@moritzwilksch/diffle 0.1.4 → 0.1.6

package/dist/server/main.js

@@ -3951,7 +3951,7 @@ function generateCompletion(program, { shell, executable = program.name() }) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.1.4";
+var version$1 = "0.1.6";
 //#endregion
 //#region src/server/comments/anchor.ts
 function splitLines(contents) {
@@ -3996,10 +3996,15 @@ function quoteRange(contents, startLine, endLine) {
 	if (startLine < 1 || endLine < startLine || endLine > lines.length) return null;
 	return lines.slice(startLine - 1, endLine).join("\n");
 }
-/** Review order: by path, then line, then when the thread was opened. */
+/** The line a thread sorts under: a file thread comes before every line of its file. */
+function anchorLine(anchor) {
+	return anchor.kind === "line" ? anchor.startLine : 0;
+}
+/** Review order: by path, then line (file threads first), then when the thread was opened. */
 function compareThreads(a, b) {
 	if (a.anchor.path !== b.anchor.path) return a.anchor.path < b.anchor.path ? -1 : 1;
-	if (a.anchor.startLine !== b.anchor.startLine) return a.anchor.startLine - b.anchor.startLine;
+	const line = anchorLine(a.anchor) - anchorLine(b.anchor);
+	if (line !== 0) return line;
 	return (a.messages[0]?.createdAt ?? 0) - (b.messages[0]?.createdAt ?? 0);
 }
 //#endregion
@@ -4007,21 +4012,23 @@ function compareThreads(a, b) {
 /**
 * Agent-prompt format, one block per thread:
 *
-*   path:line            (or path:start-end)
+*   path:line            (or path:start-end; `(file) path` for a thread on the whole file)
 *
-*   > quoted line
+*   > quoted line        (absent for a file thread)
 *
 *   body                 (a thread's messages joined by a blank line)
 *
 *   ---
 *
-* A ```suggestion fence in a body expands to ORIGINAL / SUGGESTED fences.
+* A ```suggestion fence in a body expands to ORIGINAL / SUGGESTED fences; a file
+* thread has no original, so its fences stay as written.
 */
 function formatPrompt(threads) {
 	return [...threads].sort(compareThreads).map(formatOne).join("\n");
 }
 function formatOne(t) {
 	const { anchor } = t;
+	if (anchor.kind === "file") return `${`(file) ${t.stale ? "(stale) " : ""}${anchor.path}`}\n\n${t.messages.map((m) => m.body.trim()).join("\n\n")}\n\n---\n`;
 	const range = anchor.startLine === anchor.endLine ? `${anchor.startLine}` : `${anchor.startLine}-${anchor.endLine}`;
 	const prefixes = [];
 	if (anchor.side === "old") prefixes.push("(removed)");
@@ -4513,10 +4520,11 @@ var GitRepo = class GitRepo {
 	* Worktree searches include untracked files. The result is
 	* bounded globally: git is stopped once `limit + 1` records have arrived, so a
 	* common query in a large repository cannot flood the process. `paths`
-	* restricts the search to those files; an empty list matches nothing.
+	* restricts files; `ranges` restricts new-side lines before applying the limit.
+	* An empty path list or range map matches nothing.
 	*/
 	async grep(query, rev, limit = 500, opts = {}) {
-		if (!query || opts.paths?.length === 0) return {
+		if (!query || opts.paths?.length === 0 || opts.ranges?.size === 0) return {
 			matches: [],
 			truncated: false
 		};
@@ -4526,9 +4534,9 @@ var GitRepo = class GitRepo {
 			"--no-column",
 			"-I",
 			opts.regex ? "-E" : "-F",
-			"-z",
-			`--max-count=${limit + 1}`
+			"-z"
 		];
+		if (!opts.ranges) args.push(`--max-count=${limit + 1}`);
 		if (opts.word) args.push("-w");
 		if (opts.ignoreCase) args.push("-i");
 		args.push("-e", query);
@@ -4536,20 +4544,25 @@ var GitRepo = class GitRepo {
 		else args.push(rev);
 		args.push("--");
 		for (const p of opts.paths ?? []) args.push(`:(literal)${p}`);
+		const parse = (rec) => {
+			const [rawPath = "", line = "", ...rest] = rec.split("\0");
+			return {
+				path: rev === "worktree" ? rawPath : rawPath.slice(rawPath.indexOf(":") + 1),
+				line: Number(line),
+				text: rest.join("\0").slice(0, 300)
+			};
+		};
 		const records = await execGitRecords(this.root, args, limit + 1, {
 			okCodes: [0, 1],
-			timeoutMs: GREP_TIMEOUT_MS
+			timeoutMs: GREP_TIMEOUT_MS,
+			accept: opts.ranges ? (record) => {
+				const { path, line } = parse(record);
+				return opts.ranges.get(path)?.some(([start, end]) => line >= start && line <= end) ?? false;
+			} : void 0
 		});
 		const truncated = records.length > limit;
 		return {
-			matches: records.slice(0, limit).map((rec) => {
-				const [rawPath = "", line = "", ...rest] = rec.split("\0");
-				return {
-					path: rev === "worktree" ? rawPath : rawPath.slice(rawPath.indexOf(":") + 1),
-					line: Number(line),
-					text: rest.join("\0").slice(0, 300)
-				};
-			}),
+			matches: records.slice(0, limit).map(parse),
 			truncated
 		};
 	}
@@ -4720,6 +4733,31 @@ var GitRepo = class GitRepo {
 			await fh?.close();
 		}
 	}
+	/**
+	* Boolean value of a gitattribute per path: `attr` or `attr=true` reads
+	* true, `-attr` or `attr=false` false; unspecified paths are absent. A
+	* revision reads `.gitattributes` from that tree, the worktree from the
+	* checkout. `--source` needs git 2.40.
