mbeditor 0.13.1 → 0.14.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fe5dce956e01ff66387b9ccf99fc8b163ce131a226158eda7b6cf2c8513eaa09
-  data.tar.gz: 37e4f12f4ccd1ca7d209e7fe134a25d813bbe175862d53a470a5042aff9d7797
+  metadata.gz: d6faf6632c3072f98fe34083c809069a4e37ed9e956fd6722fd2fb188ed13c55
+  data.tar.gz: 24e179af4efd250cef7ddeec7d81a8c033891af89cb286980ddbb3541f543239
 SHA512:
-  metadata.gz: 60c74bb23b92719d4273d720af42813e2ecd3d639281901d47037e332697819cbe58c338eea9aeff334f3533d48d2e62c994b2122fb36fbded4bef94bd225b36
-  data.tar.gz: 1451f3b2effb5d9cffd9811b41ea72b07d174702af9e6dc9993d5fbc92d990109dbf834e957c1eced22e8d77b815173d14bf6465b51072002a0e1c482745dc69
+  metadata.gz: 800cbc5afda678e3ae3298dc781f39054c32ecb0098dc82e68df9c6f0f8222ba4e5c06d0c6b424e50360dda0f02ed678169c4f4922353c432c8c0b446f28f428
+  data.tar.gz: 49bca37c5e4a696a4ba1ec4f5f01454899d006cb827f109e11a96e46feb65544ac7c85afdc55756076302618a2af30ced210e1b149b85690899b6801f5dcd37b

