strop-core 0.14.1

//! The buffer: a rope, byte-offset positions, edit ops, persistence.
//! No UI, no modes, no grammar — the thing everything else edits.

use crate::diagnostics::{BufferTraceId, MutationSource};
use crate::history::{Edit, EditKind, History};
use crate::range::Range;
use crate::{id, layout};
use ropey::Rope;

/// A text buffer. Positions are UTF-8 byte offsets, everywhere (0001 §5.1).
pub struct Buffer {
    pub(crate) trace_identity: BufferTraceId,
    pub rope: Rope,
    /// Filesystem identity (0021 §3: Unix filenames aren't UTF-8 — a
    /// String path makes the filesystem model a UI model). Display via
    /// to_string_lossy at the edge only.
    pub path: Option<std::path::PathBuf>,
    pub dirty: bool,
    /// Monotonic edit counter; async readers (git gutter) diff lazily.
    pub epoch: u64,
    /// Read-only views (git surfaces): motions/yank work, edits refuse.
    pub readonly: bool,
    /// Display name for virtual buffers (statusline shows "[scratch]"
    /// otherwise): "git log", "commit 1a2b3c", …
    pub name: Option<String>,
    /// Undo history (helix-style revision tree). Readonly buffers never
    /// record (their content is owned by jobs, not the user).
    pub history: History,
    /// Suppresses recording while applying undo/redo ops.
    pub replaying: bool,
    /// Disk mtime at load/last save — overwrite protection for `:w`.
    disk_stamp: Option<std::time::SystemTime>,
}

impl Buffer {
    pub fn from_text(text: &str) -> Self {
        Self {
            trace_identity: BufferTraceId::next(),
            rope: Rope::from_str(text),
            path: None,
            dirty: false,
            epoch: 0,
            readonly: false,
            name: None,
            history: History::default(),
            replaying: false,
            disk_stamp: None,
        }
    }

    /// Open a file; a missing file is a new empty buffer with that path
    /// (vim semantics — `:w` creates it). Real I/O errors still error.
    pub fn open(path: impl AsRef<std::path::Path>) -> std::io::Result<Self> {
        let path = path.as_ref();
        let text = match std::fs::read_to_string(path) {
            Ok(t) => t,
            Err(e) if e.kind() == std::io::ErrorKind::NotFound => String::new(),
            Err(e) => return Err(e),
        };
        let disk_stamp = std::fs::metadata(path).and_then(|m| m.modified()).ok();
        Ok(Self {
            trace_identity: BufferTraceId::next(),
            rope: Rope::from_str(&text),
            path: Some(path.to_path_buf()),
            dirty: false,
            epoch: 0,
            readonly: false,
            name: None,
            history: History::default(),
            replaying: false,
            disk_stamp,
        })
    }

    /// `:w` — atomic (temp + rename in the same dir), refuses to
    /// overwrite a file another process touched since we loaded it.
    /// `force` is `:w!`.
    pub fn save(&mut self, force: bool) -> std::io::Result<()> {
        let Some(path) = self.path.clone() else {
            // a pathless buffer has nothing to persist to — "written"
            // would be a lie (0015)
            return Err(std::io::Error::new(
                std::io::ErrorKind::NotFound,
                "no file name — :w {path} to name it",
            ));
        };
        // write THROUGH links (0023: replacing a symlink with a regular
        // file silently breaks the link — vim preserves it)
        let path = std::fs::canonicalize(&path).unwrap_or(path);
        let current = std::fs::metadata(&path).and_then(|m| m.modified()).ok();
        if !force && current.is_some() && current != self.disk_stamp {
            return Err(std::io::Error::new(
                std::io::ErrorKind::PermissionDenied,
                "file changed on disk — :w! to force",
            ));
        }
        write_atomic(std::path::Path::new(&path), &self.rope.to_string(), true)?;
        self.disk_stamp = std::fs::metadata(&path).and_then(|m| m.modified()).ok();
        self.dirty = false;
        Ok(())
    }

