@youtyan/code-viewer 0.1.10 → 0.1.12

package/web/shiki.js

@@ -13178,5 +13178,6 @@ var createHighlighter = /* @__PURE__ */ createBundledHighlighter({
   engine: () => (0, engine_oniguruma_exports.createOnigurumaEngine)(Promise.resolve().then(() => (init_wasm2(), exports_wasm2)))
 });
 export {
-  createHighlighter
+  createHighlighter,
+  bundledLanguages
 };

package/web/style.css

@@ -29,6 +29,8 @@
   --danger:         #cf222e;
   --danger-emph:    #cf222e;
   --attn:           #9a6700;
+  --line-hit-bg:    #fff8c5;
+  --line-hit-border:var(--accent);
   --done:           #8250df;
   /* diff colors (GitHub exact) */
   --diff-add-bg:        #dafbe1;
@@ -74,6 +76,8 @@
   --danger:         #f85149;
   --danger-emph:    #da3633;
   --attn:           #d29922;
+  --line-hit-bg:    rgba(187,128,9,0.18);
+  --line-hit-border:var(--accent);
   --done:           #a371f7;
   --diff-add-bg:        rgba(46,160,67,0.15);
   --diff-add-num-bg:    rgba(46,160,67,0.30);
@@ -106,6 +110,140 @@ html, body {
 /* Window scrolls; global header + topbar + sidebar are fixed */
 #app { display: block; }
 
