@moritzwilksch/diffle 0.1.3 → 0.1.5

package/dist/server/main.js

@@ -3951,7 +3951,7 @@ function generateCompletion(program, { shell, executable = program.name() }) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.1.3";
+var version$1 = "0.1.5";
 //#endregion
 //#region src/server/comments/anchor.ts
 function splitLines(contents) {
@@ -3996,10 +3996,15 @@ function quoteRange(contents, startLine, endLine) {
 	if (startLine < 1 || endLine < startLine || endLine > lines.length) return null;
 	return lines.slice(startLine - 1, endLine).join("\n");
 }
-/** Review order: by path, then line, then when the thread was opened. */
+/** The line a thread sorts under: a file thread comes before every line of its file. */
+function anchorLine(anchor) {
+	return anchor.kind === "line" ? anchor.startLine : 0;
+}
+/** Review order: by path, then line (file threads first), then when the thread was opened. */
 function compareThreads(a, b) {
 	if (a.anchor.path !== b.anchor.path) return a.anchor.path < b.anchor.path ? -1 : 1;
-	if (a.anchor.startLine !== b.anchor.startLine) return a.anchor.startLine - b.anchor.startLine;
+	const line = anchorLine(a.anchor) - anchorLine(b.anchor);
+	if (line !== 0) return line;
 	return (a.messages[0]?.createdAt ?? 0) - (b.messages[0]?.createdAt ?? 0);
 }
 //#endregion
@@ -4007,21 +4012,23 @@ function compareThreads(a, b) {
 /**
 * Agent-prompt format, one block per thread:
 *
-*   path:line            (or path:start-end)
+*   path:line            (or path:start-end; `(file) path` for a thread on the whole file)
 *
-*   > quoted line
+*   > quoted line        (absent for a file thread)
 *
 *   body                 (a thread's messages joined by a blank line)
 *
 *   ---
 *
-* A ```suggestion fence in a body expands to ORIGINAL / SUGGESTED fences.
+* A ```suggestion fence in a body expands to ORIGINAL / SUGGESTED fences; a file
+* thread has no original, so its fences stay as written.
 */
 function formatPrompt(threads) {
 	return [...threads].sort(compareThreads).map(formatOne).join("\n");
 }
 function formatOne(t) {
 	const { anchor } = t;
+	if (anchor.kind === "file") return `${`(file) ${t.stale ? "(stale) " : ""}${anchor.path}`}\n\n${t.messages.map((m) => m.body.trim()).join("\n\n")}\n\n---\n`;
 	const range = anchor.startLine === anchor.endLine ? `${anchor.startLine}` : `${anchor.startLine}-${anchor.endLine}`;
 	const prefixes = [];
 	if (anchor.side === "old") prefixes.push("(removed)");
@@ -4720,6 +4727,31 @@ var GitRepo = class GitRepo {
 			await fh?.close();
 		}
 	}
+	/**
+	* Boolean value of a gitattribute per path: `attr` or `attr=true` reads
+	* true, `-attr` or `attr=false` false; unspecified paths are absent. A
+	* revision reads `.gitattributes` from that tree, the worktree from the
+	* checkout. `--source` needs git 2.40.
+	*/
+	async attr(name, paths, rev) {
+		const out = /* @__PURE__ */ new Map();
+		if (paths.length === 0) return out;
+		const source = rev === "worktree" ? [] : [`--source=${rev}`];
+		const fields = splitZ(await this.exec([
+			"check-attr",
+			"-z",
+			"--stdin",
+			...source,
+			name,
+			"--"
+		], { input: paths.join("\0") }));
+		for (let i = 0; i + 2 < fields.length; i += 3) {
+			const value = fields[i + 2];
+			if (value === "set" || value === "true") out.set(fields[i], true);
+			else if (value === "unset" || value === "false") out.set(fields[i], false);
+		}
+		return out;
+	}
 	/** Paths git ignores, from a candidate list. */
 	async ignored(paths) {
 		if (paths.length === 0) return /* @__PURE__ */ new Set();
@@ -5076,11 +5108,15 @@ var GithubError = class extends Error {
 		this.status = status;
 	}
 };
+function isFileComment(c) {
+	return "subject_type" in c;
+}
 /**
 * Threads → the comments of one pending GitHub review, one per thread. Stale threads are skipped:
 * their lines no longer sit in the diff, and GitHub would refuse them anyway. With
 * `threadIds`, only those (resolved included, the user asked for them by hand);
-* without, every unresolved thread.
+* without, every unresolved thread. `review.comments` holds the line comments REST can
+* create; the file comments are appended afterwards, but `ids` counts both, in review order.
