mbeditor 0.8.1 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f74579627da44a31db150cb5de08c5060ccad0a68e9ac47603039b84849fff2
-  data.tar.gz: d2fa6b611b1a1804e26748281f367bd3f2dfc20796d0459defb9b05d65583fa1
+  metadata.gz: 2612297fd4760bf7660ab89589c549ff6a815df395e4f57fb48d6f60c1c519b8
+  data.tar.gz: d9bf030f5f056754bfe8c633253aba3013c7405aaba259628c0e7aa5e7b19aff
 SHA512:
-  metadata.gz: ab9d1c840c0153f07f3f1989874bca8025d59921615597be5eae9ba83b5eb9c536a554d50bb934c4d2c6202d8d89b119179241cba67c4c21bdf81f98491546d3
-  data.tar.gz: e5328c15e5c250c55a0d02eba2a38e2d752bf8c813d9e740181cd3e0ff86e5d79fa1bfb2e5cb5ad566328cd6b17b23faf2952edc0eed4564ec1311b86ef649f3
+  metadata.gz: 8660eda73b4cb4e3d38ab7c820286a363340e6a65592e66817c5b0594374e60532769c06999fb9a099b6082ee99f4fd1f604ec6116908f63317daed1153780d7
+  data.tar.gz: b27df09cb524a48508285abe5892b8f261f44efaa471fe580a839be1e3f2064d385848aa4e2b488af812d88b3181ee9f51e26c3e3cb84bc79353c619184ddd80

data/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.0] - 2026-07-23
+
+### Added
+- **Test-aware Ruby Outline** — the editor now recognises Minitest and RSpec
+  suites, tests, and helper methods in `_test.rb` and `_spec.rb` files. It
+  reads the unsaved Monaco buffer, preserves nested suite depth and method
+  visibility, supports keyboard navigation, and safely reports truncation or
+  parser failures without disrupting the editor.
+- **Ruby test-DSL highlighting** — Minitest/RSpec declarations, hooks, and
+  helpers now receive structural Monaco tokens while Ruby files retain the
+  existing `ruby` language identity and integrations.
+
+### Security
+- **Dangling symlink containment** — every editor and Git path check now
+  rejects dangling symlinks that resolve outside the workspace or repository,
+  closing a write-through escape for create, save, rename, and directory
+  operations.
+- **Filesystem-aware exclusions** — exclusion matching now normalizes Unicode
+  spellings and folds case only on case-insensitive filesystems, preventing
+  case or normalization variants from reaching excluded directories such as
+  `.git`.
+
+### Changed
+- Generated `graphify-out/` artifacts are ignored by Git.
+
+---
+
 ## [0.8.1] - 2026-07-22
 
 ### Fixed

data/app/assets/javascripts/mbeditor/application.js

@@ -11,6 +11,7 @@
 //= require mbeditor/tab_manager
 //= require mbeditor/color_provider
 //= require mbeditor/editor_plugins
+//= require mbeditor/ruby_outline
 //= require mbeditor/components/CollapsibleSection
 //= require mbeditor/components/ShortcutHelp
 //= require mbeditor/components/DiffViewer

data/app/assets/javascripts/mbeditor/components/EditorPanel.js

@@ -88,33 +88,44 @@ var EditorPanel = function EditorPanel(_ref) {
   var methodsList = _useState14[0];
   var setMethodsList = _useState14[1];
 
-  var _useState15 = useState(null);
+  var _useState15 = useState(false);
   var _useState16 = _slicedToArray(_useState15, 2);
-  var methodsDropdownPos = _useState16[0];
-  var setMethodsDropdownPos = _useState16[1];
+  var methodsTruncated = _useState16[0];
+  var setMethodsTruncated = _useState16[1];
 
-  var methodsBtnRef = useRef(null);
-
-  // Local pagination state — initialized from tab props; updated on page navigation
-  var _useState17 = useState(tab.startLine || 0);
+  var _useState17 = useState(false);
   var _useState18 = _slicedToArray(_useState17, 2);
-  var pageStartLine = _useState18[0];
-  var setPageStartLine = _useState18[1];
+  var methodsUnavailable = _useState18[0];
+  var setMethodsUnavailable = _useState18[1];
 
-  var _useState19 = useState(tab.lineCount || 0);
+  var _useState19 = useState(null);
   var _useState20 = _slicedToArray(_useState19, 2);
-  var pageLineCount = _useState20[0];
-  var setPageLineCount = _useState20[1];
+  var methodsDropdownPos = _useState20[0];
+  var setMethodsDropdownPos = _useState20[1];
+
+  var methodsBtnRef = useRef(null);
+  var methodsDropdownRef = useRef(null);
 
-  var _useState21 = useState(tab.totalLines || 0);
+  // Local pagination state — initialized from tab props; updated on page navigation
+  var _useState21 = useState(tab.startLine || 0);
   var _useState22 = _slicedToArray(_useState21, 2);
-  var pageTotalLines = _useState22[0];
-  var setPageTotalLines = _useState22[1];
+  var pageStartLine = _useState22[0];
+  var setPageStartLine = _useState22[1];
 
-  var _useState23 = useState(tab.totalBytes || 0);
+  var _useState23 = useState(tab.lineCount || 0);
   var _useState24 = _slicedToArray(_useState23, 2);
-  var pageTotalBytes = _useState24[0];
-  var setPageTotalBytes = _useState24[1];
+  var pageLineCount = _useState24[0];
+  var setPageLineCount = _useState24[1];
+
+  var _useState25 = useState(tab.totalLines || 0);
+  var _useState26 = _slicedToArray(_useState25, 2);
+  var pageTotalLines = _useState26[0];
+  var setPageTotalLines = _useState26[1];
+
+  var _useState27 = useState(tab.totalBytes || 0);
+  var _useState28 = _slicedToArray(_useState27, 2);
+  var pageTotalBytes = _useState28[0];
+  var setPageTotalBytes = _useState28[1];
 