+	*/
+	async attr(name, paths, rev) {
+		const out = /* @__PURE__ */ new Map();
+		if (paths.length === 0) return out;
+		const source = rev === "worktree" ? [] : [`--source=${rev}`];
+		const fields = splitZ(await this.exec([
+			"check-attr",
+			"-z",
+			"--stdin",
+			...source,
+			name,
+			"--"
+		], { input: paths.join("\0") }));
+		for (let i = 0; i + 2 < fields.length; i += 3) {
+			const value = fields[i + 2];
+			if (value === "set" || value === "true") out.set(fields[i], true);
+			else if (value === "unset" || value === "false") out.set(fields[i], false);
+		}
+		return out;
+	}
 	/** Paths git ignores, from a candidate list. */
 	async ignored(paths) {
 		if (paths.length === 0) return /* @__PURE__ */ new Set();
@@ -4951,9 +4989,10 @@ function execGitRecords(cwd, args, maxRecords, opts = {}) {
 				GIT_OPTIONAL_LOCKS: "0"
 			}
 		});
-		const chunks = [];
+		const records = [];
+		let chunks = [];
+		let fields = 0;
 		const errChunks = [];
-		let seen = 0;
 		let done = false;
 		let timedOut = false;
 		const timer = opts.timeoutMs == null ? null : setTimeout(() => {
@@ -4962,16 +5001,24 @@ function execGitRecords(cwd, args, maxRecords, opts = {}) {
 		}, opts.timeoutMs);
 		child.stdout.on("data", (chunk) => {
 			if (done) return;
+			let start = 0;
 			for (let i = 0; i < chunk.length; i++) {
-				if (chunk[i] !== 10) continue;
-				if (++seen === maxRecords) {
-					chunks.push(chunk.subarray(0, i + 1));
+				if (chunk[i] === 0) fields++;
+				if (chunk[i] !== 10 || fields < 2) continue;
+				chunks.push(chunk.subarray(start, i));
+				const record = Buffer.concat(chunks).toString("utf8");
+				chunks = [];
+				fields = 0;
+				start = i + 1;
+				if (opts.accept && !opts.accept(record)) continue;
+				records.push(record);
+				if (records.length === maxRecords) {
 					done = true;
 					child.kill();
 					return;
 				}
 			}
-			chunks.push(chunk);
+			if (start < chunk.length) chunks.push(chunk.subarray(start));
 		});
 		child.stderr.on("data", (chunk) => errChunks.push(chunk));
 		child.on("error", (err) => rej(new GitError(`git ${args.join(" ")} failed: ${err.message}`, args, null, "")));
@@ -4986,8 +5033,6 @@ function execGitRecords(cwd, args, maxRecords, opts = {}) {
 				rej(new GitError(`git ${args.join(" ")} failed: ${stderr.trim()}`, args, code, stderr));
 				return;
 			}
-			const records = Buffer.concat(chunks).toString("utf8").split("\n");
-			if (records[records.length - 1] === "") records.pop();
 			res(records);
 		});
 	});
@@ -5076,11 +5121,15 @@ var GithubError = class extends Error {
 		this.status = status;
 	}
 };
+function isFileComment(c) {
+	return "subject_type" in c;
+}
 /**
 * Threads → the comments of one pending GitHub review, one per thread. Stale threads are skipped:
 * their lines no longer sit in the diff, and GitHub would refuse them anyway. With
 * `threadIds`, only those (resolved included, the user asked for them by hand);
-* without, every unresolved thread.
+* without, every unresolved thread. `review.comments` holds the line comments REST can
+* create; the file comments are appended afterwards, but `ids` counts both, in review order.