 */
 function buildReview(threads, commitId, threadIds) {
 	const skipped = [];
@@ -5113,20 +5149,27 @@ function buildReview(threads, commitId, threadIds) {
 	return {
 		review: {
 			commit_id: commitId,
-			comments
+			comments: comments.filter((c) => !isFileComment(c))
 		},
+		comments,
 		ids,
 		skipped
 	};
 }
 function toReviewComment(t) {
 	const { anchor } = t;
+	const body = formatBody(t.messages);
+	if (anchor.kind === "file") return {
+		path: anchor.path,
+		subject_type: "file",
+		body
+	};
 	const side = anchor.side === "old" ? "LEFT" : "RIGHT";
 	const c = {
 		path: anchor.path,
 		line: anchor.endLine,
 		side,
-		body: formatBody(t.messages)
+		body
 	};
 	if (anchor.startLine !== anchor.endLine) {
 		c.start_line = anchor.startLine;
@@ -5171,15 +5214,25 @@ var GithubExporter = class {
 */
 async function exportToGithub({ snap, pullRequest: pr, threads, threadIds, run = runGh }) {
 	if (snap.newSha === "worktree") throw new GithubError("GitHub cannot anchor comments to the worktree");
-	const { review, ids, skipped } = buildReview(threads, snap.newSha, threadIds);
-	if (review.comments.length === 0) throw new GithubError(skipped.length ? `nothing to post: ${describe(skipped)}` : "nothing to post", 400);
-	for (const [i, comment] of review.comments.entries()) comment.body += `\n\n${threadMarker(ids[i])}`;
+	const { review, comments, ids, skipped } = buildReview(threads, snap.newSha, threadIds);
+	if (comments.length === 0) throw new GithubError(skipped.length ? `nothing to post: ${describe(skipped)}` : "nothing to post", 400);
+	for (const [i, comment] of comments.entries()) comment.body += `\n\n${threadMarker(ids[i])}`;
 	const pending = await findPendingReview(run, snap.root, pr);
 	if (!pending) {
-		await createPendingReview(run, snap.root, pr.repository, pr.number, review);
+		const created = await createPendingReview(run, snap.root, pr.repository, pr.number, review);
+		let appended = 0;
+		try {
+			for (const c of comments.filter(isFileComment)) {
+				await addToPendingReview(run, snap.root, created.id, c);
+				appended++;
+			}
+		} catch (e) {
+			const detail = e instanceof Error ? e.message : String(e);
+			throw new GithubError(`created the pending review with ${review.comments.length + appended} comments, then ${detail}`, 502);
+		}
 		return {
 			url: pr.url,
-			posted: review.comments.length,
+			posted: comments.length,
 			updated: 0,
 			review: "created",
 			skipped
@@ -5190,7 +5243,7 @@ async function exportToGithub({ snap, pullRequest: pr, threads, threadIds, run =
 	let updated = 0;
 	let posted = 0;
 	try {
-		for (const [i, c] of review.comments.entries()) {
+		for (const [i, c] of comments.entries()) {
 			const id = ids[i];
 			const at = existing.get(anchorKey(c));
 			const index = at?.findIndex((comment) => comment.body.trimEnd().endsWith(threadMarker(id))) ?? -1;
@@ -5234,6 +5287,7 @@ function threadMarker(id) {
 }
 /** The anchor must still match before we rewrite an exported thread. */
 function anchorKey(c) {
+	if (isFileComment(c)) return [c.path, "FILE"].join("\0");
 	return [
 		c.path,
 		c.side,
@@ -5264,7 +5318,7 @@ async function findPendingReview(run, cwd, pr) {
 const THREADS_QUERY = `query($owner:String!,$repo:String!,$number:Int!,$after:String){
   repository(owner:$owner,name:$repo){pullRequest(number:$number){reviewThreads(first:100,after:$after){
     pageInfo{hasNextPage endCursor}
-    nodes{path line startLine diffSide comments(first:1){nodes{id body pullRequestReview{id}}}}
+    nodes{path line startLine diffSide subjectType comments(first:1){nodes{id body pullRequestReview{id}}}}
   }}}
 }`;
 /**
@@ -5288,15 +5342,8 @@ async function pendingComments(run, cwd, pr, reviewId) {
 		for (const t of threads.nodes) {
 			const c = t?.comments?.nodes?.[0];
 			if (!t?.path || !c?.id || c.pullRequestReview?.id !== reviewId) continue;
-			const line = t.line;
-			if (line == null) continue;
-			const side = t.diffSide === "LEFT" ? "LEFT" : "RIGHT";
-			const key = anchorKey({
-				path: t.path,
-				side,
-				line,
-				start_line: t.startLine ?? void 0
-			});
+			const key = pendingKey(t);
+			if (key == null) continue;
 			const at = by.get(key);
 			if (at) at.push({
 				nodeId: c.id,
@@ -5313,10 +5360,30 @@ async function pendingComments(run, cwd, pr, reviewId) {
 	}
 	throw new GithubError("pending review exceeds the 1000-thread lookup limit; export stopped without changes", 502);
 }
+/** The anchor key of a thread already in the review, or null for one GitHub reports without a position. */
+function pendingKey(t) {
+	const path = t.path;
+	if (t.subjectType === "FILE") return anchorKey({
+		path,
+		subject_type: "file",
+		body: ""
+	});
+	if (t.line == null) return null;
+	return anchorKey({
+		path,
+		side: t.diffSide === "LEFT" ? "LEFT" : "RIGHT",
+		line: t.line,
+		start_line: t.startLine ?? void 0,
+		body: ""
+	});
+}
 const UPDATE_COMMENT = `mutation($input:UpdatePullRequestReviewCommentInput!){updatePullRequestReviewComment(input:$input){pullRequestReviewComment{id}}}`;
-/** No `event` in the body, so GitHub keeps the new review pending with all of its comments. */
+/**
+* No `event` in the body, so GitHub keeps the new review pending with all of its comments.