   var onFormatRef = useRef(onFormat);
   onFormatRef.current = onFormat;
@@ -1601,6 +1612,13 @@ var EditorPanel = function EditorPanel(_ref) {
   var fileBaseName = (tab.path || '').split('/').pop().toLowerCase();
   var isRubyFile = ext === 'rb' || ext === 'ruby' || ext === 'gemspec' || ext === 'rake' ||
     fileBaseName === 'gemfile' || fileBaseName === 'gemfile.lock' || fileBaseName === 'rakefile';
+  var isTestOutline = false;
+  try {
+    isTestOutline = isRubyFile && window.RubyOutline &&
+      typeof window.RubyOutline.isTestPath === 'function' && window.RubyOutline.isTestPath(tab.path);
+  } catch (err) {
+    isTestOutline = false;
+  }
 
   useEffect(function () {
     if (isMarkdown && window.marked) {
@@ -1638,8 +1656,8 @@ var EditorPanel = function EditorPanel(_ref) {
     if (!methodsOpen) return;
     function handleClickOutside(e) {
       var btn = methodsBtnRef.current;
-      // Close if click is not on the button (the dropdown uses onMouseDown with preventDefault)
-      if (btn && !btn.contains(e.target)) {
+      var dropdown = methodsDropdownRef.current;
+      if (btn && !btn.contains(e.target) && (!dropdown || !dropdown.contains(e.target))) {
         setMethodsOpen(false);
       }
     }
@@ -1667,20 +1685,14 @@ var EditorPanel = function EditorPanel(_ref) {
     });
   }
 
-  // Parse all method definitions from the current Monaco model
-  function parseRubyMethods(model) {
-    var methods = [];
+  // Parse the current Monaco buffer so unsaved Ruby test declarations appear too.
+  function parseRubyOutline(model, path) {
     var lineCount = model.getLineCount();
-    var DEF_RE = /^\s*def\s+(self\.)?([a-zA-Z_][a-zA-Z0-9_?!=]*)/;
+    var lines = [];
     for (var i = 1; i <= lineCount; i++) {
-      var line = model.getLineContent(i);
-      var m = DEF_RE.exec(line);
-      if (m) {
-        var selfPrefix = m[1] ? 'self.' : '';
-        methods.push({ line: i, name: selfPrefix + m[2] });
-      }
+      lines.push(model.getLineContent(i));
     }
-    return methods;
+    return window.RubyOutline.parse(lines, { path: path });
   }
 
   if (tab.fileNotFound) {
@@ -1831,7 +1843,16 @@ var EditorPanel = function EditorPanel(_ref) {
             var nextOpen = !methodsOpen;
             if (nextOpen) {
               var model = monacoRef.current && monacoRef.current.getModel();
-              setMethodsList(model ? parseRubyMethods(model) : []);
+              try {
+                var result = model ? parseRubyOutline(model, tab.path) : { entries: [], truncated: false };
+                setMethodsList(result.entries || []);
+                setMethodsTruncated(!!result.truncated);
+                setMethodsUnavailable(false);
+              } catch (err) {
+                setMethodsList([]);
+                setMethodsTruncated(false);
+                setMethodsUnavailable(true);
+              }
               if (methodsBtnRef.current) {
                 var rect = methodsBtnRef.current.getBoundingClientRect();
                 setMethodsDropdownPos({ top: rect.bottom + 4, right: window.innerWidth - rect.right });
@@ -1839,10 +1860,10 @@ var EditorPanel = function EditorPanel(_ref) {
             }
             setMethodsOpen(nextOpen);
           },
-          title: 'Jump to Method'
+          title: isTestOutline ? 'Jump to Outline' : 'Jump to Method'
         },
         React.createElement('i', { className: 'fas fa-list-ul', style: { marginRight: editorPrefs.toolbarIconOnly ? 0 : '5px', flexShrink: 0 } }),
-        !editorPrefs.toolbarIconOnly && React.createElement('span', { className: 'ide-toolbar-label' }, 'Methods')
+        !editorPrefs.toolbarIconOnly && React.createElement('span', { className: 'ide-toolbar-label' }, isTestOutline ? 'Outline' : 'Methods')
       ),
       gitAvailable && React.createElement(
         'button',
@@ -2029,31 +2050,99 @@ var EditorPanel = function EditorPanel(_ref) {
     methodsOpen && methodsDropdownPos && React.createElement(
       'div',
       {
+        ref: methodsDropdownRef,
         className: 'ide-methods-dropdown',
         style: { position: 'fixed', top: methodsDropdownPos.top + 'px', right: methodsDropdownPos.right + 'px', left: 'auto', zIndex: 9900 }
       },
-      methodsList.length === 0
-        ? React.createElement('div', { className: 'ide-methods-dropdown-empty' }, 'No methods found')
-        : methodsList.map(function(m) {
-            return React.createElement(
-              'div',
-              {
-                key: m.line,
-                className: 'ide-methods-dropdown-item',
-                onMouseDown: function(e) {
-                  e.preventDefault();
-                  setMethodsOpen(false);
-                  if (monacoRef.current) {
-                    monacoRef.current.revealLineInCenter(m.line);
-                    monacoRef.current.setPosition({ lineNumber: m.line, column: 1 });
-                    monacoRef.current.focus();
+      methodsUnavailable
+        ? React.createElement('div', { className: 'ide-methods-dropdown-message' }, 'Outline unavailable')
+        : methodsList.length === 0
+          ? React.createElement('div', { className: 'ide-methods-dropdown-empty' }, isTestOutline ? 'No outline entries found' : 'No methods found')
+          : (function() {
+              var rows = [];
+              var visibility = null;
+              var visibilityStartLine = null;
+              var visibilityRows = [];
+              var icons = { method: 'fa-code', suite: 'fa-layer-group', test: 'fa-flask' };
+
+              function activateEntry(entry) {
+                setMethodsOpen(false);
+                if (monacoRef.current) {
+                  monacoRef.current.revealLineInCenter(entry.line);
+                  monacoRef.current.setPosition({ lineNumber: entry.line, column: 1 });
+                  monacoRef.current.focus();
+                }
+              }
+
+              function flushVisibilityRows() {
+                if (visibilityRows.length === 0) return;
+                rows.push(React.createElement(
+                  'div',
+                  {
+                    key: 'visibility-group-' + visibilityStartLine,
+                    className: 'ide-methods-dropdown-visibility-group'
+                  },
+                  React.createElement(
+                    'div',
+                    { className: 'ide-methods-dropdown-visibility' },
+                    visibility
+                  ),
+                  visibilityRows
+                ));
+                visibility = null;
+                visibilityStartLine = null;
+                visibilityRows = [];
+              }
+
+              methodsList.forEach(function(entry, entryIndex) {
+                var depth = typeof entry.depth === 'number' ? entry.depth : 0;
+                var row = React.createElement(
+                  'button',
+                  {
+                    key: entry.kind + '-' + entry.line,
+                    type: 'button',
+                    className: 'ide-methods-dropdown-item ide-outline-entry ide-outline-entry-' + entry.kind,
+                    'data-outline-kind': entry.kind,
+                    'data-outline-depth': depth,
+                    'aria-label': entry.name + ', line ' + entry.line,
+                    tabIndex: 0,
+                    autoFocus: entryIndex === 0,
+                    style: { paddingLeft: (12 + depth * 14) + 'px' },
+                    onClick: function() {
+                      activateEntry(entry);
+                    }
+                  },
+                  React.createElement('span', { className: 'ide-methods-dropdown-line' }, entry.line),
+                  React.createElement('i', {
+                    className: 'fas ' + (icons[entry.kind] || icons.method) + ' ide-outline-entry-icon',
+                    'aria-hidden': 'true'
+                  }),
+                  React.createElement('span', { className: 'ide-outline-entry-name' }, entry.name)
+                );
+
+                if (entry.kind === 'method' && entry.visibility) {
+                  if (visibility !== entry.visibility) {
+                    flushVisibilityRows();
+                    visibility = entry.visibility;
+                    visibilityStartLine = entry.line;
                   }
+                  visibilityRows.push(row);
+                } else {
+                  flushVisibilityRows();
+                  rows.push(row);
                 }
-              },
-              React.createElement('span', { className: 'ide-methods-dropdown-line' }, m.line),
-              m.name
-            );
-          })
+              });
+              flushVisibilityRows();
+
+              if (methodsTruncated) {
+                rows.push(React.createElement(
+                  'div',
+                  { key: 'truncated', className: 'ide-methods-dropdown-message' },
+                  'Results truncated at 5,000 entries'
+                ));
+              }
+              return rows;
+            })()
     ),
     React.createElement('div', { ref: vimStatusRef, className: 'vim-statusbar', style: { display: editorPrefs.vimMode ? 'flex' : 'none', height: '22px', alignItems: 'center', padding: '0 10px', fontFamily: "'JetBrains Mono', 'Fira Code', Consolas, monospace", fontSize: '12px', background: 'var(--ide-statusbar-bg, #1e1e2e)', color: 'var(--ide-statusbar-fg, #9cdcfe)', borderTop: '1px solid var(--ide-border, #3e3e3e)', flexShrink: 0, userSelect: 'none', letterSpacing: '0.02em' } })
   );
@@ -2073,4 +2162,4 @@ window.EditorPanel = React.memo(EditorPanel, function(prev, next) {
     prev.testInlineVisible === next.testInlineVisible &&
     prev.editorPrefs === next.editorPrefs &&
     prev.monacoReady === next.monacoReady;
-});
+});