    /// `:w {path}` — persist under a new name and adopt it (the buffer
    /// becomes that file). The identity changes only after a SUCCESSFUL
    /// write (0020 §1): an existing target needs `force`, and a failed
    /// write leaves path, baseline and dirty state untouched.
    pub fn save_as(
        &mut self,
        path: impl AsRef<std::path::Path>,
        force: bool,
    ) -> std::io::Result<()> {
        let target = path.as_ref();
        if !force && target.exists() {
            return Err(std::io::Error::new(
                std::io::ErrorKind::PermissionDenied,
                "file exists — :w! to overwrite",
            ));
        }
        write_atomic(target, &self.rope.to_string(), force)?;
        // success: adopt the identity
        self.path = Some(target.to_path_buf());
        self.disk_stamp = std::fs::metadata(target).and_then(|m| m.modified()).ok();
        self.dirty = false;
        Ok(())
    }
    /// Display CELL of an offset within its line (0017): cursor
    /// placement and overlays need terminal cells, not byte cols —
    /// wide chars and tabs make the difference. The LineLayout is the
    /// single translation seam.
    pub fn cell_col_of(&self, offset: impl Into<id::ByteOffset>) -> u16 {
        self.cell_col_with_tab(offset, 8)
    }

    /// The cell col under a caller's tab stop (0023: the caret and the
    /// tab glyph must read the same width — render config drives both).
    pub fn cell_col_with_tab(&self, offset: impl Into<id::ByteOffset>, tab: u16) -> u16 {
        let offset = offset.into().get();
        if self.len_bytes() == 0 {
            return 0;
        }
        let line = self.line_of(offset);
        let (s, e) = (self.line_start(line), self.line_end(line));
        let text = self.rope.byte_slice(s..e).to_string();
        let col = offset.saturating_sub(s);
        let layout = layout::LineLayout::build(text.trim_end_matches('\n'), tab.max(1));
        layout.cell_at_byte(col.min(layout.len_bytes))
    }

    pub fn len_bytes(&self) -> usize {
        self.rope.len_bytes()
    }
    pub fn len_lines(&self) -> usize {
        self.rope.len_lines()
    }

    /// Last *content* line index — a trailing newline's phantom empty
    /// line doesn't count (vim's G lands on real text).
    pub fn last_content_line(&self) -> usize {
        let mut l = self.len_lines().saturating_sub(1);
        if self.len_bytes() > 0 && self.byte(self.len_bytes() - 1) == b'\n' && l > 0 {
            l -= 1;
        }
        l
    }

    /// Byte offset of the first char of `line` (0-indexed).
    pub fn line_start(&self, line: impl Into<id::LineIndex>) -> usize {
        self.rope
            .line_to_byte(line.into().get().min(self.len_lines().saturating_sub(1)))
    }

    /// Byte offset one past the last content char (excludes LF or CRLF).
    pub fn line_end(&self, line: impl Into<id::LineIndex>) -> usize {
        let line = line.into().get();
        let start = self.line_start(line);
        let mut end = self.line_start((line + 1).min(self.len_lines().saturating_sub(1)));
        if line + 1 >= self.len_lines() {
            end = self.len_bytes();
        }
        // strip the trailing newline
        if end > start && self.byte(end - 1) == b'\n' {
            end -= 1;
            if end > start && self.byte(end - 1) == b'\r' {
                end -= 1;
            }
        }
        end
    }

    pub fn line_of(&self, offset: impl Into<id::ByteOffset>) -> usize {
        self.rope
            .byte_to_line(offset.into().get().min(self.len_bytes()))
    }

    /// Column (in bytes) of `offset` within its line.
    pub fn col_of(&self, offset: impl Into<id::ByteOffset>) -> usize {
        let offset = offset.into();
        offset.get() - self.line_start(self.line_of(offset))
    }
    /// Byte at a position. An empty rope reads as NUL: every classifier
    /// treats NUL as a boundary, and the alternative (a panic) is how
    /// the second review found this (0015). `byte_at` when absence
    /// itself matters.
    pub fn byte(&self, offset: impl Into<id::ByteOffset>) -> u8 {
        if self.len_bytes() == 0 {
            return 0;
        }
        self.rope
            .byte(offset.into().get().min(self.len_bytes().saturating_sub(1)))
    }

    pub fn byte_at(&self, offset: impl Into<id::ByteOffset>) -> Option<u8> {
        let off = offset.into().get();
        if off < self.len_bytes() {
            Some(self.rope.byte(off))
        } else {
            None
        }
    }