+* Resolves the review's node id, for the comments REST cannot carry.
+*/
 async function createPendingReview(run, cwd, repository, number, review) {
-	await run([
+	const out = await run([
 		"api",
 		"--method",
 		"POST",
@@ -5327,20 +5394,31 @@ async function createPendingReview(run, cwd, repository, number, review) {
 		cwd,
 		input: JSON.stringify(review)
 	});
+	let id;
+	try {
+		id = JSON.parse(out).node_id;
+	} catch {
+		throw new GithubError(`unexpected output from gh api: ${out.slice(0, 200)}`, 502);
+	}
+	if (typeof id !== "string") throw new GithubError(`unexpected output from gh api: ${out.slice(0, 200)}`, 502);
+	return { id };
 }
 const ADD_THREAD = `mutation($input:AddPullRequestReviewThreadInput!){addPullRequestReviewThread(input:$input){thread{id}}}`;
-/** Appends one thread through GraphQL; REST cannot extend a pending review. */
+/** Appends one thread through GraphQL; REST cannot extend a pending review, nor place a file comment. */
 async function addToPendingReview(run, cwd, reviewId, c) {
 	const input = {
 		pullRequestReviewId: reviewId,
 		path: c.path,
-		line: c.line,
-		side: c.side,
 		body: c.body
 	};
-	if (c.start_line != null) {
-		input.startLine = c.start_line;
-		input.startSide = c.start_side;
+	if (isFileComment(c)) input.subjectType = "FILE";
+	else {
+		input.line = c.line;
+		input.side = c.side;
+		if (c.start_line != null) {
+			input.startLine = c.start_line;
+			input.startSide = c.start_side;
+		}
 	}
 	await graphql(run, cwd, ADD_THREAD, { input });
 }
@@ -11164,7 +11242,7 @@ const ChangedFileSchema = object({
 	binary: boolean(),
 	/** New-side blob sha. '' for deletions. Keys the viewed state. */
 	blob: string(),
-	/** A path pattern or a content sniff said this file is generated. Feeds auto-collapse and risk ranking. */
+	/** The `linguist-generated` gitattribute, a path pattern or a content sniff said this file is generated. Feeds auto-collapse and risk ranking. */
 	generated: boolean(),
 	/** A gitlink (mode 160000): `blob` is the recorded commit, the patch shows the commit-id change, and there is no file to open. */
 	submodule: literal(true).optional()
@@ -11192,7 +11270,8 @@ object({
 	contents: string(),
 	binary: boolean()
 });
-const CommentAnchorSchema = object({
+const CommentAnchorSchema = discriminatedUnion("kind", [object({
+	kind: literal("line"),
 	path: string(),
 	/** Column the user selected in a diff; 'new' for file items. */
 	side: SideSchema,
@@ -11200,7 +11279,11 @@ const CommentAnchorSchema = object({
 	endLine: number(),
 	/** Exact text of [startLine, endLine] at creation. */
 	quoted: string()
-});
+}), object({
+	kind: literal("file"),
+	/** The changed file's path (its new path for a rename), or any tree path. */
+	path: string()
+})]);
 const CommentMessageSchema = object({
 	id: string(),
 	body: string(),
@@ -11214,24 +11297,31 @@ object({
 	messages: CommentMessageSchema.array().min(1),
 	resolved: boolean(),
 	resolvedAt: number().optional(),
-	/** Relocation failed after a snapshot refresh. */
+	/** Relocation failed after a snapshot refresh: the lines left the diff, or the file left the review. */
 	stale: boolean(),
-	/** Original startLine, shown in export when stale. */
+	/** Original startLine of a line thread, shown in export when stale. */
 	staleFromLine: number().optional()
 });
-/** Create payload. `quoted` is optional: the server quotes the range from the snapshot. */
+/**
+* Create payload. Without `startLine` the thread is on the file as a whole; then `side`,
+* `endLine` and `quoted` are refused rather than ignored, so a payload that meant a line
+* never lands on the file. `quoted` is optional: the server quotes the range from the snapshot.