 */
 function buildReview(threads, commitId, threadIds) {
 	const skipped = [];
@@ -5113,20 +5162,27 @@ function buildReview(threads, commitId, threadIds) {
 	return {
 		review: {
 			commit_id: commitId,
-			comments
+			comments: comments.filter((c) => !isFileComment(c))
 		},
+		comments,
 		ids,
 		skipped
 	};
 }
 function toReviewComment(t) {
 	const { anchor } = t;
+	const body = formatBody(t.messages);
+	if (anchor.kind === "file") return {
+		path: anchor.path,
+		subject_type: "file",
+		body
+	};
 	const side = anchor.side === "old" ? "LEFT" : "RIGHT";
 	const c = {
 		path: anchor.path,
 		line: anchor.endLine,
 		side,
-		body: formatBody(t.messages)
+		body
 	};
 	if (anchor.startLine !== anchor.endLine) {
 		c.start_line = anchor.startLine;
@@ -5171,15 +5227,25 @@ var GithubExporter = class {
 */
 async function exportToGithub({ snap, pullRequest: pr, threads, threadIds, run = runGh }) {
 	if (snap.newSha === "worktree") throw new GithubError("GitHub cannot anchor comments to the worktree");
-	const { review, ids, skipped } = buildReview(threads, snap.newSha, threadIds);
-	if (review.comments.length === 0) throw new GithubError(skipped.length ? `nothing to post: ${describe(skipped)}` : "nothing to post", 400);
-	for (const [i, comment] of review.comments.entries()) comment.body += `\n\n${threadMarker(ids[i])}`;
+	const { review, comments, ids, skipped } = buildReview(threads, snap.newSha, threadIds);
+	if (comments.length === 0) throw new GithubError(skipped.length ? `nothing to post: ${describe(skipped)}` : "nothing to post", 400);
+	for (const [i, comment] of comments.entries()) comment.body += `\n\n${threadMarker(ids[i])}`;
 	const pending = await findPendingReview(run, snap.root, pr);
 	if (!pending) {
-		await createPendingReview(run, snap.root, pr.repository, pr.number, review);
+		const created = await createPendingReview(run, snap.root, pr.repository, pr.number, review);
+		let appended = 0;
+		try {
+			for (const c of comments.filter(isFileComment)) {
+				await addToPendingReview(run, snap.root, created.id, c);
+				appended++;
+			}
+		} catch (e) {
+			const detail = e instanceof Error ? e.message : String(e);
+			throw new GithubError(`created the pending review with ${review.comments.length + appended} comments, then ${detail}`, 502);
+		}
 		return {
 			url: pr.url,
-			posted: review.comments.length,
+			posted: comments.length,
 			updated: 0,
 			review: "created",
 			skipped
@@ -5190,7 +5256,7 @@ async function exportToGithub({ snap, pullRequest: pr, threads, threadIds, run =
 	let updated = 0;
 	let posted = 0;
 	try {
-		for (const [i, c] of review.comments.entries()) {
+		for (const [i, c] of comments.entries()) {
 			const id = ids[i];
 			const at = existing.get(anchorKey(c));
 			const index = at?.findIndex((comment) => comment.body.trimEnd().endsWith(threadMarker(id))) ?? -1;
@@ -5234,6 +5300,7 @@ function threadMarker(id) {
 }
 /** The anchor must still match before we rewrite an exported thread. */
 function anchorKey(c) {
+	if (isFileComment(c)) return [c.path, "FILE"].join("\0");
 	return [
 		c.path,
 		c.side,
@@ -5264,7 +5331,7 @@ async function findPendingReview(run, cwd, pr) {
 const THREADS_QUERY = `query($owner:String!,$repo:String!,$number:Int!,$after:String){
   repository(owner:$owner,name:$repo){pullRequest(number:$number){reviewThreads(first:100,after:$after){
     pageInfo{hasNextPage endCursor}
-    nodes{path line startLine diffSide comments(first:1){nodes{id body pullRequestReview{id}}}}
+    nodes{path line startLine diffSide subjectType comments(first:1){nodes{id body pullRequestReview{id}}}}
   }}}
 }`;
 /**
@@ -5288,15 +5355,8 @@ async function pendingComments(run, cwd, pr, reviewId) {
 		for (const t of threads.nodes) {
 			const c = t?.comments?.nodes?.[0];
 			if (!t?.path || !c?.id || c.pullRequestReview?.id !== reviewId) continue;
-			const line = t.line;
-			if (line == null) continue;
-			const side = t.diffSide === "LEFT" ? "LEFT" : "RIGHT";
-			const key = anchorKey({
-				path: t.path,
-				side,
-				line,
-				start_line: t.startLine ?? void 0
-			});
+			const key = pendingKey(t);
+			if (key == null) continue;
 			const at = by.get(key);
 			if (at) at.push({
 				nodeId: c.id,
@@ -5313,10 +5373,30 @@ async function pendingComments(run, cwd, pr, reviewId) {
 	}
 	throw new GithubError("pending review exceeds the 1000-thread lookup limit; export stopped without changes", 502);
 }
+/** The anchor key of a thread already in the review, or null for one GitHub reports without a position. */
+function pendingKey(t) {
+	const path = t.path;
+	if (t.subjectType === "FILE") return anchorKey({
+		path,
+		subject_type: "file",
+		body: ""
+	});
+	if (t.line == null) return null;
+	return anchorKey({
+		path,
+		side: t.diffSide === "LEFT" ? "LEFT" : "RIGHT",
+		line: t.line,
+		start_line: t.startLine ?? void 0,
+		body: ""
+	});
+}
 const UPDATE_COMMENT = `mutation($input:UpdatePullRequestReviewCommentInput!){updatePullRequestReviewComment(input:$input){pullRequestReviewComment{id}}}`;
-/** No `event` in the body, so GitHub keeps the new review pending with all of its comments. */
+/**
+* No `event` in the body, so GitHub keeps the new review pending with all of its comments.
+* Resolves the review's node id, for the comments REST cannot carry.