    /// Is `offset` a UTF-8 char boundary? ropey's `try_byte_to_char`
    /// maps a mid-char byte to its containing char without complaint —
    /// only the byte↔char roundtrip actually detects boundaries. (The
    /// pre-0.3.9 clamp trusted it and never clamped anything.)
    pub fn is_boundary(&self, offset: impl Into<id::ByteOffset>) -> bool {
        let off = offset.into().get();
        if off == 0 || off == self.len_bytes() {
            return true;
        }
        if off > self.len_bytes() {
            return false;
        }
        match self.rope.try_byte_to_char(off) {
            Ok(c) => self.rope.try_char_to_byte(c).is_ok_and(|b| b == off),
            Err(_) => false,
        }
    }

    /// Clamp a byte offset down to a char boundary (the grapheme policy
    /// in 0001 §5.9 hardens this further when text goes wide).
    pub fn clamp_boundary(&self, offset: impl Into<id::ByteOffset>) -> usize {
        let mut offset = offset.into().get().min(self.len_bytes());
        while offset > 0 && !self.is_boundary(offset) {
            offset -= 1;
        }
        offset
    }

    /// Smallest char boundary >= offset. Byte arithmetic on a cursor
    /// (`cursor + 1` in x/a/r/~) lands inside a multibyte char; deleting
    /// or inserting there panics ropey. Round up, never down — a
    /// deletion that rounds down eats the previous char's tail.
    pub fn ceil_boundary(&self, offset: impl Into<id::ByteOffset>) -> usize {
        let mut offset = offset.into().get().min(self.len_bytes());
        while offset < self.len_bytes() && !self.is_boundary(offset) {
            offset += 1;
        }
        offset
    }

    /// Slice as String — for register/paste paths, never for per-frame render.
    /// Stale ranges clamp (fuzz-driven cascades hand these around).
    pub fn slice_string(&self, range: Range) -> String {
        let start = range.start.min(self.len_bytes());
        let end = range.end.min(self.len_bytes());
        self.rope.byte_slice(start..end.max(start)).to_string()
    }

    /// Apply history edits (undo/redo replay — never recorded).
    pub fn apply_history(&mut self, ops: Vec<Edit>) {
        self.replaying = true;
        for op in &ops {
            match op.kind {
                EditKind::Insert => {
                    let at = self.clamp_boundary(op.at.min(self.len_bytes()));
                    self.rope.insert(self.rope.byte_to_char(at), &op.text);
                }
                EditKind::Delete => {
                    // both bounds must land on char boundaries — a stale
                    // replay against drifted text panics ropey otherwise
                    let end = self.clamp_boundary((op.at + op.text.len()).min(self.len_bytes()));
                    let start = self.clamp_boundary(op.at.min(end));
                    if start < end {
                        self.rope
                            .remove(self.rope.byte_to_char(start)..self.rope.byte_to_char(end));
                    }
                }
            }
        }
        self.replaying = false;
        self.dirty = true;
        self.epoch += 1;
        self.trace_history(&ops);
    }

    /// Replace the whole contents (user-facing path). Refuses on
    /// readonly buffers — the owning subsystem uses
    /// `replace_all_system`.
    pub fn replace_all(&mut self, text: &str) {
        if self.readonly {
            return;
        }
        self.replace_all_system(text);
    }

    /// The privileged replace for generated surfaces: their content is
    /// owned by jobs (git/LSP/shell), refreshed under the user's feet —
    /// the readonly guard is about *user* edits, not the owner.
    pub fn replace_all_system(&mut self, text: &str) {
        let removed_bytes = self.len_bytes();
        self.rope = Rope::from_str(text);
        self.epoch += 1;
        self.trace_edit(MutationSource::System, 0, removed_bytes, text);
    }