data/app/assets/javascripts/mbeditor/editor_plugins.js

@@ -1028,6 +1028,12 @@
           [/(\bmodule\b)(\s+)([A-Z][\w:]*)/, ['keyword.control.module', '', 'entity.name.class']],
           [/\bmodule\b/, 'keyword.control.module'],
 
+          // Test DSL suites, runnable examples, hooks, and helpers
+          [/\b(describe|context|feature)(?![a-zA-Z0-9_!?=])/, 'keyword.control.test'],
+          [/\b(test|it|specify|example|scenario)(?![a-zA-Z0-9_!?=])/, 'entity.name.function.test'],
+          [/\b(setup|teardown|before|after|around|subject)(?![a-zA-Z0-9_!?=])/, 'support.function.test'],
+          [/\blet!?(?=\s|\()/, 'support.function.test'],
+
           // Language literals
           [/\b(nil|true|false)\b/, 'constant.language'],
           [/\b(self|super)\b/, 'variable.language'],

data/app/assets/javascripts/mbeditor/ruby_outline.js

@@ -0,0 +1,427 @@
+'use strict';
+
+// A deliberately small Ruby lexer for editor outlines. It recognizes only
+// declarations and never evaluates source; masking literals avoids false
+// matches without needing a full Ruby parser.
+var RubyOutline = (function () {
+  var MAX_ENTRIES = 5000;
+  var DEF_RE = /^\s*def\s+(self\.)?([a-zA-Z_][a-zA-Z0-9_?!=]*)/;
+  var VISIBILITY_RE = /^\s*(public|protected|private)\s*(?:#.*)?$/;
+  var SCOPE_RE = /^\s*(class|module)\b/;
+  var DECLARATION_RE = /^\s*((?:RSpec\.)?(?:describe|context|feature)|test|it|specify|example|scenario)\b/;
+  var SUITE_NAMES = {
+    'describe': true, 'RSpec.describe': true,
+    'context': true, 'RSpec.context': true,
+    'feature': true, 'RSpec.feature': true
+  };
+  var TEST_NAMES = { 'test': true, 'it': true, 'specify': true, 'example': true, 'scenario': true };
+
+  function indentation(line) {
+    var leading = (/^[ \t]*/.exec(line) || [''])[0];
+    return leading.replace(/\t/g, '  ').length;
+  }
+
+  function popScopesAtOrInside(scopes, indent) {
+    while (scopes.length > 1 && scopes[scopes.length - 1].indent >= indent) {
+      scopes.pop();
+    }
+  }
+
+  function percentLiteralAt(line, index) {
+    if (line.charAt(index) !== '%') return null;
+
+    var type = line.charAt(index + 1);
+    var delimiterIndex = index + 1;
+    if (/[qQwWrixsI]/.test(type)) delimiterIndex++;
+
+    var open = line.charAt(delimiterIndex);
+    if (!open || /[a-zA-Z0-9_\s]/.test(open)) return null;
+
+    var pairs = { '(': ')', '[': ']', '{': '}', '<': '>' };
+    return {
+      length: delimiterIndex - index + 1,
+      open: open,
+      close: pairs[open] || open,
+      paired: !!pairs[open]
+    };
+  }
+
+  function heredocAt(line, index) {
+    if (line.slice(index, index + 2) !== '<<') return null;
+    if (index > 0 && !/[\s(,=\[{]/.test(line.charAt(index - 1))) return null;
+
+    var match = /^<<([-~])?(?:'([^'\r\n]+)'|"([^"\r\n]+)"|`([^`\r\n]+)`|([a-zA-Z_][a-zA-Z0-9_]*))/.exec(line.slice(index));
+    if (!match) return null;
+
+    return {
+      length: match[0].length,
+      terminator: match[2] || match[3] || match[4] || match[5],
+      allowIndent: !!match[1]
+    };
+  }
+
+  function startsSlashRegex(line, index, code) {
+    if (/\s/.test(line.charAt(index + 1))) return false;
+
+    var prefix = code.replace(/\s+$/, '');
+    if (prefix.length === 0) return true;
+    if (/[=(:,\[!&|?{};+\-*%<>~^]$/.test(prefix)) return true;
+    if (/\b(?:return|yield|when|if|unless|while|until|and|or|not)$/.test(prefix)) return true;
+
+    return /\s$/.test(line.slice(0, index)) &&
+      /[a-zA-Z_][a-zA-Z0-9_!?=]*$/.test(prefix);
+  }
+
+  function maskRubyLine(line, state) {
+    var code = '';
+    var heredocs = [];
+    var i = 0;
+
+    while (i < line.length) {
+      var ch = line.charAt(i);
+
+      if (state) {
+        var maskedCharacter = ' ';
+
+        if (state.escaped) {
+          state.escaped = false;
+        } else if (ch === '\\') {
+          state.escaped = true;
+        } else if (state.regex && ch === '[') {
+          state.inCharacterClass = true;
+        } else if (state.regex && ch === ']') {
+          state.inCharacterClass = false;
+        } else if (state.regex && ch === '/' && !state.inCharacterClass) {
+          state = null;
+        } else if (state.paired && ch === state.open) {
+          state.depth++;
+        } else if (!state.regex && ch === state.close) {
+          if (state.paired) state.depth--;
+          if (!state.paired || state.depth === 0) state = null;
+        }
+
+        if (!state) maskedCharacter = 'x';
+        code += maskedCharacter;
+        i++;
+        continue;
+      }
+
+      if (ch === '#') break;
+
+      if (ch === "'" || ch === '"' || ch === '`') {
+        state = { open: ch, close: ch, paired: false, depth: 1, escaped: false };
+        code += ' ';
+        i++;
+        continue;
+      }
+
+      if (ch === '/' && startsSlashRegex(line, i, code)) {
+        state = {
+          open: '/', close: '/', paired: false, depth: 1, escaped: false,
+          regex: true, inCharacterClass: false
+        };
+        code += ' ';
+        i++;