+*/
 async function createPendingReview(run, cwd, repository, number, review) {
-	await run([
+	const out = await run([
 		"api",
 		"--method",
 		"POST",
@@ -5327,20 +5407,31 @@ async function createPendingReview(run, cwd, repository, number, review) {
 		cwd,
 		input: JSON.stringify(review)
 	});
+	let id;
+	try {
+		id = JSON.parse(out).node_id;
+	} catch {
+		throw new GithubError(`unexpected output from gh api: ${out.slice(0, 200)}`, 502);
+	}
+	if (typeof id !== "string") throw new GithubError(`unexpected output from gh api: ${out.slice(0, 200)}`, 502);
+	return { id };
 }
 const ADD_THREAD = `mutation($input:AddPullRequestReviewThreadInput!){addPullRequestReviewThread(input:$input){thread{id}}}`;
-/** Appends one thread through GraphQL; REST cannot extend a pending review. */
+/** Appends one thread through GraphQL; REST cannot extend a pending review, nor place a file comment. */
 async function addToPendingReview(run, cwd, reviewId, c) {
 	const input = {
 		pullRequestReviewId: reviewId,
 		path: c.path,
-		line: c.line,
-		side: c.side,
 		body: c.body
 	};
-	if (c.start_line != null) {
-		input.startLine = c.start_line;
-		input.startSide = c.start_side;
+	if (isFileComment(c)) input.subjectType = "FILE";
+	else {
+		input.line = c.line;
+		input.side = c.side;
+		if (c.start_line != null) {
+			input.startLine = c.start_line;
+			input.startSide = c.start_side;
+		}
 	}
 	await graphql(run, cwd, ADD_THREAD, { input });
 }
@@ -11164,7 +11255,7 @@ const ChangedFileSchema = object({
 	binary: boolean(),
 	/** New-side blob sha. '' for deletions. Keys the viewed state. */
 	blob: string(),
-	/** A path pattern or a content sniff said this file is generated. Feeds auto-collapse and risk ranking. */
+	/** The `linguist-generated` gitattribute, a path pattern or a content sniff said this file is generated. Feeds auto-collapse and risk ranking. */
 	generated: boolean(),
 	/** A gitlink (mode 160000): `blob` is the recorded commit, the patch shows the commit-id change, and there is no file to open. */
 	submodule: literal(true).optional()
@@ -11192,7 +11283,8 @@ object({
 	contents: string(),
 	binary: boolean()
 });
-const CommentAnchorSchema = object({
+const CommentAnchorSchema = discriminatedUnion("kind", [object({
+	kind: literal("line"),
 	path: string(),
 	/** Column the user selected in a diff; 'new' for file items. */
 	side: SideSchema,
@@ -11200,7 +11292,11 @@ const CommentAnchorSchema = object({
 	endLine: number(),
 	/** Exact text of [startLine, endLine] at creation. */
 	quoted: string()
-});
+}), object({
+	kind: literal("file"),
+	/** The changed file's path (its new path for a rename), or any tree path. */
+	path: string()
+})]);
 const CommentMessageSchema = object({
 	id: string(),
 	body: string(),
@@ -11214,24 +11310,31 @@ object({
 	messages: CommentMessageSchema.array().min(1),
 	resolved: boolean(),
 	resolvedAt: number().optional(),
-	/** Relocation failed after a snapshot refresh. */
+	/** Relocation failed after a snapshot refresh: the lines left the diff, or the file left the review. */
 	stale: boolean(),
-	/** Original startLine, shown in export when stale. */
+	/** Original startLine of a line thread, shown in export when stale. */
 	staleFromLine: number().optional()
 });
-/** Create payload. `quoted` is optional: the server quotes the range from the snapshot. */
+/**
+* Create payload. Without `startLine` the thread is on the file as a whole; then `side`,
+* `endLine` and `quoted` are refused rather than ignored, so a payload that meant a line
+* never lands on the file. `quoted` is optional: the server quotes the range from the snapshot.
+*/
 const ThreadCreateSchema = object({
 	path: string().min(1),
 	/** Default 'new'. */
 	side: SideSchema.optional(),
-	startLine: number().int().positive(),
+	startLine: number().int().positive().optional(),
 	/** Default startLine. */
 	endLine: number().int().positive().optional(),
 	body: string().refine((body) => body.trim().length > 0, "body required"),
 	quoted: string().optional()
-}).refine((t) => t.endLine == null || t.endLine >= t.startLine, {
+}).refine((t) => t.startLine == null || t.endLine == null || t.endLine >= t.startLine, {
 	path: ["endLine"],
 	message: "endLine must be ≥ startLine"
+}).refine((t) => t.startLine != null || t.side == null && t.endLine == null && t.quoted == null, {
+	path: ["startLine"],
+	message: "side, endLine and quoted need a startLine; leave all four out for a comment on the whole file"
 });
 const ReplyCreateSchema = object({ body: string().refine((body) => body.trim().length > 0, "body required") });
 const ThreadStateSchema = _enum([
@@ -11301,6 +11404,8 @@ const SearchScopeSchema = _enum([
 	"diff",
 	"repo"
 ]);
+/** Whether search includes whole files or only new-side diff hunks and their context. */
+const SearchContentSchema = _enum(["diff", "full"]);
 object({
 	query: string(),
 	matches: SearchMatchSchema.array(),
@@ -11522,6 +11627,7 @@ const flagSchema = _enum(["0", "1"]).optional().transform((value) => value === "
 const SearchQuerySchema = object({
 	q: string().default(""),
 	scope: SearchScopeSchema.default("diff"),
+	content: SearchContentSchema.default("diff"),
 	path: string().optional(),
 	word: flagSchema,
 	i: flagSchema,
@@ -15780,6 +15886,7 @@ const LOOPBACK = /* @__PURE__ */ new Set([
 	"::1",
 	"localhost"
 ]);
+const HINT = "if a reverse proxy sent it, trust that origin with --allowed-origin";
 /**
 * Restricts API and WebSocket requests to local hosts and the configured public origin.