data/CHANGELOG.md

@@ -5,6 +5,138 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.14.1] - 2026-10-19
+
+### Added
+- **Combined View.** Ctrl/Cmd-select files or folders in the explorer, right-click,
+  "Open in Combined View": every file on one scrolling page under its path, with
+  Copy and Download per file. Folders expand recursively; capped at 200 files with
+  a visible note. The tab is virtual and is not restored on reload.
+- **Method picking and Markdown export.** In Combined View, Ruby files get a
+  method checklist; "Download .md" / "Copy .md" bundle the view into one file,
+  method-limited files keeping their `class`/`module` skeleton with `# ...`
+  between pieces. Built for chat assistants that take only a few attachments.
+- **Paste & Place** (editor context menu or F1, Ruby). Paste methods from a
+  chat reply and mbeditor finds where each goes: the active file, then a repo
+  search for `def name` narrowed by class. New methods go into the file that
+  holds the class, before `private`. Diff preview first; Apply is one undoable
+  edit in the buffer and nothing is saved.
+- **Compare on upload conflicts.** When an upload or drop would overwrite a
+  file, each text file gets a "Compare" diff of disk vs incoming.
+- `POST /ruby_methods`: Ripper-based method ranges (owner, singleton, doc
+  comment start) behind the two features above.
+- A help-panel section describing all of the above.
+
+### Fixed
+- **Unreadable status bar and buttons.** The Liquid Glass status bar and the
+  title-bar buttons painted "text on the accent fill" onto panel-coloured
+  surfaces; glass also hid the amber pending-migration background; Dracula,
+  Night Owl and Tomorrow Night had white text on light accents. 44 combinations
+  (11 themes × glass × pending) now all clear 4.5:1 on the status bar.
+- **Flicker while migrations are pending.** `/cable` was not covered by the
+  pending-migration bypass, so every reconnect raised and the live channel
+  (presence, collaboration, file-change push) stayed dead.
+- Paste & Place searches use POSIX classes, because the `git grep` search tier
+  is ERE and silently matches nothing for `\s`.
+
+### Changed
+- **Monaco 0.57.0** (from 0.55.1). Its TypeScript API moved from
+  `monaco.languages.typescript` to `monaco.typescript`; every call site is
+  migrated. DOMPurify inside Monaco is still 3.4.15 (advisory rated low) until a
+  Monaco release ships 3.4.16+.
+- **axios 1.20.0** (from 1.17.0 vendored), for new high-severity advisories.
+
+## [0.14.0] - 2026-09-21
+
+### Added
+- **Liquid Glass chrome, opt-in** (Settings → Appearance). Translucent, blurred
+  panels layered over whichever theme is active — it is a layer, not a twelfth
+  theme, so every colour is derived from the existing `--ide-*` tokens. Monaco
+  itself stays solid: legibility beats the effect, and a blurred backdrop under
+  a text editor costs a re-composite per repaint. The default chrome is the new
+  Modern one, matching VS Code's Dark Modern.
+- **Drag-to-open gutters.** One `Gutter` component owns every draggable gap.
+  Drag the strip above the status bar to open Problems, the right edge to open
+  the git panel, and the collapsed sidebar's gutter rightwards to snap the
+  explorer back open.
+- **Settings is a searchable modal**, not an editor tab, so it no longer takes a
+  pane or persists into your tab list.
+- **The model graph opens as its own view**, not a tab: the activity-bar icon
+  toggles it, it takes the whole centre column, and both side panels hide with
+  it. A layered graph is inherently wide and the tab gave it whatever was left
+  beside the explorer.
+- **A downloadable audit log** (Settings → Diagnostics) that structurally cannot
+  carry a file name, path or URL — every field is a number, boolean or authored
+  Symbol.
+- **Quick Open as a frosted palette** over the title bar, with a chevron
+  breadcrumb and VS Code-style Open Editors rows.
+- Auto-close tags in ERB and multi-line JSX, linked tag pairs, and `props.x`
+  completion.
+- Multi-select download in the explorer.
+- A `toolbarLabels` preference: toolbar button labels are now opt-in.
+- Accessibility: a focus-visible ring throughout, a real tab-close button, a
+  higher-contrast version chip, and the offline pulse respects reduced-motion.
+
+### Changed
+- **The pending-migration warning is no longer a banner.** It sat above
+  everything and pushed the editor down the page every time it appeared. The
+  status bar turns amber instead and carries a "Migrations pending" item. Both
+  halves of that colour are per-theme, because `--ide-warning` is authored as a
+  foreground colour and several themes pick an ochre that is unreadable as a
+  background; measured contrast is 4.87:1 to 14.97:1 across the eleven themes.
+- **Peer presence is an avatar stack**, not one chip per peer. Eight people used
+  to mean eight buttons across the title bar; it is now three overlapping dots
+  and a `+N`, fixed width whatever the roster size. Hovering a dot opens the
+  usual card, clicking follows or unfollows, and the `+N` opens a list of
+  everyone else with a follow toggle per row.
+- The title bar says "Mbeditor" rather than the full window title; the host and
+  port are in the browser's own address bar.
+- The file-tree section header has no chevron. Collapsing it left an empty
+  sidebar, so there was nothing to collapse to.
+- Tabs are rounded chips on the strip, the Problems panel wears VS Code chrome,
+  and problem counts are neutral rather than alarming.
+- `.scss` files open as scss and `.less` files as less, instead of css and
+  plaintext.
+- Audit recording moved off the subprocess critical path.
+
+### Fixed
+- **The pending-migration warning stuck after `rails db:migrate`**, and
+  flickered before that. The header announcing it was only *set* when a
+  migration was pending, and those responses are conditional-GET cacheable: a
+  304 updates the stored headers of the cached 200 but never removes one it
+  omits, so the browser replayed "pending" for as long as the cache entry
+  lived. It is now always sent, `1` or `0`, and an absent header counts as no
+  evidence either way.
+- **The model graph was unusable on a large app.** The cost was in click and
+  hover, not pan and zoom: `focused` was a dependency of the scene memo, so
+  every click-to-centre rebuilt every SVG element inside the click handler;
+  node hover scanned the whole scene per mouseenter; and the hover card and
+  edge tooltip each read `getBoundingClientRect` per pointer move, right after
+  hover had dirtied the style, forcing a full-scene layout. Measured on a
+  420-model, 1,249-association app: click-to-centre 20.4 ms → 7.9 ms median,
+  hover 45.7 ms → 33.2 ms.
+- Collaboration data-loss paths, and the per-keystroke buffer work that went
+  with them.
+- Undo tracking starts after the file load, not before, so the first undo no
+  longer empties a freshly opened file.
+- Ruby hover skips comments and the route-hint decoration space, and
+  go-to-definition starts the Ripper fallback alongside ruby-lsp rather than
+  after it.
+- Closing a markdown file closes its preview, and source and preview scroll in
+  sync.
+- Markdown anchor links, upload UX, the conflict chip and the cursor readout.
+- `RubyLspClient` performs its handshake outside the state lock, bounds the
+  document-lock wait, and keeps an LRU of documents.
+- `JsSyntaxCheckService` remembers a broken babel bundle instead of retrying it,
+  and bounds its lock wait.
+- The test-result `localStorage` cache is capped, and failed draft backups are
+  surfaced rather than silently dropped.
+- `json` is pinned below 3 so the suite runs.
+
+### Removed
+- Stale agent docs, the dead `build_js` rake task and a set of duplicated
+  helpers — about 1,100 lines.
+
 ## [0.13.1] - 2026-08-26
 