+        continue;
+      }
+
+      var percentLiteral = percentLiteralAt(line, i);
+      if (percentLiteral) {
+        state = {
+          open: percentLiteral.open, close: percentLiteral.close,
+          paired: percentLiteral.paired, depth: 1, escaped: false
+        };
+        code += new Array(percentLiteral.length + 1).join(' ');
+        i += percentLiteral.length;
+        continue;
+      }
+
+      var heredoc = heredocAt(line, i);
+      if (heredoc) {
+        heredocs.push({ terminator: heredoc.terminator, allowIndent: heredoc.allowIndent });
+        code += new Array(heredoc.length + 1).join(' ');
+        i += heredoc.length;
+        continue;
+      }
+
+      code += ch;
+      i++;
+    }
+
+    if (state) state.escaped = false;
+    return { code: code, state: state, heredocs: heredocs };
+  }
+
+  function addEntry(entries, entry) {
+    if (entries.length >= MAX_ENTRIES) return false;
+    entries.push(entry);
+    return true;
+  }
+
+  function cloneLexicalState(state) {
+    if (!state) return null;
+    return {
+      open: state.open,
+      close: state.close,
+      paired: state.paired,
+      depth: state.depth,
+      escaped: state.escaped,
+      regex: state.regex,
+      inCharacterClass: state.inCharacterClass
+    };
+  }
+
+  function cloneHeredocs(heredocs) {
+    return heredocs.map(function (heredoc) {
+      return { terminator: heredoc.terminator, allowIndent: heredoc.allowIndent };
+    });
+  }
+
+  function testPath(path) {
+    return /(^|\/)test\/.*_test\.rb$/.test(path) ||
+      /(^|\/)spec\/.*_spec\.rb$/.test(path) ||
+      /_test\.rb$/.test(path) ||
+      /_spec\.rb$/.test(path);
+  }
+
+  function declarationDescription(raw, code, declaration, kind, lineNumber) {
+    var rest = raw.slice(raw.indexOf(declaration) + declaration.length);
+    var codeRest = code.slice(code.indexOf(declaration) + declaration.length);
+    var quoted = /^\s*\(?\s*(['"])((?:\\.|[^\\])*?)\1/.exec(rest);
+    var constant = /^\s*\(?\s*([A-Z][a-zA-Z0-9_]*(?:::[A-Z][a-zA-Z0-9_]*)*)(?=\s*(?:,|\)|\bdo\b|\{))/.exec(rest);
+    var descriptor = codeRest.replace(/(?:\bdo\b|\{)[\s\S]*$/, '').replace(/[(){}\s]/g, '');
+
+    if (quoted && quoted[2].indexOf('\n') === -1 &&
+        (quoted[1] === "'" || quoted[2].indexOf('#{') === -1)) return quoted[2];
+    if (constant) return constant[1];
+    if (quoted || /[a-zA-Z_:]/.test(descriptor) || /<</.test(rest)) {
+      return kind === 'suite' ? 'suite at line ' + lineNumber : 'test at line ' + lineNumber;
+    }
+    return null;
+  }
+
+  function declarationStatus(code) {
+    var parenDepth = 0;
+    var bracketDepth = 0;
+    var hashDepth = 0;
+    var i = 0;
+
+    while (i < code.length) {
+      var ch = code.charAt(i);
+
+      if (ch === '(') {
+        parenDepth++;
+      } else if (ch === ')') {
+        if (parenDepth > 0) parenDepth--;
+      } else if (ch === '[') {
+        bracketDepth++;
+      } else if (ch === ']') {
+        if (bracketDepth > 0) bracketDepth--;
+      } else if (ch === '{') {
+        if (parenDepth === 0 && bracketDepth === 0 && hashDepth === 0) {
+          var beforeBrace = code.slice(0, i).replace(/\s+$/, '');
+          if (!/(?:[:,=]|\*\*|=>)$/.test(beforeBrace)) {
+            return { complete: true, canContinue: false };
+          }
+        }
+        hashDepth++;
+      } else if (ch === '}') {
+        if (hashDepth > 0) hashDepth--;
+      } else if (parenDepth === 0 && bracketDepth === 0 && hashDepth === 0 &&
+          code.slice(i, i + 2) === 'do' &&
+          (i === 0 || !/[a-zA-Z0-9_!:]/.test(code.charAt(i - 1))) &&
+          !/[a-zA-Z0-9_!?=]/.test(code.charAt(i + 2)) &&
+          !/^\s*:/.test(code.slice(i + 2))) {
+        return { complete: true, canContinue: false };
+      }
+      i++;
+    }
+
+    var trimmed = code.replace(/\s+$/, '');
+    return {
+      complete: false,
+      canContinue: parenDepth > 0 || bracketDepth > 0 || hashDepth > 0 ||
+        /(?:[,\\]|[+\-*\/%&|.=<>?:])$/.test(trimmed)
+    };
+  }
+
+  function scanDeclarationHeader(lines, startIndex, rawHeader, codeHeader, state, heredocs, inBlockComment) {
+    var headerEnd = startIndex;
+    var localState = cloneLexicalState(state);
+    var localHeredocs = cloneHeredocs(heredocs);
+    var localBlockComment = inBlockComment;
+    var status = declarationStatus(codeHeader);
+    if (!status.complete && (localState || localHeredocs.length > 0 || localBlockComment)) {
+      status.canContinue = true;
+    }
+
+    while (!status.complete && status.canContinue &&
+        headerEnd + 1 < lines.length && headerEnd - startIndex < 7) {
+      headerEnd++;
+      var nextLine = String(lines[headerEnd] || '').replace(/\r?\n$/, '');
+      var nextCode = '';
+
+      if (localBlockComment) {
+        if (/^=end\b/.test(nextLine)) localBlockComment = false;
+      } else if (localHeredocs.length > 0) {
+        var pendingHeredoc = localHeredocs[0];
+        var candidateTerminator = pendingHeredoc.allowIndent ?