+*/
 const ThreadCreateSchema = object({
 	path: string().min(1),
 	/** Default 'new'. */
 	side: SideSchema.optional(),
-	startLine: number().int().positive(),
+	startLine: number().int().positive().optional(),
 	/** Default startLine. */
 	endLine: number().int().positive().optional(),
 	body: string().refine((body) => body.trim().length > 0, "body required"),
 	quoted: string().optional()
-}).refine((t) => t.endLine == null || t.endLine >= t.startLine, {
+}).refine((t) => t.startLine == null || t.endLine == null || t.endLine >= t.startLine, {
 	path: ["endLine"],
 	message: "endLine must be ≥ startLine"
+}).refine((t) => t.startLine != null || t.side == null && t.endLine == null && t.quoted == null, {
+	path: ["startLine"],
+	message: "side, endLine and quoted need a startLine; leave all four out for a comment on the whole file"
 });
 const ReplyCreateSchema = object({ body: string().refine((body) => body.trim().length > 0, "body required") });
 const ThreadStateSchema = _enum([
@@ -15780,38 +15870,39 @@ const LOOPBACK = /* @__PURE__ */ new Set([
 	"::1",
 	"localhost"
 ]);
+const HINT = "if a reverse proxy sent it, trust that origin with --allowed-origin";
 /**
-* Host/Origin policy for API and WebSocket requests. Pure given its inputs;
-* `bindHost` is the `--host` value. An Origin, when sent, must name the same
-* host:port as Host (blocks cross-site pages). On a loopback bind, Host must be
-* loopback too. On any other bind, Host must be an IP literal, loopback, the
-* bind host, or one of `names` (the machine's own hostnames by default). Both
-* rules block DNS rebinding: an attacker's domain is never an IP literal and
-* never one of ours.
+* Restricts API and WebSocket requests to local hosts and the configured public origin.
+* Proxies may preserve the public Host or rewrite it to an allowed upstream Host.
+* Forwarded headers never grant trust; a public Origin must be explicitly configured.
 */
-function requestGuard(bindHost, names = ownNames()) {
+function requestGuard(bindHost, names = ownNames(), allowedOrigin) {
 	const loopback = LOOPBACK.has(bindHost);
 	const allowed = /* @__PURE__ */ new Set([
 		...LOOPBACK,
 		bindHost.toLowerCase(),
 		...names.map((n) => n.toLowerCase())
 	]);
+	const publicHost = allowedOrigin == null ? void 0 : new URL(allowedOrigin).host;
 	return ({ host, origin }) => {
-		if (!host) return false;
-		if (origin != null) {
-			let originHost;
-			try {
-				originHost = new URL(origin).host;
-			} catch {
-				return false;
-			}
-			if (originHost !== host) return false;
-		}
+		if (!host) return "missing Host header";
 		const name = hostnameOf(host).toLowerCase();
-		if (loopback) return LOOPBACK.has(name);
-		return isIP(name) !== 0 || allowed.has(name);
+		const localHost = loopback ? LOOPBACK.has(name) : isIP(name) !== 0 || allowed.has(name);
+		const proxyHost = publicHost != null && host.toLowerCase() === publicHost;
+		if (!localHost && !proxyHost) return `forbidden Host "${host}"; ${HINT}`;
+		if (origin == null || allowedOrigin != null && origin === allowedOrigin) return null;
+		if (!proxyHost && parseHost(origin) === host) return null;
+		return `forbidden Origin "${origin}" for Host "${host}"; ${HINT}`;
 	};
 }
+/** The host of a syntactically valid origin; undefined for `null` and other non-URLs. */
+function parseHost(origin) {
+	try {
+		return new URL(origin).host;
+	} catch {
+		return;
+	}
+}
 /** The machine's hostname, its short form, and its mDNS name, so LAN visitors can use any of them. */
 function ownNames() {
 	const full = hostname();
@@ -15881,15 +15972,17 @@ function toThreadCreate(entry, where) {
 }
 /** True when `t` duplicates an open thread at the same anchor whose opening message has the same body. */
 function isDuplicate(existing, t) {
+	const body = t.body.trim();
+	const open = existing.filter((e) => !e.resolved && e.anchor.path === t.path && e.messages[0]?.body.trim() === body);
+	if (t.startLine == null) return open.some((e) => e.anchor.kind === "file");
 	const side = t.side ?? "new";
 	const endLine = t.endLine ?? t.startLine;
-	const body = t.body.trim();
-	return existing.some((e) => !e.resolved && e.anchor.path === t.path && e.anchor.side === side && e.anchor.startLine === t.startLine && e.anchor.endLine === endLine && e.messages[0]?.body.trim() === body);
+	return open.some((e) => e.anchor.kind === "line" && e.anchor.side === side && e.anchor.startLine === t.startLine && e.anchor.endLine === endLine);
 }
 //#endregion
 //#region src/server/comments/CommentStore.ts
 var NotFoundError = class extends Error {};
-/** A range the snapshot cannot quote: path absent on that side, or lines past the end. */
+/** An anchor the snapshot cannot place: path absent on that side, or lines past the end. */
 var UnquotableError = class extends Error {};
 /**
 * Owns this mode's set in `<gitDir>/diffle/comments.json`: threads and viewed
@@ -15906,14 +15999,14 @@ var CommentStore = class CommentStore {
 		this.file = file;
 		this.key = key;
 	}
-	/** Opens the store; a v1 file is backed up to `comments.v1.bak` and rewritten as v2 first. */
+	/** Opens the store; an older file is backed up to `comments.v<n>.bak` and rewritten in the current format first. */
 	static async open(gitDir, modeKey) {
 		const file = join(gitDir, "diffle", "comments.json");
 		await withFileLock(file, async () => {
 			const all = await readStoreFile(file);
-			if (all.version !== 1) return;
-			await copyFile(file, join(gitDir, "diffle", "comments.v1.bak"));
-			await writeStoreFile(file, migrateV1(all));
+			if (all.version === 3) return;
+			await copyFile(file, join(gitDir, "diffle", `comments.v${all.version}.bak`));
+			await writeStoreFile(file, upgrade(all));
 		});
 		return new CommentStore(file, modeKey);
 	}
@@ -15989,12 +16082,13 @@ var CommentStore = class CommentStore {
 		});
 	}
 	/**
-	* Adds each import that is not already an open duplicate. Every range is
-	* checked against the snapshot through `quote`; a payload's own `quoted` (the
-	* text the browser showed) is kept once the range is known to exist. Throws
-	* UnquotableError, adding nothing, when any range cannot be read.