 * Proxies may preserve the public Host or rewrite it to an allowed upstream Host.
@@ -15794,20 +15901,24 @@ function requestGuard(bindHost, names = ownNames(), allowedOrigin) {
 	]);
 	const publicHost = allowedOrigin == null ? void 0 : new URL(allowedOrigin).host;
 	return ({ host, origin }) => {
-		if (!host) return false;
+		if (!host) return "missing Host header";
 		const name = hostnameOf(host).toLowerCase();
 		const localHost = loopback ? LOOPBACK.has(name) : isIP(name) !== 0 || allowed.has(name);
 		const proxyHost = publicHost != null && host.toLowerCase() === publicHost;
-		if (!localHost && !proxyHost) return false;
-		if (origin == null || allowedOrigin != null && origin === allowedOrigin) return true;
-		if (proxyHost) return false;
-		try {
-			return new URL(origin).host === host;
-		} catch {
-			return false;
-		}
+		if (!localHost && !proxyHost) return `forbidden Host "${host}"; ${HINT}`;
+		if (origin == null || allowedOrigin != null && origin === allowedOrigin) return null;
+		if (!proxyHost && parseHost(origin) === host) return null;
+		return `forbidden Origin "${origin}" for Host "${host}"; ${HINT}`;
 	};
 }
+/** The host of a syntactically valid origin; undefined for `null` and other non-URLs. */
+function parseHost(origin) {
+	try {
+		return new URL(origin).host;
+	} catch {
+		return;
+	}
+}
 /** The machine's hostname, its short form, and its mDNS name, so LAN visitors can use any of them. */
 function ownNames() {
 	const full = hostname();
@@ -15877,15 +15988,17 @@ function toThreadCreate(entry, where) {
 }
 /** True when `t` duplicates an open thread at the same anchor whose opening message has the same body. */
 function isDuplicate(existing, t) {
+	const body = t.body.trim();
+	const open = existing.filter((e) => !e.resolved && e.anchor.path === t.path && e.messages[0]?.body.trim() === body);
+	if (t.startLine == null) return open.some((e) => e.anchor.kind === "file");
 	const side = t.side ?? "new";
 	const endLine = t.endLine ?? t.startLine;
-	const body = t.body.trim();
-	return existing.some((e) => !e.resolved && e.anchor.path === t.path && e.anchor.side === side && e.anchor.startLine === t.startLine && e.anchor.endLine === endLine && e.messages[0]?.body.trim() === body);
+	return open.some((e) => e.anchor.kind === "line" && e.anchor.side === side && e.anchor.startLine === t.startLine && e.anchor.endLine === endLine);
 }
 //#endregion
 //#region src/server/comments/CommentStore.ts
 var NotFoundError = class extends Error {};
-/** A range the snapshot cannot quote: path absent on that side, or lines past the end. */
+/** An anchor the snapshot cannot place: path absent on that side, or lines past the end. */
 var UnquotableError = class extends Error {};
 /**
 * Owns this mode's set in `<gitDir>/diffle/comments.json`: threads and viewed
@@ -15902,14 +16015,14 @@ var CommentStore = class CommentStore {
 		this.file = file;
 		this.key = key;
 	}
-	/** Opens the store; a v1 file is backed up to `comments.v1.bak` and rewritten as v2 first. */
+	/** Opens the store; an older file is backed up to `comments.v<n>.bak` and rewritten in the current format first. */
 	static async open(gitDir, modeKey) {
 		const file = join(gitDir, "diffle", "comments.json");
 		await withFileLock(file, async () => {
 			const all = await readStoreFile(file);
-			if (all.version !== 1) return;
-			await copyFile(file, join(gitDir, "diffle", "comments.v1.bak"));
-			await writeStoreFile(file, migrateV1(all));
+			if (all.version === 3) return;
+			await copyFile(file, join(gitDir, "diffle", `comments.v${all.version}.bak`));
+			await writeStoreFile(file, upgrade(all));
 		});
 		return new CommentStore(file, modeKey);
 	}
@@ -15985,12 +16098,13 @@ var CommentStore = class CommentStore {
 		});
 	}
 	/**
-	* Adds each import that is not already an open duplicate. Every range is
-	* checked against the snapshot through `quote`; a payload's own `quoted` (the
-	* text the browser showed) is kept once the range is known to exist. Throws
-	* UnquotableError, adding nothing, when any range cannot be read.
+	* Adds each import that is not already an open duplicate. Every anchor is
+	* checked against the snapshot through `source`: a range is quoted (a payload's
+	* own `quoted`, the text the browser showed, is kept once the range is known to
+	* exist) and a file thread's path must be in the review. Throws UnquotableError,
+	* adding nothing, when any anchor cannot be placed.