+          nextLine.replace(/^\s+/, '') : nextLine;
+        if (candidateTerminator === pendingHeredoc.terminator) localHeredocs.shift();
+      } else {
+        var nextMasked = maskRubyLine(nextLine, localState);
+        localState = nextMasked.state;
+        nextCode = nextMasked.code;
+
+        if (/^=begin\b/.test(nextCode)) {
+          localBlockComment = true;
+          nextCode = '';
+        } else {
+          for (var h = 0; h < nextMasked.heredocs.length; h++) {
+            localHeredocs.push(nextMasked.heredocs[h]);
+          }
+        }
+      }
+
+      rawHeader += '\n' + nextLine;
+      codeHeader += '\n' + nextCode;
+      status = declarationStatus(codeHeader);
+      if (!status.complete && (localState || localHeredocs.length > 0 || localBlockComment)) {
+        status.canContinue = true;
+      }
+    }
+
+    return {
+      complete: status.complete,
+      rawHeader: rawHeader,
+      codeHeader: codeHeader,
+      headerEnd: headerEnd,
+      state: localState,
+      heredocs: localHeredocs,
+      inBlockComment: localBlockComment
+    };
+  }
+
+  function parse(lines, options) {
+    var entries = [];
+    var scopes = [{ indent: -1, visibility: null }];
+    var suites = [];
+    var heredocTerminators = [];
+    var lexicalState = null;
+    var inBlockComment = false;
+    var path = String((options || {}).path || '');
+    var allowTestDsl = testPath(path);
+    var stopped = false;
+
+    for (var i = 0; i < lines.length && !stopped; i++) {
+      var line = String(lines[i] || '').replace(/\r?\n$/, '');
+      var codeLine;
+      var masked;
+
+      if (inBlockComment) {
+        if (/^=end\b/.test(line)) inBlockComment = false;
+        continue;
+      }
+
+      if (heredocTerminators.length > 0) {
+        var pendingHeredoc = heredocTerminators[0];
+        var candidateTerminator = pendingHeredoc.allowIndent ? line.replace(/^\s+/, '') : line;
+        if (candidateTerminator === pendingHeredoc.terminator) heredocTerminators.shift();
+        continue;
+      }
+
+      masked = maskRubyLine(line, lexicalState);
+      lexicalState = masked.state;
+      codeLine = masked.code;
+
+      if (/^=begin\b/.test(codeLine)) {
+        inBlockComment = true;
+        continue;
+      }
+
+      for (var h = 0; h < masked.heredocs.length; h++) heredocTerminators.push(masked.heredocs[h]);
+      if (/^\s*$/.test(codeLine)) continue;
+
+      var indent = indentation(line);
+      while (suites.length > 0 && indent <= suites[suites.length - 1].indent) suites.pop();
+
+      if (SCOPE_RE.test(codeLine)) {
+        popScopesAtOrInside(scopes, indent);
+        scopes.push({ indent: indent, visibility: null });
+        continue;
+      }
+
+      var visibilityMatch = VISIBILITY_RE.exec(codeLine);
+      if (visibilityMatch) {
+        popScopesAtOrInside(scopes, indent);
+        scopes[scopes.length - 1].visibility = visibilityMatch[1];
+        continue;
+      }
+
+      var methodMatch = DEF_RE.exec(codeLine);
+      if (methodMatch) {
+        popScopesAtOrInside(scopes, indent);
+        if (!addEntry(entries, {
+          line: i + 1,
+          name: (methodMatch[1] || '') + methodMatch[2],
+          kind: 'method',
+          depth: suites.length,
+          visibility: methodMatch[1] ? 'public' : scopes[scopes.length - 1].visibility
+        })) stopped = true;
+        continue;
+      }
+
+      if (!allowTestDsl) continue;
+
+      var declarationMatch = DECLARATION_RE.exec(codeLine);
+      if (!declarationMatch) continue;
+
+      var declaration = declarationMatch[1];
+      var kind = SUITE_NAMES[declaration] ? 'suite' : (TEST_NAMES[declaration] ? 'test' : null);
+      if (!kind) continue;
+
+      var rawHeader = line;
+      var codeHeader = codeLine;
+      var headerEnd = i;
+      var headerScan = scanDeclarationHeader(
+        lines, i, rawHeader, codeHeader, lexicalState,
+        heredocTerminators, inBlockComment
+      );
+
+      if (!headerScan.complete) continue;
+      if (headerScan.headerEnd > i) {
+        rawHeader = headerScan.rawHeader;
+        codeHeader = headerScan.codeHeader;
+        headerEnd = headerScan.headerEnd;
+        lexicalState = headerScan.state;
+        heredocTerminators = headerScan.heredocs;
+        inBlockComment = headerScan.inBlockComment;
+      }
+
+      var name = declarationDescription(rawHeader, codeHeader, declaration, kind, i + 1);
+      if (!name) continue;
+
+      if (!addEntry(entries, {
+        line: i + 1,
+        name: name,
+        kind: kind,
+        depth: suites.length,
+        visibility: null
+      })) {
+        stopped = true;
+        continue;
+      }
+
+      if (kind === 'suite' && !/(?:\bdo\b|\{)[\s\S]*\bend\b/.test(codeHeader)) {
+        suites.push({ indent: indent });
+      }
+      i = headerEnd;
+    }
+
+    return { entries: entries, truncated: entries.length >= MAX_ENTRIES && stopped };
+  }
+
+  return { parse: parse, isTestPath: testPath };
+})();
+
+window.RubyOutline = RubyOutline;