+.gdp-palette-backdrop {
+  position: fixed;
+  inset: 0;
+  z-index: 500;
+  background: rgba(31, 35, 40, 0.18);
+  display: flex;
+  align-items: flex-start;
+  justify-content: center;
+  padding-top: min(12vh, 96px);
+}
+
+[data-theme="dark"] .gdp-palette-backdrop {
+  background: rgba(1, 4, 9, 0.45);
+}
+
+.gdp-palette {
+  width: min(760px, calc(100vw - 32px));
+  max-height: min(620px, calc(100vh - 48px));
+  display: grid;
+  grid-template-rows: auto auto auto auto 1fr;
+  overflow: hidden;
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  box-shadow: 0 16px 48px rgba(31, 35, 40, 0.28);
+}
+
+.gdp-palette-label {
+  padding: 12px 16px 0;
+  color: var(--fg-muted);
+  font-size: 12px;
+  font-weight: 600;
+  text-transform: uppercase;
+}
+
+.gdp-palette-input {
+  width: 100%;
+  border: 0;
+  border-bottom: 1px solid var(--border);
+  padding: 10px 16px 14px;
+  background: transparent;
+  color: var(--fg);
+  font-size: 24px;
+  line-height: 1.25;
+  outline: none;
+}
+
+.gdp-palette-status {
+  min-height: 28px;
+  padding: 6px 16px;
+  color: var(--fg-muted);
+  font-size: 12px;
+  border-bottom: 1px solid var(--border-muted);
+}
+
+.gdp-palette-controls {
+  min-height: 34px;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 6px 16px 0;
+}
+
+.gdp-palette-mode-button {
+  height: 24px;
+  padding: 0 8px;
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  background: var(--bg);
+  color: var(--fg-muted);
+  font-size: 12px;
+  font-weight: 600;
+  cursor: pointer;
+}
+
+.gdp-palette-mode-button[aria-pressed="true"] {
+  border-color: var(--accent);
+  background: var(--accent-subtle);
+  color: var(--accent);
+}
+
+.gdp-palette-mode-hint {
+  color: var(--fg-muted);
+  font-size: 12px;
+}
+
+.gdp-palette-list {
+  overflow: auto;
+  padding: 6px;
+}
+
+.gdp-palette-row {
+  width: 100%;
+  min-height: 52px;
+  display: grid;
+  grid-template-rows: auto auto;
+  gap: 2px;
+  padding: 8px 10px;
+  border: 0;
+  border-radius: 6px;
+  background: transparent;
+  color: var(--fg);
+  text-align: left;
+  cursor: pointer;
+}
+
+.gdp-palette-row[aria-selected="true"] {
+  background: var(--accent-subtle);
+}
+
+.gdp-palette-row-title {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  font-size: 14px;
+  font-weight: 600;
+}
+
+.gdp-palette-row-detail {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  color: var(--fg-muted);
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 12px;
+}
+
+.gdp-palette-row-detail mark {
+  background: var(--attn);
+  color: var(--fg-onemphasis);
+  border-radius: 2px;
+  padding: 0 1px;
+}
+
 /* ===== Global header ===== */
 #global-header {
   position: fixed;
@@ -1286,6 +1424,17 @@ table.d2h-diff-table .d2h-code-line-prefix {
   width: 1.5em;
   padding-left: 4px;
 }
+
+table.d2h-diff-table tr.gdp-diff-line-target > td,
+table.d2h-diff-table tr.gdp-diff-line-target .d2h-code-line,
+table.d2h-diff-table tr.gdp-diff-line-target .d2h-code-side-line,
+table.d2h-diff-table tr.gdp-diff-line-target .d2h-code-line-ctn {
+  background: var(--line-hit-bg) !important;
+  background-color: var(--line-hit-bg) !important;
+}
+table.d2h-diff-table tr.gdp-diff-line-target > td:first-child {
+  box-shadow: inset 3px 0 0 var(--line-hit-border), inset -1px 0 0 var(--border-muted);
+}
 /* Stack height = number of buttons * 20px. With 1 button = 20px row,
  * with 2 (↑+↓) = 40px row, matching GitHub. */
 .gdp-expand-stack {
@@ -1602,6 +1751,33 @@ table.d2h-diff-table .d2h-code-line-prefix {
   font-size: 12px;
   line-height: 20px;
 }
+.gdp-source-table tr.gdp-source-line-target {
+  background: var(--line-hit-bg);
+}
+.gdp-source-table tr.gdp-source-line-target .gdp-source-line-number,
+.gdp-source-table tr.gdp-source-line-target .gdp-source-line-code,
+.gdp-source-virtual-row.gdp-source-line-target {
+  background: var(--line-hit-bg) !important;
+  background-color: var(--line-hit-bg) !important;
+}
+.gdp-source-table tr.gdp-source-line-target > td.gdp-source-line-number,
+.gdp-source-virtual-row.gdp-source-line-target > .gdp-source-virtual-line-number {
+  background: var(--line-hit-bg) !important;
+  background-color: var(--line-hit-bg) !important;
+}
+.gdp-source-table tr.gdp-source-line-target .gdp-source-line-number,
+.gdp-source-virtual-row.gdp-source-line-target .gdp-source-virtual-line-number {
+  box-shadow: inset 3px 0 0 var(--line-hit-border), inset -1px 0 0 var(--border-muted);
+}
+.gdp-source-line-target .gdp-source-line-code,
+.gdp-source-line-target .gdp-source-virtual-line-code {
+  background: var(--line-hit-bg) !important;
+  background-color: var(--line-hit-bg) !important;
+}
+.gdp-source-line-target .gdp-source-line-code.shiki span,
+.gdp-source-line-target .gdp-source-virtual-line-code.hljs span {
+  background: transparent !important;
+}
 .gdp-standalone-source .gdp-source-table {
   display: block;
   overflow: auto;
@@ -1660,6 +1836,19 @@ table.d2h-diff-table .d2h-code-line-prefix {
 .gdp-source-line-code.hljs {
   background: var(--bg);
 }
+.gdp-source-line-target .gdp-source-line-code.hljs,
+.gdp-source-line-target .gdp-source-line-code.shiki,
+.gdp-source-line-target .gdp-source-virtual-line-code.hljs {
+  background: var(--line-hit-bg);
+}
+.gdp-source-line-code.shiki,
+.gdp-source-line-code.shiki span {
+  color: var(--shiki-light) !important;
+}
+[data-theme="dark"] .gdp-source-line-code.shiki,
+[data-theme="dark"] .gdp-source-line-code.shiki span {
+  color: var(--shiki-dark) !important;
+}
 .gdp-source-virtual {
   display: grid;
   grid-template-rows: auto minmax(0, 1fr);
@@ -1725,6 +1914,8 @@ table.d2h-diff-table .d2h-code-line-prefix {
   font-family: "Monaspace Neon", ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, "Liberation Mono", monospace;
   font-size: 12px;
   line-height: 20px;
+  cursor: pointer;
+  user-select: none;
 }
 .gdp-source-virtual-spacer {
   position: relative;
@@ -1752,6 +1943,7 @@ table.d2h-diff-table .d2h-code-line-prefix {
   background: var(--bg);
   box-shadow: inset -1px 0 0 var(--border-muted);
   font-variant-numeric: tabular-nums;
+  cursor: pointer;
   user-select: none;
 }
 .gdp-source-virtual-line-code {

package/web-src/routes.ts

@@ -3,6 +3,13 @@ export type DiffRange = {
   to: string;
 };
 
+export type SourceLineRange = {
+  start: number;
+  end: number;
+};
+
+export type SourceLineTarget = number | SourceLineRange;
+
 export type SourceFileTarget = {
   path: string;
   ref: string;
@@ -10,8 +17,8 @@ export type SourceFileTarget = {
 
 export type AppRoute =
   | { screen: 'repo'; ref: string; path: string; range: DiffRange }
-  | { screen: 'diff'; range: DiffRange }
-  | { screen: 'file'; path: string; ref: string; range: DiffRange; view?: 'blob' | 'detail' }
+  | { screen: 'diff'; range: DiffRange; path?: string; line?: SourceLineTarget }
+  | { screen: 'file'; path: string; ref: string; range: DiffRange; view?: 'blob' | 'detail'; line?: SourceLineTarget }
   | { screen: 'unknown'; reason: 'unknown-pathname' | 'missing-path'; rawPathname: string; rawSearch: string; range: DiffRange };
 
 export const SPA_PATHS = ['/todif', '/todiff', '/file'] as const;
@@ -31,6 +38,25 @@ function parseLegacyRange(value: string | null | undefined, fallback: DiffRange)
   };
 }
 