 	*/
-	importThreads(imports, quote) {
+	importThreads(imports, source) {
 		return this.mutate(async (set) => {
 			const added = [];
 			const pending = [];
@@ -16001,18 +16115,7 @@ var CommentStore = class CommentStore {
 					skipped++;
 					continue;
 				}
-				const side = t.side ?? "new";
-				const startLine = t.startLine;
-				const endLine = t.endLine ?? startLine;
-				const fromSnapshot = await quote(t.path, side, startLine, endLine);
-				if (fromSnapshot == null) throw new UnquotableError(`cannot quote ${t.path}:${startLine}${endLine !== startLine ? `-${endLine}` : ""} on the ${side} side`);
-				const anchor = {
-					path: t.path,
-					side,
-					startLine,
-					endLine,
-					quoted: t.quoted ?? fromSnapshot
-				};
+				const anchor = await placeImport(t, source);
 				pending.push({
 					anchor,
 					t
@@ -16093,17 +16196,18 @@ var CommentStore = class CommentStore {
 		});
 	}
 	/**
-	* Re-anchor every thread against the current review. A thread is stale when
-	* its side is gone, its text is not found, or the relocated range falls
-	* outside what the review shows. Returns true if anything changed.
+	* Re-anchor every thread against the current review. A line thread is stale
+	* when its side is gone, its text is not found, or the relocated range falls
+	* outside what the review shows; a file thread when its file left the review.
+	* Returns true if anything changed.
 	*/
-	async relocateAll(view) {
+	async relocateAll(review) {
 		const cache = /* @__PURE__ */ new Map();
 		const load = (path, side) => {
 			const k = `${side}:${path}`;
 			let p = cache.get(k);
 			if (!p) {
-				p = view(path, side);
+				p = review.side(path, side);
 				cache.set(k, p);
 			}
 			return p;
@@ -16111,6 +16215,14 @@ var CommentStore = class CommentStore {
 		return this.mutate(async (set) => {
 			let changed = false;
 			for (const t of set.threads) {
+				if (t.anchor.kind === "file") {
+					const stale = !review.hasFile(t.anchor.path);
+					if (stale !== t.stale) {
+						t.stale = stale;
+						changed = true;
+					}
+					continue;
+				}
 				const v = await load(t.anchor.path, t.anchor.side);
 				let moved = v == null ? null : relocate(t.anchor, v.contents);
 				if (moved && v?.shown && !isShown(v.shown, moved.startLine, moved.endLine)) moved = null;
@@ -16147,7 +16259,7 @@ var CommentStore = class CommentStore {
 				viewed: []
 			};
 		}
-		return ownSet(parsed.version === 2 ? parsed : migrateV1(parsed), this.key);
+		return ownSet(upgrade(parsed), this.key);
 	}
 	/**
 	* Locked read-modify-write: `fn` edits this key's set as read from disk under
@@ -16157,12 +16269,11 @@ var CommentStore = class CommentStore {
 	*/
 	mutate(fn, changed = () => true) {
 		return withFileLock(this.file, async () => {
-			const onDisk = await readStoreFile(this.file);
-			const all = onDisk.version === 2 ? onDisk : migrateV1(onDisk);
+			const all = upgrade(await readStoreFile(this.file));
 			const set = ownSet(all, this.key);
 			const r = await fn(set);
 			if (changed(r)) await writeStoreFile(this.file, {
-				version: 2,
+				version: 3,
 				sets: {
 					...all.sets,
 					[this.key]: set
@@ -16184,7 +16295,33 @@ function findThread(set, id) {
 	if (!t) throw new NotFoundError(id);
 	return t;
 }
-/** The file as stored, or an empty v2 store when absent. Malformed JSON propagates. */
+/**
+* The anchor an import lands on, checked against the snapshot. Throws
+* UnquotableError for a range that cannot be quoted or a file the review lacks.
+*/
+async function placeImport(t, source) {
+	if (t.startLine == null) {
+		if (!await source.hasFile(t.path)) throw new UnquotableError(`${t.path} is not in the review`);
+		return {
+			kind: "file",
+			path: t.path
+		};
+	}
+	const side = t.side ?? "new";
+	const startLine = t.startLine;
+	const endLine = t.endLine ?? startLine;
+	const fromSnapshot = await source.quote(t.path, side, startLine, endLine);
+	if (fromSnapshot == null) throw new UnquotableError(`cannot quote ${t.path}:${startLine}${endLine !== startLine ? `-${endLine}` : ""} on the ${side} side`);
+	return {
+		kind: "line",
+		path: t.path,
+		side,
+		startLine,
+		endLine,
+		quoted: t.quoted ?? fromSnapshot
+	};
+}
+/** The file as stored, or an empty store when absent. Malformed JSON propagates. */
 async function readStoreFile(file) {
 	try {
 		return parseStoreFile(await readFile(file, "utf8"));
@@ -16192,20 +16329,26 @@ async function readStoreFile(file) {
 		if (e.code !== "ENOENT") throw e;
 	}
 	return {
-		version: 2,
+		version: 3,
 		sets: {}
 	};
 }
-/** Unknown shapes read as an empty v2 store. */
+/** Unknown shapes read as an empty store. */
 function parseStoreFile(text) {