data/app/assets/stylesheets/mbeditor/editor.css

@@ -1990,6 +1990,10 @@ html, body, #mbeditor-root {
   display: flex;
   align-items: center;
   gap: 8px;
+  width: 100%;
+  border: 0;
+  border-radius: 0;
+  background: transparent;
   padding: 5px 12px;
   cursor: pointer;
   color: #ccc;
@@ -1998,13 +2002,20 @@ html, body, #mbeditor-root {
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
+  text-align: left;
 }
 
-.ide-methods-dropdown-item:hover {
+.ide-methods-dropdown-item:hover,
+.ide-methods-dropdown-item:focus {
   background: #094771;
   color: #fff;
 }
 
+.ide-methods-dropdown-item:focus {
+  outline: 1px solid #75beff;
+  outline-offset: -1px;
+}
+
 .ide-methods-dropdown-line {
   color: #858585;
   font-size: 11px;
@@ -2021,6 +2032,42 @@ html, body, #mbeditor-root {
   font-style: italic;
 }
 
+.ide-methods-dropdown-visibility {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  padding: 4px 12px;
+  background: #252526;
+  border-bottom: 1px solid #3a3a3a;
+  color: #9cdcfe;
+  font-size: 10px;
+  font-weight: 600;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+}
+
+.ide-methods-dropdown-visibility-group {
+  position: relative;
+}
+
+.ide-outline-entry-icon {
+  width: 13px;
+  flex-shrink: 0;
+  text-align: center;
+  color: #858585;
+}
+
+.ide-outline-entry-suite .ide-outline-entry-icon { color: #dcb67a; }
+.ide-outline-entry-test .ide-outline-entry-icon { color: #8ab4f8; }
+.ide-outline-entry-name { overflow: hidden; text-overflow: ellipsis; }
+
+.ide-methods-dropdown-message {
+  padding: 8px 12px;
+  color: #858585;
+  font-size: 12px;
+  font-style: italic;
+}
+
 
 
 .project-action-btn {

data/app/controllers/mbeditor/application_controller.rb

@@ -32,23 +32,17 @@ module Mbeditor
     end
 
     # Expand path and confirm it's inside workspace_root.
-    # Resolves symlinks on the nearest existing ancestor of the target so that
-    # a symlink inside the workspace cannot escape the sandbox regardless of
-    # whether the target itself exists yet (create / rename paths).
+    # SafePath follows every symlink on the way — including dangling ones, which
+    # an existence walk would skip past — so a symlink inside the workspace
+    # cannot escape the sandbox regardless of whether the target exists yet
+    # (create / rename paths).
     def resolve_path(raw)
       return nil if raw.blank?
 
       root = workspace_root.to_s
       full = File.expand_path(raw.to_s, root)
       return nil unless full.start_with?("#{root}/") || full == root
-
-      # Walk up to the nearest existing ancestor (could be the path itself,
-      # its parent directory, or ultimately the workspace root).
-      check = full
-      check = File.dirname(check) until File.exist?(check)
-      real_root = File.realpath(root)
-      real = File.realpath(check)
-      return nil unless real.start_with?("#{real_root}/") || real == real_root
+      return nil unless SafePath.within?(root, full)
 
       full
     rescue Errno::EACCES

data/app/controllers/mbeditor/editors_controller.rb

@@ -1098,7 +1098,7 @@ module Mbeditor
       rel = relative_path(full_path)
       return true if rel.blank?
 