+	* Adds each import that is not already an open duplicate. Every anchor is
+	* checked against the snapshot through `source`: a range is quoted (a payload's
+	* own `quoted`, the text the browser showed, is kept once the range is known to
+	* exist) and a file thread's path must be in the review. Throws UnquotableError,
+	* adding nothing, when any anchor cannot be placed.
 	*/
-	importThreads(imports, quote) {
+	importThreads(imports, source) {
 		return this.mutate(async (set) => {
 			const added = [];
 			const pending = [];
@@ -16005,18 +16099,7 @@ var CommentStore = class CommentStore {
 					skipped++;
 					continue;
 				}
-				const side = t.side ?? "new";
-				const startLine = t.startLine;
-				const endLine = t.endLine ?? startLine;
-				const fromSnapshot = await quote(t.path, side, startLine, endLine);
-				if (fromSnapshot == null) throw new UnquotableError(`cannot quote ${t.path}:${startLine}${endLine !== startLine ? `-${endLine}` : ""} on the ${side} side`);
-				const anchor = {
-					path: t.path,
-					side,
-					startLine,
-					endLine,
-					quoted: t.quoted ?? fromSnapshot
-				};
+				const anchor = await placeImport(t, source);
 				pending.push({
 					anchor,
 					t
@@ -16097,17 +16180,18 @@ var CommentStore = class CommentStore {
 		});
 	}
 	/**
-	* Re-anchor every thread against the current review. A thread is stale when
-	* its side is gone, its text is not found, or the relocated range falls
-	* outside what the review shows. Returns true if anything changed.
+	* Re-anchor every thread against the current review. A line thread is stale
+	* when its side is gone, its text is not found, or the relocated range falls
+	* outside what the review shows; a file thread when its file left the review.
+	* Returns true if anything changed.
 	*/
-	async relocateAll(view) {
+	async relocateAll(review) {
 		const cache = /* @__PURE__ */ new Map();
 		const load = (path, side) => {
 			const k = `${side}:${path}`;
 			let p = cache.get(k);
 			if (!p) {
-				p = view(path, side);
+				p = review.side(path, side);
 				cache.set(k, p);
 			}
 			return p;
@@ -16115,6 +16199,14 @@ var CommentStore = class CommentStore {
 		return this.mutate(async (set) => {
 			let changed = false;
 			for (const t of set.threads) {
+				if (t.anchor.kind === "file") {
+					const stale = !review.hasFile(t.anchor.path);
+					if (stale !== t.stale) {
+						t.stale = stale;
+						changed = true;
+					}
+					continue;
+				}
 				const v = await load(t.anchor.path, t.anchor.side);
 				let moved = v == null ? null : relocate(t.anchor, v.contents);
 				if (moved && v?.shown && !isShown(v.shown, moved.startLine, moved.endLine)) moved = null;
@@ -16151,7 +16243,7 @@ var CommentStore = class CommentStore {
 				viewed: []
 			};
 		}
-		return ownSet(parsed.version === 2 ? parsed : migrateV1(parsed), this.key);
+		return ownSet(upgrade(parsed), this.key);
 	}
 	/**
 	* Locked read-modify-write: `fn` edits this key's set as read from disk under
@@ -16161,12 +16253,11 @@ var CommentStore = class CommentStore {
 	*/
 	mutate(fn, changed = () => true) {
 		return withFileLock(this.file, async () => {
-			const onDisk = await readStoreFile(this.file);
-			const all = onDisk.version === 2 ? onDisk : migrateV1(onDisk);
+			const all = upgrade(await readStoreFile(this.file));
 			const set = ownSet(all, this.key);
 			const r = await fn(set);
 			if (changed(r)) await writeStoreFile(this.file, {
-				version: 2,
+				version: 3,
 				sets: {
 					...all.sets,
 					[this.key]: set
@@ -16188,7 +16279,33 @@ function findThread(set, id) {
 	if (!t) throw new NotFoundError(id);
 	return t;
 }
-/** The file as stored, or an empty v2 store when absent. Malformed JSON propagates. */
+/**
+* The anchor an import lands on, checked against the snapshot. Throws
+* UnquotableError for a range that cannot be quoted or a file the review lacks.