 	const parsed = JSON.parse(text);
+	if (parsed.version === 3 && parsed.sets) return parsed;
 	if (parsed.version === 2 && parsed.sets) return parsed;
 	if (parsed.version === 1 && parsed.sets) return parsed;
 	return {
-		version: 2,
+		version: 3,
 		sets: {}
 	};
 }
+/** Any stored format as the current one. */
+function upgrade(all) {
+	if (all.version === 3) return all;
+	return migrateV2(all.version === 2 ? all : migrateV1(all));
+}
 /** Atomic write. Quoted source lines: owner-only. */
 function writeStoreFile(file, data) {
 	return writeFileAtomic(file, JSON.stringify(data, null, 2), 384);
@@ -16219,6 +16362,24 @@ function newMessage(msg) {
 		updatedAt: now
 	};
 }
+/** Every v2 anchor is a line range; v3 says so. */
+function migrateV2(v2) {
+	const sets = {};
+	for (const [key, set] of Object.entries(v2.sets)) sets[key] = {
+		threads: (set.threads ?? []).map((t) => ({
+			...t,
+			anchor: {
+				kind: "line",
+				...t.anchor
+			}
+		})),
+		viewed: set.viewed ?? []
+	};
+	return {
+		version: 3,
+		sets
+	};
+}
 /** Each v1 comment becomes a single-message, unresolved thread. */
 function migrateV1(v1) {
 	const sets = {};
@@ -16313,12 +16474,22 @@ function createApi(deps) {
 		const query = SearchQuerySchema.parse(c.req.query());
 		const { q, scope } = query;
 		const snap = await session.snapshotter.current();
-		const paths = scope === "repo" ? void 0 : scope === "file" ? snap.tree.filter((p) => p === query.path) : snap.changed.filter((f) => f.status !== "D").map((f) => f.path);
+		let paths = scope === "repo" ? void 0 : scope === "file" ? snap.tree.filter((p) => p === query.path) : snap.changed.filter((f) => f.status !== "D").map((f) => f.path);
+		let ranges;
+		if (query.content === "diff") {
+			const entries = await mapLimit(snap.changed.filter((f) => f.status !== "D" && !f.binary && (!paths || paths.includes(f.path))), 8, async (file) => {
+				const patch = await session.repo.patch(snap.oldSha, snap.newSha, file, snap.context);
+				return [file.path, shownRanges(patch, "new")];
+			});
+			ranges = new Map(entries);
+			paths = entries.filter(([, spans]) => spans.length > 0).map(([path]) => path);
+		}
 		const { matches, truncated } = await session.repo.grep(q, snap.newSha, 500, {
 			word: query.word,
 			ignoreCase: query.i,
 			regex: query.re,
-			paths
+			paths,
+			ranges
 		});
 		const body = {
 			query: q,
@@ -16349,7 +16520,7 @@ function createApi(deps) {
 	});
 	app.post("/api/threads", async (c) => {
 		const imports = parseImports(await readJson(c));
-		const { added } = await session.comments.importThreads(imports, session.quoter());
+		const { added } = await session.comments.importThreads(imports, session.anchorSource());
 		if (added.length) hub.broadcast({ type: "threads" });
 		return c.json(added, 201);
 	});
@@ -16499,10 +16670,11 @@ var Server = class {
 		const app = new Hono();
 		const guard = requestGuard(this.opts.host, void 0, this.opts.allowedOrigin);
 		app.use("/api/*", async (c, next) => {
-			if (!guard({
+			const rejected = guard({
 				host: c.req.header("host"),
 				origin: c.req.header("origin")
-			})) return c.json({ error: "forbidden origin" }, 403);
+			});
+			if (rejected != null) return c.json({ error: rejected }, 403);
 			await next();
 		});
 		app.use("/api/*", async (c, next) => {
@@ -16892,6 +17064,8 @@ function looksGenerated(path, head) {
 //#endregion
 //#region src/server/Snapshotter.ts
 const PREWARM = 3;
+/** The gitattribute GitHub reads to collapse generated files; `=false` opts a file out of the heuristics. */
+const GENERATED_ATTR = "linguist-generated";
 /** Concurrent worktree reads while flagging generated files. */
 const SNIFF_CONCURRENCY = 8;
 /** Sniff verdicts remembered by blob sha; the map is emptied, not evicted, past this. */
@@ -17000,14 +17174,23 @@ var Snapshotter = class {
 		return snap;
 	}
 	/**
-	* Sets `generated` on each non-binary changed file: by path first, then by a
-	* SNIFF_BYTES content sniff. Blobs already classified are not read again;
-	* commit-side blobs go through one `cat-file --batch`, worktree files through
-	* a bounded read each. Never fails the snapshot: a read error means false.
+	* Sets `generated` on each non-binary changed file. A `linguist-generated`
+	* gitattribute on the new side decides outright, as on GitHub; otherwise a
+	* path convention, then a SNIFF_BYTES content sniff. Blobs already sniffed
+	* are not read again; commit-side blobs go through one `cat-file --batch`,
+	* worktree files through a bounded read each. Never fails the snapshot: a
+	* failed attribute lookup or read means the next heuristic, then false.
 	* Submodules have no contents to sniff.