-      ExclusionMatcher.new(Mbeditor.configuration.excluded_paths).excluded?(rel)
+      ExclusionMatcher.new(Mbeditor.configuration.excluded_paths, root: workspace_root).excluded?(rel)
     end
 
     def ruby_def_include_dirs

data/app/services/mbeditor/exclusion_matcher.rb

@@ -1,13 +1,98 @@
 # frozen_string_literal: true
 
 module Mbeditor
+  # Decides whether a workspace-relative path falls under a configured
+  # exclusion (`Mbeditor.configuration.excluded_paths`).
+  #
+  # Comparison is normalized rather than byte-for-byte, because the filesystem
+  # the workspace lives on may resolve two different spellings of a name to the
+  # same file:
+  #
+  #   * Case. APFS/HFS+ (and NTFS) resolve "TMP/cache.txt" to the excluded
+  #     "tmp/", and ".GIT/hooks/post-checkout" to the real ".git/hooks/" — the
+  #     latter is arbitrary code execution on the next git operation. Folding is
+  #     applied only when the filesystem backing the workspace really is
+  #     case-insensitive, probed at runtime: a case-sensitive volume can be
+  #     mounted on macOS, and folding there would hide legitimately distinct
+  #     paths.
+  #
+  #   * Unicode normalization. APFS stores one file for the NFC and NFD
+  #     spellings of a name, so an NFD request path slips past an NFC pattern.
+  #     NFC folding is applied unconditionally: filesystems that do keep the two
+  #     spellings apart are rare enough, and the cost there is over-exclusion
+  #     (hiding a path) rather than the write-through this class exists to
+  #     prevent.
   class ExclusionMatcher
-    def initialize(patterns)
-      @patterns = patterns.map(&:to_s).reject(&:empty?)
+    MUTEX = Mutex.new
+    private_constant :MUTEX
+
+    # Roots are stable for the life of a process; the bound only keeps the test
+    # suite (a fresh tmpdir workspace per test) from growing the memo forever.
+    MAX_PROBE_CACHE = 256
+    private_constant :MAX_PROBE_CACHE
+
+    class << self
+      # Whether the filesystem backing +root+ resolves paths case-insensitively.
+      # Probed once per root, then memoized for the life of the process.
+      def case_insensitive_filesystem?(root)
+        key = File.expand_path(root.to_s)
+
+        MUTEX.synchronize do
+          @probe_cache ||= {}
+          return @probe_cache[key] if @probe_cache.key?(key)
+
+          @probe_cache = {} if @probe_cache.size >= MAX_PROBE_CACHE
+          @probe_cache[key] = probe_case_insensitive(key)
+        end
+      end
+
+      def reset_filesystem_probe!
+        MUTEX.synchronize { @probe_cache = {} }
+      end
+
+      private
+
+      # Asks the filesystem directly: look up a real directory under its own
+      # name and under that name with the case flipped, and compare device +
+      # inode (that is what File.identical? does). They only agree when the
+      # filesystem folded the two spellings onto one directory.
+      #
+      # Climbs to the nearest ancestor whose name actually contains a cased
+      # character, since a name like "42" flips to itself and proves nothing.
+      # When nothing can be determined — no cased ancestor, a root that does not
+      # exist, a permission error — it reports case-insensitive, which
+      # over-excludes rather than leaving the hole open.
+      def probe_case_insensitive(root)
+        return true unless File.directory?(root)
+
+        path = root
+        loop do
+          parent  = File.dirname(path)
+          base    = File.basename(path)
+          flipped = base.swapcase
+
+          return File.identical?(path, File.join(parent, flipped)) unless flipped == base
+          break if parent == path
+
+          path = parent
+        end
+
+        true
+      rescue SystemCallError
+        true
+      end
+    end
+
+    # +root+ is the workspace the paths are relative to; it decides only whether
+    # case is folded. Defaults to the resolved workspace root.
+    def initialize(patterns, root: nil)
+      @fold_case = self.class.case_insensitive_filesystem?(root || WorkspaceRootResolver.call)
+      @patterns  = patterns.map { |pattern| normalize(pattern.to_s) }.reject(&:empty?)
     end
 
     def excluded?(relative_path)
-      @patterns.any? { |pattern| matches?(pattern, relative_path) }
+      rel = normalize(relative_path.to_s)
+      @patterns.any? { |pattern| matches?(pattern, rel) }
     end
 
     private
@@ -19,5 +104,22 @@ module Mbeditor
         File.basename(rel) == pattern || rel.split("/").include?(pattern)
       end
     end
+
+    # "/" is ASCII and survives both steps, so the caller can normalize a whole
+    # path in one pass and split it afterwards.
+    def normalize(str)
+      # ASCII is already NFC, so only the case step can apply.
+      return @fold_case ? str.downcase : str if str.ascii_only?
+
+      utf8 = str.encoding == Encoding::UTF_8 ? str : str.dup.force_encoding(Encoding::UTF_8)
+      # Undecodable bytes become U+FFFD. This is a comparison key, never a path
+      # we open, and scrubbing keeps a malformed name from skipping the fold
+      # (and raising) on its way past an exclusion.
+      utf8 = utf8.scrub unless utf8.valid_encoding?
+      utf8 = utf8.unicode_normalize(:nfc)
+      @fold_case ? utf8.downcase : utf8
+    rescue ArgumentError, Encoding::CompatibilityError
+      str
+    end
   end
 end

data/app/services/mbeditor/file_tree_service.rb

@@ -15,7 +15,7 @@ module Mbeditor
         end
       end
 
-      matcher = ExclusionMatcher.new(Mbeditor.configuration.excluded_paths)
+      matcher = ExclusionMatcher.new(Mbeditor.configuration.excluded_paths, root: root)
       data = traverse(root, root, matcher)
 