+*/
+async function placeImport(t, source) {
+	if (t.startLine == null) {
+		if (!await source.hasFile(t.path)) throw new UnquotableError(`${t.path} is not in the review`);
+		return {
+			kind: "file",
+			path: t.path
+		};
+	}
+	const side = t.side ?? "new";
+	const startLine = t.startLine;
+	const endLine = t.endLine ?? startLine;
+	const fromSnapshot = await source.quote(t.path, side, startLine, endLine);
+	if (fromSnapshot == null) throw new UnquotableError(`cannot quote ${t.path}:${startLine}${endLine !== startLine ? `-${endLine}` : ""} on the ${side} side`);
+	return {
+		kind: "line",
+		path: t.path,
+		side,
+		startLine,
+		endLine,
+		quoted: t.quoted ?? fromSnapshot
+	};
+}
+/** The file as stored, or an empty store when absent. Malformed JSON propagates. */
 async function readStoreFile(file) {
 	try {
 		return parseStoreFile(await readFile(file, "utf8"));
@@ -16196,20 +16313,26 @@ async function readStoreFile(file) {
 		if (e.code !== "ENOENT") throw e;
 	}
 	return {
-		version: 2,
+		version: 3,
 		sets: {}
 	};
 }
-/** Unknown shapes read as an empty v2 store. */
+/** Unknown shapes read as an empty store. */
 function parseStoreFile(text) {
 	const parsed = JSON.parse(text);
+	if (parsed.version === 3 && parsed.sets) return parsed;
 	if (parsed.version === 2 && parsed.sets) return parsed;
 	if (parsed.version === 1 && parsed.sets) return parsed;
 	return {
-		version: 2,
+		version: 3,
 		sets: {}
 	};
 }
+/** Any stored format as the current one. */
+function upgrade(all) {
+	if (all.version === 3) return all;
+	return migrateV2(all.version === 2 ? all : migrateV1(all));
+}
 /** Atomic write. Quoted source lines: owner-only. */
 function writeStoreFile(file, data) {
 	return writeFileAtomic(file, JSON.stringify(data, null, 2), 384);
@@ -16223,6 +16346,24 @@ function newMessage(msg) {
 		updatedAt: now
 	};
 }
+/** Every v2 anchor is a line range; v3 says so. */
+function migrateV2(v2) {
+	const sets = {};
+	for (const [key, set] of Object.entries(v2.sets)) sets[key] = {
+		threads: (set.threads ?? []).map((t) => ({
+			...t,
+			anchor: {
+				kind: "line",
+				...t.anchor
+			}
+		})),
+		viewed: set.viewed ?? []
+	};
+	return {
+		version: 3,
+		sets
+	};
+}
 /** Each v1 comment becomes a single-message, unresolved thread. */
 function migrateV1(v1) {
 	const sets = {};
@@ -16353,7 +16494,7 @@ function createApi(deps) {
 	});
 	app.post("/api/threads", async (c) => {
 		const imports = parseImports(await readJson(c));
-		const { added } = await session.comments.importThreads(imports, session.quoter());
+		const { added } = await session.comments.importThreads(imports, session.anchorSource());
 		if (added.length) hub.broadcast({ type: "threads" });
 		return c.json(added, 201);
 	});
@@ -16501,12 +16642,13 @@ var Server = class {
 	}
 	async listen() {
 		const app = new Hono();
-		const guard = requestGuard(this.opts.host);
+		const guard = requestGuard(this.opts.host, void 0, this.opts.allowedOrigin);
 		app.use("/api/*", async (c, next) => {
-			if (!guard({
+			const rejected = guard({
 				host: c.req.header("host"),
 				origin: c.req.header("origin")
-			})) return c.json({ error: "forbidden origin" }, 403);
+			});
+			if (rejected != null) return c.json({ error: rejected }, 403);
 			await next();
 		});
 		app.use("/api/*", async (c, next) => {
@@ -16896,6 +17038,8 @@ function looksGenerated(path, head) {
 //#endregion
 //#region src/server/Snapshotter.ts
 const PREWARM = 3;
+/** The gitattribute GitHub reads to collapse generated files; `=false` opts a file out of the heuristics. */
+const GENERATED_ATTR = "linguist-generated";
 /** Concurrent worktree reads while flagging generated files. */
 const SNIFF_CONCURRENCY = 8;
 /** Sniff verdicts remembered by blob sha; the map is emptied, not evicted, past this. */
@@ -17004,14 +17148,23 @@ var Snapshotter = class {
 		return snap;
 	}
 	/**
-	* Sets `generated` on each non-binary changed file: by path first, then by a
-	* SNIFF_BYTES content sniff. Blobs already classified are not read again;
-	* commit-side blobs go through one `cat-file --batch`, worktree files through
-	* a bounded read each. Never fails the snapshot: a read error means false.
+	* Sets `generated` on each non-binary changed file. A `linguist-generated`
+	* gitattribute on the new side decides outright, as on GitHub; otherwise a
+	* path convention, then a SNIFF_BYTES content sniff. Blobs already sniffed
+	* are not read again; commit-side blobs go through one `cat-file --batch`,
+	* worktree files through a bounded read each. Never fails the snapshot: a
+	* failed attribute lookup or read means the next heuristic, then false.