 ### Removed

data/app/assets/javascripts/mbeditor/application.js

@@ -1,4 +1,5 @@
 //= require mbeditor/application_iife_head
+//= require mbeditor/audit_log
 //= require mbeditor/editor_store
 //= require mbeditor/file_icon
 //= require mbeditor/file_service
@@ -17,12 +18,15 @@
 //= require mbeditor/ruby_outline
 //= require mbeditor/js_outline
 //= require mbeditor/components/CollapsibleSection
+//= require mbeditor/components/SettingsModal
+//= require mbeditor/components/Gutter
 //= require mbeditor/components/ShortcutHelp
 //= require mbeditor/components/DiffViewer
 //= require mbeditor/components/CombinedDiffViewer
 //= require mbeditor/components/CommitGraph
 //= require mbeditor/components/ModelGraph
 //= require mbeditor/components/ChangelogView
+//= require mbeditor/components/CombinedFileView
 //= require mbeditor/components/FileHistoryPanel
 //= require mbeditor/components/TestResultsPanel
 //= require mbeditor/components/LogPanel
@@ -39,5 +43,6 @@
 // whole app down the first time it renders.
 //= require mbeditor/components/ImportConflictModal
 //= require mbeditor/components/ImportDialog
+//= require mbeditor/components/PastePlaceModal
 //= require mbeditor/components/MbeditorApp
 //= require mbeditor/application_iife_tail