       MUTEX.synchronize do

data/app/services/mbeditor/git_service.rb

@@ -139,8 +139,8 @@ module Mbeditor
     # Resolve a file path safely within repo_path.  Returns full path string or
     # nil if the path escapes the root.
     #
-    # Resolves symlinks on the nearest existing ancestor of the target so that a
-    # symlink inside the repo cannot escape it, mirroring
+    # Follows symlinks (via SafePath, including dangling ones) so that a symlink
+    # inside the repo cannot escape it, mirroring
     # ApplicationController#resolve_path.  When repo_path is not a real directory
     # (e.g. unit tests with synthetic roots) the symlink check is skipped, since
     # there is nothing on disk to resolve and repo_path is server-controlled.
@@ -151,14 +151,7 @@ module Mbeditor
       full = File.expand_path(relative.to_s, root)
       return nil unless full.start_with?("#{root}/") || full == root
       return full unless File.directory?(root)
-
-      # Walk up to the nearest existing ancestor, then realpath both it and the
-      # root and confirm the resolved target is still inside the resolved root.
-      check = full
-      check = File.dirname(check) until File.exist?(check)
-      real_root = File.realpath(root)
-      real = File.realpath(check)
-      return nil unless real.start_with?("#{real_root}/") || real == real_root
+      return nil unless SafePath.within?(root, full)
 
       full
     rescue Errno::EACCES

data/app/services/mbeditor/ruby_definition_service.rb

@@ -181,7 +181,7 @@ module Mbeditor
       @symbol            = symbol
       @excluded_paths    = Array(excluded_paths)
       @included_dirs     = Array(included_dirs)
-      @exclusion_matcher = ExclusionMatcher.new(@excluded_paths)
+      @exclusion_matcher = ExclusionMatcher.new(@excluded_paths, root: @workspace_root)
       @shared_cache      = self.class.send(:file_cache)
       @shared_mutex      = self.class.send(:mutex)
     end

data/app/services/mbeditor/safe_path.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Mbeditor
+  # Containment check for paths that may not exist yet.
+  #
+  # +File.realpath+ refuses to resolve a path whose final component is missing,
+  # so callers that create files have to reason about the nearest existing
+  # ancestor instead. Doing that with +File.exist?+ is unsafe: it *follows*
+  # symlinks, so a symlink pointing at a missing target reports false and an
+  # existence walk steps straight past it, back to the safely-contained parent.
+  # A subsequent +File.open+ follows the link and writes outside the root.
+  #
+  # SafePath resolves the link chain itself with +File.symlink?+/+File.readlink+
+  # (both lstat-based, neither follows) so a dangling symlink is judged by where
+  # it points, not by whether that target happens to exist yet.
+  module SafePath
+    # Guards against symlink cycles, which surface as a path that neither
+    # exists nor terminates.
+    MAX_SYMLINK_HOPS = 32
+
+    module_function
+
+    # True when +path+ resolves to a location inside +root+, following every
+    # symlink component including dangling ones. +root+ must exist.
+    def within?(root, path)
+      real_root = File.realpath(root.to_s)
+      target    = canonical(path.to_s)
+      return false unless target
+
+      target == real_root || target.start_with?("#{real_root}/")
+    rescue SystemCallError
+      false
+    end
+
+    # The filesystem location a write to +path+ would actually land on, with
+    # all symlinks expanded. Returns nil when the link chain cycles or exceeds
+    # MAX_SYMLINK_HOPS.
+    def canonical(path, hops = 0)
+      return nil if hops > MAX_SYMLINK_HOPS
+      # Anything that exists (including a symlink with a live target) resolves
+      # normally; realpath expands the whole chain for us.
+      return File.realpath(path) if File.exist?(path)
+
+      parent = File.dirname(path)
+      return nil if parent == path # ran off the top without finding anything
+
+      real_parent = canonical(parent, hops)
+      return nil unless real_parent
+
+      if File.symlink?(path)
+        canonical(File.absolute_path(File.readlink(path), real_parent), hops + 1)
+      else
+        File.join(real_parent, File.basename(path))
+      end
+    end
+  end
+end

data/app/services/mbeditor/search_replace_service.rb

@@ -100,7 +100,7 @@ module Mbeditor
         end
 
         pattern = build_pattern(query, use_regex: use_regex, match_case: match_case, whole_word: whole_word)
-        matcher = ExclusionMatcher.new(excluded_paths)
+        matcher = ExclusionMatcher.new(excluded_paths, root: workspace_root)
         replaced_count = 0
         files_affected = []
         errors = []
@@ -182,7 +182,7 @@ module Mbeditor
         tier = pick_tier(root)
         env, args = build_command(tier, root, query, use_regex: use_regex, match_case: match_case,
                                   whole_word: whole_word, excluded_paths: excluded_paths, paths: paths)
-        matcher = ExclusionMatcher.new(excluded_paths)
+        matcher = ExclusionMatcher.new(excluded_paths, root: root)
         results = []
         timed_out = false
         timeout_secs = Mbeditor.configuration.search_timeout

data/lib/mbeditor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mbeditor
-  VERSION = "0.8.1"
+  VERSION = "0.9.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mbeditor
 version: !ruby/object:Gem::Version
-  version: 0.8.1
+  version: 0.9.0
 platform: ruby
 authors:
 - Oliver Noonan
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-22 00:00:00.000000000 Z
+date: 2026-07-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -82,6 +82,7 @@ files:
 - app/assets/javascripts/mbeditor/git_service.js
 - app/assets/javascripts/mbeditor/history_service.js
 - app/assets/javascripts/mbeditor/log_service.js
+- app/assets/javascripts/mbeditor/ruby_outline.js
 - app/assets/javascripts/mbeditor/search_service.js
 - app/assets/javascripts/mbeditor/tab_manager.js
 - app/assets/javascripts/mbeditor/websocket_service.js
@@ -118,6 +119,7 @@ files:
 - app/services/mbeditor/redmine_service.rb
 - app/services/mbeditor/ri_definition_service.rb
 - app/services/mbeditor/ruby_definition_service.rb
+- app/services/mbeditor/safe_path.rb
 - app/services/mbeditor/schema_service.rb
 - app/services/mbeditor/search_replace_service.rb
 - app/services/mbeditor/test_runner_service.rb