 	*/
 	async fillGenerated(files, newSha) {
-		const sniff = files.filter((f) => f.status !== "D" && !f.binary && !f.submodule).filter((f) => !(f.generated = looksGenerated(f.path, null)));
+		const textual = files.filter((f) => f.status !== "D" && !f.binary && !f.submodule);
+		const marked = await this.repo.attr(GENERATED_ATTR, textual.map((f) => f.path), newSha).catch(() => /* @__PURE__ */ new Map());
+		const sniff = [];
+		for (const f of textual) {
+			const attr = marked.get(f.path);
+			if (attr != null) f.generated = attr;
+			else if (!(f.generated = looksGenerated(f.path, null))) sniff.push(f);
+		}
 		const unknown = [];
 		for (const f of sniff) {
 			const known = f.blob ? this.sniffed.get(f.blob) : void 0;
@@ -17232,21 +17415,24 @@ var Session = class {
 	/**
 	* Re-anchors threads against what `snap` shows. A changed file shows its
 	* hunks; an unchanged tree file shows its new side whole (the file view) and
-	* nothing of its old side.
+	* nothing of its old side. A file thread only needs its file in the review.
 	*/
 	async relocateComments(a, snap) {
-		await a.comments.relocateAll(async (path, side) => {
-			const buf = await this.readSide(snap, path, side);
-			if (buf == null) return null;
-			const contents = buf.toString("utf8");
-			if (!snap.changed.some((f) => f.path === path)) return side === "new" ? {
-				contents,
-				shown: null
-			} : null;
-			return {
-				contents,
-				shown: shownRanges(await a.snapshotter.patch(path) ?? "", side)
-			};
+		await a.comments.relocateAll({
+			side: async (path, side) => {
+				const buf = await this.readSide(snap, path, side);
+				if (buf == null) return null;
+				const contents = buf.toString("utf8");
+				if (!snap.changed.some((f) => f.path === path)) return side === "new" ? {
+					contents,
+					shown: null
+				} : null;
+				return {
+					contents,
+					shown: shownRanges(await a.snapshotter.patch(path) ?? "", side)
+				};
+			},
+			hasFile: (path) => this.hasFile(snap, path)
 		});
 	}
 	/**
@@ -17265,15 +17451,24 @@ var Session = class {
 	hasSide(snap, path, side) {
 		return sidePath(this.readablePaths(snap), path, side) != null;
 	}
+	/** Whether `path` is a file of the review: a changed file (by its new path) or a tree path. A rename's old path is not. */
+	hasFile(snap, path) {
+		const r = this.readablePaths(snap);
+		return r.tree.has(path) || r.changed.has(path);
+	}
 	/**
-	* Quotes a line range from the current snapshot, for imports that carry no
-	* `quoted`. Goes through `readSide`, so the allowlist applies.
+	* Places imported anchors against the current snapshot: quotes a line range for
+	* imports that carry no `quoted`, and says whether a file thread's file is in the
+	* review. Goes through `readSide`, so the allowlist applies.
 	*/
-	quoter() {
-		return async (path, side, startLine, endLine) => {
-			const snap = await this.snapshotter.current();
-			const buf = await this.readSide(snap, path, side);
-			return buf == null ? null : quoteRange(buf.toString("utf8"), startLine, endLine);
+	anchorSource() {
+		return {
+			quote: async (path, side, startLine, endLine) => {
+				const snap = await this.snapshotter.current();
+				const buf = await this.readSide(snap, path, side);
+				return buf == null ? null : quoteRange(buf.toString("utf8"), startLine, endLine);
+			},
+			hasFile: async (path) => this.hasFile(await this.snapshotter.current(), path)
 		};
 	}
 	readablePaths(snap) {
@@ -17325,7 +17520,7 @@ var Session = class {
 	}
 };
 async function defaultWatcherFactory() {
-	const { Watcher } = await import("./Watcher-C_X03LRa.js");
+	const { Watcher } = await import("./Watcher-CKwvGuPB.js");
 	return (target) => new Watcher(target);
 }
 function readablePaths(snap) {
@@ -21013,14 +21208,16 @@ var WsHub = class {
 		maxPayload: MAX_PAYLOAD_BYTES
 	});
 	clientListeners = /* @__PURE__ */ new Set();
-	attach(server, guard = () => true) {
+	attach(server, guard = () => null) {
 		server.on("upgrade", (req, socket, head) => {
 			if (new URL(req.url ?? "/", "http://localhost").pathname !== "/ws") return;
-			if (!guard({
+			const rejected = guard({
 				host: req.headers.host,
 				origin: req.headers.origin
-			})) {
-				socket.destroy();
+			});
+			if (rejected != null) {
+				socket.once("finish", () => socket.destroy());
+				socket.end(`HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\n${rejected}\n`);
 				return;
 			}
 			this.wss.handleUpgrade(req, socket, head, (ws) => {
@@ -21260,11 +21457,12 @@ Revisions follow git diff, except that a lone one compares from the merge base:
   diffle main...feat       what feat added since it left main
   diffle main..worktree    main vs the uncommitted tree ("worktree" works on either side)
 
+Without revisions, diffle compares HEAD..worktree.
+
 Status goes to stderr, so stdout carries only the review: unless --keep-alive is set,
 closing the last auto-opened browser tab stops diffle and prints the open comments as a prompt for an agent.
 Ctrl+C always stops it.`).action(async (revs, _o, cmd) => {
-	if (revs.length === 0) cmd.help();
-	await run({
+	await run(revs.length === 0 ? { kind: "working" } : {
 		kind: "revspec",
 		args: revs
 	}, cmd.optsWithGlobals());