[mbeditor] audit log load failed: #{e.class}: #{e.message}")
+      end
+
+      def file_path
+        Rails.root && Rails.root.join("tmp", "mbeditor_audit.json").to_s
+      end
+    end
+  end
+end

data/lib/mbeditor/configuration.rb

@@ -12,7 +12,7 @@ module Mbeditor
                   :js_program, :js_program_exclude,
                   :js_syntax_check, :babel_standalone_path, :js_scope_lint,
                   :ruby_lsp, :ruby_lsp_command, :ruby_lsp_timeout,
-                  :exception_capture, :model_graph_max_models,
+                  :exception_capture, :audit_log, :model_graph_max_models,
                   :search_respect_gitignore, :ripgrep_command
 
     def initialize
@@ -98,6 +98,11 @@ module Mbeditor
       # same exposure the log panel already has, since it tails the dev log.
       # Set to false to record nothing.
       @exception_capture = :auto
+      # Record an audit/telemetry log the developer can download and hand to an
+      # AI to analyse. It carries numbers only — no code, file names, URLs or
+      # host paths — because both the browser ring and AuditLog.record refuse
+      # to store a String at all. Set to false to record nothing.
+      @audit_log = true
       # Models drawn in the model graph before it reports itself truncated.
       # nil uses ModelGraphService::DEFAULT_MAX_MODELS.
       @model_graph_max_models = nil

data/lib/mbeditor/rack/pending_migration_bypass.rb

@@ -46,34 +46,40 @@ module Mbeditor
 
       # Announced on every bypassed response so the editor can warn about a
       # migration created mid-session, not only one that existed at page load.
+      #
+      # It is always present, "1" or "0" — an omitted header is NOT the same as
+      # "no longer pending". These responses are conditional-GET cacheable, and
+      # a 304 only *updates* the stored headers of the cached 200: a header the
+      # 304 leaves out stays in the cache verbatim. Omitting it when the check
+      # passed therefore replayed a stale "pending" to the browser for as long
+      # as the cache entry lived — which is exactly what made the warning stick
+      # after `rails db:migrate`, and flicker as cached and fresh responses
+      # disagreed. A value that is always sent is overwritten on every
+      # revalidation. The message itself does not travel; the editor's warning
+      # supplies the instructions.
       PENDING_HEADER = "X-Mbeditor-Pending-Migration"
 
       def call(env)
         return @checked.call(env) unless editor_traffic?(env)
 
         begin
-          result = @checked.call(env)
+          status, headers, body = @checked.call(env)
           # The check passed, so anything recorded earlier is stale.
           Mbeditor::PendingMigrations.clear
-          result
+          headers[PENDING_HEADER] = "0"
+          [status, headers, body]
         rescue StandardError => e
           raise unless pending_migration_error?(e)
 
           Mbeditor::PendingMigrations.note(e.message)
           status, headers, body = @app.call(env)
-          headers[PENDING_HEADER] = header_safe(e.message)
+          headers[PENDING_HEADER] = "1"
           [status, headers, body]
         end
       end
 
       private
 
-      # A header cannot carry the newlines the error message has, and it does
-      # not need the whole thing — the banner supplies the instructions.
-      def header_safe(message)
-        message.to_s.gsub(/\s+/, " ").strip[0, 200]
-      end
-
       def pending_migration_error?(error)
         defined?(ActiveRecord::PendingMigrationError) &&
           error.is_a?(ActiveRecord::PendingMigrationError)

data/lib/mbeditor/route_map.rb

@@ -14,6 +14,7 @@ module Mbeditor
     get    'files',           to: 'editors#files'
     get    'file',            to: 'editors#show'
     get    'raw',             to: 'editors#raw'
+    get    'archive',         to: 'editors#archive'
     post   'file',            to: 'editors#save'
     post   'create_file',     to: 'editors#create_file'
     post   'create_dir',      to: 'editors#create_dir'
@@ -39,6 +40,9 @@ module Mbeditor
   get    'model_graph',     to: 'editors#model_graph'
   get    'exceptions',      to: 'editors#exceptions'
   delete 'exceptions',      to: 'editors#clear_exceptions'
+    get    'audit_log',       to: 'editors#audit_log'
+    post   'audit_log',       to: 'editors#ingest_audit_log'
+    delete 'audit_log',       to: 'editors#clear_audit_log'
     get    'module_members',  to: 'editors#module_members'
     get    'file_includes',   to: 'editors#file_includes'
     get    'client_config',   to: 'editors#client_config'