 	* Submodules have no contents to sniff.
 	*/
 	async fillGenerated(files, newSha) {
-		const sniff = files.filter((f) => f.status !== "D" && !f.binary && !f.submodule).filter((f) => !(f.generated = looksGenerated(f.path, null)));
+		const textual = files.filter((f) => f.status !== "D" && !f.binary && !f.submodule);
+		const marked = await this.repo.attr(GENERATED_ATTR, textual.map((f) => f.path), newSha).catch(() => /* @__PURE__ */ new Map());
+		const sniff = [];
+		for (const f of textual) {
+			const attr = marked.get(f.path);
+			if (attr != null) f.generated = attr;
+			else if (!(f.generated = looksGenerated(f.path, null))) sniff.push(f);
+		}
 		const unknown = [];
 		for (const f of sniff) {
 			const known = f.blob ? this.sniffed.get(f.blob) : void 0;
@@ -17236,21 +17389,24 @@ var Session = class {
 	/**
 	* Re-anchors threads against what `snap` shows. A changed file shows its
 	* hunks; an unchanged tree file shows its new side whole (the file view) and
-	* nothing of its old side.
+	* nothing of its old side. A file thread only needs its file in the review.
 	*/
 	async relocateComments(a, snap) {
-		await a.comments.relocateAll(async (path, side) => {
-			const buf = await this.readSide(snap, path, side);
-			if (buf == null) return null;
-			const contents = buf.toString("utf8");
-			if (!snap.changed.some((f) => f.path === path)) return side === "new" ? {
-				contents,
-				shown: null
-			} : null;
-			return {
-				contents,
-				shown: shownRanges(await a.snapshotter.patch(path) ?? "", side)
-			};
+		await a.comments.relocateAll({
+			side: async (path, side) => {
+				const buf = await this.readSide(snap, path, side);
+				if (buf == null) return null;
+				const contents = buf.toString("utf8");
+				if (!snap.changed.some((f) => f.path === path)) return side === "new" ? {
+					contents,
+					shown: null
+				} : null;
+				return {
+					contents,
+					shown: shownRanges(await a.snapshotter.patch(path) ?? "", side)
+				};
+			},
+			hasFile: (path) => this.hasFile(snap, path)
 		});
 	}
 	/**
@@ -17269,15 +17425,24 @@ var Session = class {
 	hasSide(snap, path, side) {
 		return sidePath(this.readablePaths(snap), path, side) != null;
 	}
+	/** Whether `path` is a file of the review: a changed file (by its new path) or a tree path. A rename's old path is not. */
+	hasFile(snap, path) {
+		const r = this.readablePaths(snap);
+		return r.tree.has(path) || r.changed.has(path);
+	}
 	/**
-	* Quotes a line range from the current snapshot, for imports that carry no
-	* `quoted`. Goes through `readSide`, so the allowlist applies.
+	* Places imported anchors against the current snapshot: quotes a line range for
+	* imports that carry no `quoted`, and says whether a file thread's file is in the
+	* review. Goes through `readSide`, so the allowlist applies.
 	*/
-	quoter() {
-		return async (path, side, startLine, endLine) => {
-			const snap = await this.snapshotter.current();
-			const buf = await this.readSide(snap, path, side);
-			return buf == null ? null : quoteRange(buf.toString("utf8"), startLine, endLine);
+	anchorSource() {
+		return {
+			quote: async (path, side, startLine, endLine) => {
+				const snap = await this.snapshotter.current();
+				const buf = await this.readSide(snap, path, side);
+				return buf == null ? null : quoteRange(buf.toString("utf8"), startLine, endLine);
+			},
+			hasFile: async (path) => this.hasFile(await this.snapshotter.current(), path)
 		};
 	}
 	readablePaths(snap) {
@@ -17329,7 +17494,7 @@ var Session = class {
 	}
 };
 async function defaultWatcherFactory() {
-	const { Watcher } = await import("./Watcher-C_X03LRa.js");
+	const { Watcher } = await import("./Watcher-CKwvGuPB.js");
 	return (target) => new Watcher(target);
 }
 function readablePaths(snap) {
@@ -21017,14 +21182,16 @@ var WsHub = class {
 		maxPayload: MAX_PAYLOAD_BYTES
 	});
 	clientListeners = /* @__PURE__ */ new Set();
-	attach(server, guard = () => true) {
+	attach(server, guard = () => null) {
 		server.on("upgrade", (req, socket, head) => {
 			if (new URL(req.url ?? "/", "http://localhost").pathname !== "/ws") return;
-			if (!guard({
+			const rejected = guard({
 				host: req.headers.host,
 				origin: req.headers.origin
-			})) {
-				socket.destroy();
+			});
+			if (rejected != null) {
+				socket.once("finish", () => socket.destroy());
+				socket.end(`HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\n${rejected}\n`);
 				return;
 			}
 			this.wss.handleUpgrade(req, socket, head, (ws) => {
@@ -21067,6 +21234,16 @@ function intArg(min, max) {
 }
 const parsePort = intArg(0, 65535);
 const parseContext = intArg(0, 1e4);
+/** Accepts an HTTP(S) origin without credentials, a path prefix, query, or fragment. */
+function parseAllowedOrigin(raw) {
+	try {
+		const url = new URL(raw);