    /// Returns the deleted text (register payoff). Refuses on readonly
    /// buffers: the input layer checks first, but the mutation boundary
    /// enforces — no caller-remembered guard (0014).
    pub fn delete(&mut self, range: Range) -> String {
        if self.readonly && !self.replaying {
            return String::new();
        }
        // stale ranges (fuzz-driven cascades, replay drift) clamp, not panic
        let start = self.clamp_boundary(range.start.min(self.len_bytes()));
        let end = self.clamp_boundary(range.end.min(self.len_bytes()));
        if start >= end {
            return String::new();
        }
        let text = self.rope.byte_slice(start..end).to_string();
        // ropey mutates by CHAR index; our offsets are bytes
        let cstart = self.rope.byte_to_char(start);
        let cend = self.rope.byte_to_char(end);
        self.rope.remove(cstart..cend);
        self.dirty = true;
        self.epoch += 1;
        self.trace_edit(MutationSource::User, start, end - start, "");
        if !self.replaying && !self.readonly {
            self.history.record(
                Edit {
                    at: start,
                    text: text.clone(),
                    kind: EditKind::Insert,
                },
                Edit {
                    at: start,
                    text: text.clone(),
                    kind: EditKind::Delete,
                },
            );
        }
        text
    }

    pub fn insert(&mut self, at: impl Into<id::ByteOffset>, text: &str) {
        if self.readonly && !self.replaying {
            return;
        }
        let at = self.clamp_boundary(at);
        self.rope.insert(self.rope.byte_to_char(at), text);
        self.dirty = true;
        self.epoch += 1;
        self.trace_edit(MutationSource::User, at, 0, text);
        if !self.replaying && !self.readonly {
            self.history.record(
                Edit {
                    at,
                    text: text.into(),
                    kind: EditKind::Delete,
                },
                Edit {
                    at,
                    text: text.into(),
                    kind: EditKind::Insert,
                },
            );
        }
    }

    pub fn line_text(&self, line: impl Into<id::LineIndex>) -> String {
        let line = line.into().get();
        let start = self.line_start(line);
        let end = self.line_end(line);
        self.rope.byte_slice(start..end).to_string()
    }
}

/// Same-directory temp + rename, preserving the target's permissions —
/// the ONE atomic writer (0020 §8: no third copy of this logic).
fn write_atomic(target: &std::path::Path, contents: &str, overwrite: bool) -> std::io::Result<()> {
    use std::io::Write;
    let parent = target
        .parent()
        .filter(|path| !path.as_os_str().is_empty())
        .unwrap_or_else(|| std::path::Path::new("."));
    let mut temporary = tempfile::NamedTempFile::new_in(parent)?;
    match std::fs::metadata(target) {
        Ok(metadata) => temporary
            .as_file()
            .set_permissions(metadata.permissions())?,
        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
        Err(error) => return Err(error),
    }
    temporary.write_all(contents.as_bytes())?;
    temporary.as_file().sync_all()?;
    let result = if overwrite {
        temporary.persist(target)
    } else {
        temporary.persist_noclobber(target)
    };
    result.map(|_| ()).map_err(|error| error.error)
}

/// One edit in tree-sitter's terms (0022 §1): byte range + point
/// positions, computed from the op itself at commit time — no old text
/// needed (the point extents derive from the op's own content).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct InputEdit {
    pub start_byte: usize,
    pub old_end_byte: usize,
    pub new_end_byte: usize,
    pub start_point: (usize, usize),
    pub old_end_point: (usize, usize),
    pub new_end_point: (usize, usize),
}

impl Buffer {
    /// (line, col) of a byte offset, as tree-sitter Points.
    pub fn point_of(&self, offset: usize) -> (usize, usize) {
        let offset = offset.min(self.len_bytes());
        (self.line_of(offset), self.col_of(offset))
    }

    /// The (line, col) extent of a text fragment.
    fn point_extent(text: &str) -> (usize, usize) {
        let lines = text.bytes().filter(|b| *b == b'\n').count();
        let col = if lines == 0 {
            text.len()
        } else {
            text.rsplit('\n').next().map(str::len).unwrap_or(0)
        };
        (lines, col)
    }