data/app/assets/javascripts/mbeditor/audit_log.js

@@ -0,0 +1,165 @@
+// Audit/telemetry ring the developer can download and hand to an AI to analyse.
+//
+// The privacy guarantee is structural, not a scrubber: rec() is the only way
+// in, and it drops any argument whose typeof is not 'number'. A path, a file
+// name, a URL or a line of source cannot be represented at all. Enumerated
+// dimensions (file extension, search backend tier, LSP method, collab phase)
+// travel as small integers whose meaning lives in LEGEND. LEGEND stays here and
+// is merged into the file at download time: sending it to the server would be
+// the one path in this module that carries an arbitrary string, which is
+// exactly the property the rest of it exists to deny.
+window.MbeditorAudit = (function () {
+  var CAPACITY = 512;
+  var FLUSH_AT = CAPACITY / 2;
+
+  var EV = Object.freeze({
+    BOOT: 1,
+    OPEN: 2,
+    SAVE: 3,
+    SEARCH: 4,
+    TREE_POLL: 5,
+    GIT_POLL: 6,
+    LINT: 7,
+    FORMAT: 8,
+    LSP: 9,
+    COLLAB: 10,
+    LONGTASK: 11,
+    ERR: 12
+  });
+
+  var LEGEND = {
+    ev: {},
+    // What a, b and c mean per event. A field named after one of the
+    // enumerated dimensions below carries an index into that table.
+    fields: {
+      BOOT:      ['msToReady', '', ''],
+      OPEN:      ['ext', 'bytes', 'ms'],
+      SAVE:      ['ext', 'bytes', 'ms'],
+      SEARCH:    ['searchBackend', 'ms', 'hits'],
+      TREE_POLL: ['ms', 'changed', ''],
+      GIT_POLL:  ['ms', 'changedFiles', ''],
+      LINT:      ['ext', 'ms', 'markers'],
+      FORMAT:    ['ext', 'ms', 'bytes'],
+      LSP:       ['lspMethod', 'ms', 'ok'],
+      COLLAB:    ['collabPhase', 'peers', 'ms'],
+      LONGTASK:  ['ms', '', ''],
+      ERR:       ['ev', '', '']
+    },
+    // Index 0 is always "other", so an unrecognised name still records.
+    ext: ['other', 'rb', 'js', 'jsx', 'erb', 'haml', 'css', 'scss', 'html', 'md', 'json', 'yml', 'ts', 'tsx'],
+    searchBackend: ['other', 'rg', 'git', 'grep'],
+    lspMethod: ['other', 'definition', 'hover', 'completion', 'diagnostics', 'references', 'rename',
+                'format', 'signatureHelp', 'documentSymbol', 'foldingRange', 'documentHighlight',
+                'selectionRange', 'codeAction'],
+    collabPhase: ['other', 'join', 'seed', 'attach', 'defer', 'update', 'reconnect', 'leave', 'degrade']
+  };
+  Object.keys(EV).forEach(function (name) { LEGEND.ev[EV[name]] = name; });
+
+  // Preallocated: rec() reuses the slot, so recording allocates nothing.
+  var ring = new Array(CAPACITY);
+  for (var i = 0; i < CAPACITY; i++) ring[i] = [0, 0, 0, 0, 0];
+
+  var write = 0;
+  var count = 0;
+  var enabled = false;
+  var scheduled = false;
+  var observing = false;
+
+  // The whole privacy guarantee in one line.
+  function num(v) { return typeof v === 'number' && isFinite(v) ? v : 0; }
+
+  function rec(ev, a, b, c) {
+    if (!enabled) return;
+    var e = ring[write];
+    e[0] = performance.now() | 0;
+    e[1] = num(ev);
+    e[2] = num(a);
+    e[3] = num(b);
+    e[4] = num(c);
+    write = write + 1 === CAPACITY ? 0 : write + 1;
+    if (count < CAPACITY) count++;
+    if (count >= FLUSH_AT) schedule();
+  }
+
+  function code(dimension, name) {
+    var table = LEGEND[dimension];
+    var index = table ? table.indexOf(name) : -1;
+    return index < 0 ? 0 : index;
+  }
+
+  function drain() {
+    var out = new Array(count);
+    var start = (write - count + CAPACITY) % CAPACITY;
+    for (var i = 0; i < count; i++) {
+      var e = ring[(start + i) % CAPACITY];
+      out[i] = [e[0], e[1], e[2], e[3], e[4]];
+    }
+    count = 0;
+    write = 0;
+    return out;
+  }
+
+  // keepalive rather than navigator.sendBeacon: the CSRF guard needs the
+  // X-Mbeditor-Client header and sendBeacon cannot set one.
+  function flush() {
+    scheduled = false;
+    if (!enabled || count === 0) return Promise.resolve();
+    var body = JSON.stringify({ events: drain() });
+    return fetch(window.mbeditorBasePath() + '/audit_log', {
+      method: 'POST',
+      keepalive: true,
+      headers: { 'X-Mbeditor-Client': '1', 'Content-Type': 'application/json' },
+      body: body
+    })['catch'](function () {});
+  }
+
+  function schedule() {
+    if (scheduled) return;
+    scheduled = true;
+    if (window.requestIdleCallback) {
+      window.requestIdleCallback(function () { flush(); }, { timeout: 2000 });
+    } else {
+      setTimeout(function () { flush(); }, 0);
+    }
+  }
+
+  function observe() {
+    if (observing) return;
+    observing = true;
+    try {
+      new PerformanceObserver(function (list) {
+        var items = list.getEntries();
+        for (var i = 0; i < items.length; i++) rec(EV.LONGTASK, items[i].duration | 0);
+      }).observe({ type: 'longtask', buffered: true });
+    } catch (e) {
+      // Safari has no longtask entry type. Everything else keeps recording.
+    }
+  }
+
+  function clear() { count = 0; write = 0; }
+
+  function setEnabled(on) {
+    on = !!on;
+    if (on === enabled) return;
+    enabled = on;
+    // Disabled means nothing recorded, including what was buffered before the
+    // preference arrived from the server.
+    if (on) observe(); else clear();
+  }
+
+  window.addEventListener('pagehide', function () { flush(); });
+  document.addEventListener('visibilitychange', function () {
+    if (document.visibilityState === 'hidden') flush();
+  });
+
+  return {
+    EV: EV,
+    LEGEND: LEGEND,
+    rec: rec,
+    code: code,
+    flush: flush,
+    clear: clear,
+    setEnabled: setEnabled,
+    buffered: function () { return count; }
+  };
+})();