+		if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash || !/^https?:\/\/[^/?#]+\/?$/i.test(raw)) throw new Error("invalid origin");
+		return url.origin;
+	} catch {
+		throw new InvalidArgumentError("expected an HTTP(S) origin, e.g. https://proxy.example (without a path)");
+	}
+}
 /** Commander parser for a language diffle knows; anything else lists the ones it does. */
 function parseLanguage(raw) {
 	const language = raw.trim().toLowerCase();
@@ -21238,7 +21415,7 @@ const c = {
 	bold: paint("1"),
 	dim: paint("2")
 };
-const program = new Command().name("diffle").description("Review a git diff in the browser and export line comments as an agent prompt.").version(version$1, "-v, --version", "print the version and exit").addOption(completionHint(new Option("-C <path>", "run as if started in <path> (any directory inside a git worktree)"), { kind: "directory" })).option("-p, --port <port>", `port to listen on (default: ${DEFAULT_PORT}, or the next free one; 0 = random)`, parsePort).option("-H, --host <host>", "address to bind; use 0.0.0.0 to expose on the network", "127.0.0.1").option("--no-open", "do not open a browser").option("--keep-alive", "keep the server running after all browser tabs close").option("--no-watch", "do not watch for changes").addOption(new Option("--auto-viewed <glob>", "mark matching files viewed for this session (repeatable)").argParser(collect).default([], "none")).option("-U, --context <n>", "context lines around changes for this session (default: config, 5)", parseContext).addOption(new Option("--lsp <language=command>", "language server command for one language, started for this run (repeatable); by default the diff's languages are served by whatever is on PATH").argParser(collectLspOverride).default(true, "the diff's languages, resolved on PATH")).option("--no-lsp", "do not start any language server").option("--timing", "print startup phase timings to stderr").option("--dev", "serve the client through Vite (development)", process.env.DIFFLE_DEV === "1" ? true : void 0).addArgument(completionHint(new Argument("[revs...]", "git-diff style revisions: <rev> | <a>..<b> | <a>...<b> | <a> <b>"), {
+const program = new Command().exitOverride().name("diffle").description("Review a git diff in the browser and export line comments as an agent prompt.").version(version$1, "-v, --version", "print the version and exit").addOption(completionHint(new Option("-C <path>", "run as if started in <path> (any directory inside a git worktree)"), { kind: "directory" })).option("-p, --port <port>", `port to listen on (default: ${DEFAULT_PORT}, or the next free one; 0 = random)`, parsePort).option("-H, --host <host>", "address to bind; use 0.0.0.0 to expose on the network", "127.0.0.1").option("--allowed-origin <origin>", "trusted public HTTP(S) origin behind a reverse proxy (without a path)", parseAllowedOrigin).option("--no-open", "do not open a browser").option("--keep-alive", "keep the server running after all browser tabs close").option("--no-watch", "do not watch for changes").addOption(new Option("--auto-viewed <glob>", "mark matching files viewed for this session (repeatable)").argParser(collect).default([], "none")).option("-U, --context <n>", "context lines around changes for this session (default: config, 5)", parseContext).addOption(new Option("--lsp <language=command>", "language server command for one language, started for this run (repeatable); by default the diff's languages are served by whatever is on PATH").argParser(collectLspOverride).default(true, "the diff's languages, resolved on PATH")).option("--no-lsp", "do not start any language server").option("--timing", "print startup phase timings to stderr").option("--dev", "serve the client through Vite (development)", process.env.DIFFLE_DEV === "1" ? true : void 0).addArgument(completionHint(new Argument("[revs...]", "git-diff style revisions: <rev> | <a>..<b> | <a>...<b> | <a> <b>"), {
 	kind: "choices",
 	values: ["working", "pr"]
 })).addHelpText("after", `
@@ -21374,6 +21551,7 @@ async function serve(req, opts, repo, closeRepo, config, timing) {
 		port: opts.port ?? 4966,
 		probe: opts.port == null,
 		host: opts.host,
+		allowedOrigin: opts.allowedOrigin,
 		dev: opts.dev || !hasClientBuild()
 	});
 	let stopBrowserWatch = () => {};
@@ -21471,9 +21649,8 @@ function startLsp(repo, session, hub, overrides, preload) {
 	});
 	return lsp;
 }
-program.exitOverride();
 program.parseAsync(process.argv).catch((e) => {
-	if (e instanceof CommanderError) process.exit(e.exitCode);
+	if (e instanceof CommanderError) process.exit(e.exitCode === 0 ? 0 : 2);
 	console.error(`${c.red("✖")} ${e instanceof Error ? e.message : e}`);
 	process.exit(e instanceof RevspecError || e instanceof GitError || e instanceof GithubError ? 2 : 1);
 });