    /// Bridge one recorded history op to tree-sitter's InputEdit.
    /// Call against the post-edit buffer (the transaction has landed).
    pub fn input_edit_of(&self, op: &crate::history::Edit) -> InputEdit {
        let start_point = self.point_of(op.at);
        let extent = Self::point_extent(&op.text);
        match op.kind {
            EditKind::Insert => InputEdit {
                start_byte: op.at,
                old_end_byte: op.at,
                new_end_byte: op.at + op.text.len(),
                start_point,
                old_end_point: start_point,
                // a single-line insert ends at start.column + len — the
                // extent's col is relative, not absolute (0023 probe)
                new_end_point: if extent.0 == 0 {
                    (start_point.0, start_point.1 + extent.1)
                } else {
                    (start_point.0 + extent.0, extent.1)
                },
            },
            EditKind::Delete => InputEdit {
                start_byte: op.at,
                old_end_byte: op.at + op.text.len(),
                new_end_byte: op.at,
                start_point,
                old_end_point: if extent.0 == 0 {
                    (start_point.0, start_point.1 + extent.1)
                } else {
                    (start_point.0 + extent.0, extent.1)
                },
                new_end_point: start_point,
            },
        }
    }
}

#[cfg(test)]
mod safety_tests {
    use super::*;

    #[test]
    fn save_refuses_external_change_unless_forced() {
        let dir = tempfile::tempdir().unwrap();
        let f = dir.path().join("f.txt");
        std::fs::write(&f, "original\n").unwrap();
        let mut b = Buffer::open(f.to_str().unwrap()).unwrap();
        b.insert(id::ByteOffset::new(0), "mine ");
        // another process touches the file
        std::thread::sleep(std::time::Duration::from_millis(5));
        std::fs::write(&f, "theirs\n").unwrap();
        let err = b.save(false).unwrap_err();
        assert!(err.to_string().contains("changed on disk"));
        assert_eq!(std::fs::read_to_string(&f).unwrap(), "theirs\n");
        b.save(true).unwrap(); // :w!
        assert_eq!(std::fs::read_to_string(&f).unwrap(), "mine original\n");
        assert!(!b.dirty);
    }

    #[test]
    fn save_is_atomic_and_keeps_permissions() {
        use std::os::unix::fs::PermissionsExt;
        let dir = tempfile::tempdir().unwrap();
        let f = dir.path().join("x.sh");
        std::fs::write(&f, "#!/bin/sh\n").unwrap();
        std::fs::set_permissions(&f, std::fs::Permissions::from_mode(0o750)).unwrap();
        let mut b = Buffer::open(f.to_str().unwrap()).unwrap();
        b.insert(id::ByteOffset::new(b.len_bytes()), "echo hi\n");
        b.save(false).unwrap();
        assert_eq!(std::fs::read_to_string(&f).unwrap(), "#!/bin/sh\necho hi\n");
        let mode = std::fs::metadata(&f).unwrap().permissions().mode() & 0o777;
        assert_eq!(mode, 0o750, "permissions survive the swap");
        // no temp litter
        assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 1);
    }

    #[test]
    fn readonly_refuses_mutation_at_the_boundary() {
        // 0014: the guard lives in Buffer, not in every caller's memory
        let mut b = Buffer::from_text("abc\n");
        b.readonly = true;
        b.insert(id::ByteOffset::new(0), "nope");
        let gone = b.delete(Range::charwise(0, 2));
        assert_eq!(gone, "");
        assert_eq!(b.rope.to_string(), "abc\n", "untouched");
        // the owner path still works (job-generated surfaces)
        b.replace_all_system("gen\n");
        assert_eq!(b.rope.to_string(), "gen\n");
    }
    #[test]
    fn non_utf8_filename_opens_and_roundtrips() {
        // 0021 §3: the filesystem is not UTF-8 — a weird name must open,
        // save, and keep its identity
        use std::os::unix::ffi::OsStrExt;
        let dir = tempfile::tempdir().unwrap();
        let weird = dir
            .path()
            .join(std::ffi::OsStr::from_bytes(b"weird-\xff.rs"));
        std::fs::write(&weird, "fn main() {}\n").unwrap();
        let mut b = Buffer::open(&weird).unwrap();
        assert_eq!(b.path.as_deref(), Some(weird.as_path()));
        b.insert(0, "// x\n");
        b.save(false).unwrap();
        assert!(std::fs::read_to_string(&weird).unwrap().starts_with("// x"));
    }
}