+function parseLineTarget(value: string | null | undefined): SourceLineTarget | undefined {
+  const raw = value || '';
+  const range = /^(\d+)-(\d+)$/.exec(raw);
+  if (range) {
+    const a = Number(range[1]);
+    const b = Number(range[2]);
+    const start = Math.min(a, b);
+    const end = Math.max(a, b);
+    if (start > 0) return { start, end };
+    return undefined;
+  }
+  const line = Number(raw);
+  return Number.isInteger(line) && line > 0 ? line : undefined;
+}
+
+function formatLineTarget(line: SourceLineTarget): string {
+  return typeof line === 'number' ? String(line) : line.start + '-' + line.end;
+}
+
 export function parseRoute(pathname: string, search: string, fallbackRange: DiffRange): AppRoute {
   const params = new URLSearchParams(search);
   const legacyRange = parseLegacyRange(params.get('range'), fallbackRange);
@@ -49,13 +75,19 @@ export function parseRoute(pathname: string, search: string, fallbackRange: Diff
       };
     case '/todif':
     case '/todiff':
-      return { screen: 'diff', range };
+      return {
+        screen: 'diff',
+        range,
+        ...(params.get('path') ? { path: params.get('path') || '' } : {}),
+        ...(parseLineTarget(params.get('line')) ? { line: parseLineTarget(params.get('line')) } : {}),
+      };
     case '/file': {
       const path = params.get('path') || '';
       const target = params.get('target') || '';
       const ref = target || params.get('ref') || 'worktree';
+      const line = parseLineTarget(params.get('line'));
       if (!path) return { screen: 'unknown', reason: 'missing-path', rawPathname: pathname, rawSearch: search, range };
-      return { screen: 'file', path, ref, range, view: target ? 'blob' : 'detail' };
+      return { screen: 'file', path, ref, range, view: target ? 'blob' : 'detail', ...(line ? { line } : {}) };
     }
     default:
       return { screen: 'unknown', reason: 'unknown-pathname', rawPathname: pathname, rawSearch: search, range };
@@ -74,15 +106,19 @@ export function buildRoute(route: AppRoute): string {
     case 'file':
       if (route.view === 'blob') {
         return '/file?path=' + encodeURIComponent(route.path) +
-          '&target=' + encodeURIComponent(route.ref || 'worktree');
+          '&target=' + encodeURIComponent(route.ref || 'worktree') +
+          (route.line ? '&line=' + encodeURIComponent(formatLineTarget(route.line)) : '');
       }
       return '/file?path=' + encodeURIComponent(route.path) +
         '&ref=' + encodeURIComponent(route.ref || 'worktree') +
         '&from=' + encodeURIComponent(route.range.from || '') +
-        '&to=' + encodeURIComponent(route.range.to || 'worktree');
+        '&to=' + encodeURIComponent(route.range.to || 'worktree') +
+        (route.line ? '&line=' + encodeURIComponent(formatLineTarget(route.line)) : '');
     case 'diff':
       return '/todif?from=' + encodeURIComponent(route.range.from || '') +
-        '&to=' + encodeURIComponent(route.range.to || 'worktree');
+        '&to=' + encodeURIComponent(route.range.to || 'worktree') +
+        (route.path ? '&path=' + encodeURIComponent(route.path) : '') +
+        (route.line ? '&line=' + encodeURIComponent(formatLineTarget(route.line)) : '');
     case 'unknown':
       return '/todif?from=' + encodeURIComponent(route.range.from || '') +
         '&to=' + encodeURIComponent(route.range.to || 'worktree');

package/web-src/server/cache.ts

@@ -1,6 +1,10 @@
+import { lstatSync } from 'node:fs';
+import { join } from 'node:path';
+
 // Short enough that a browser reload self-heals stale git data, while still
 // coalescing bursts from one render pass.
 export const CACHE_TTL_MS = 1500;
+export const MAX_TIMED_CACHE_ENTRIES = 200;
 
 export type TimedCacheEntry<T> = T & { storedAt: number };
 
@@ -11,3 +15,50 @@ export function cacheFresh<T>(
 ): cached is TimedCacheEntry<T> {
   return !!cached && now - cached.storedAt <= ttlMs;
 }
+
+export function setTimedCacheEntry<T>(
+  cache: Map<string, TimedCacheEntry<T>>,
+  key: string,
+  value: T,
+  now = Date.now(),
+  maxEntries = MAX_TIMED_CACHE_ENTRIES,
+): void {
+  cache.set(key, { ...value, storedAt: now });
+  while (cache.size > maxEntries) {
+    const oldest = cache.keys().next().value;
+    if (oldest === undefined) break;
+    cache.delete(oldest);
+  }
+}
+
+export function worktreeFileSignature(path: string, cwd: string): string {
+  try {
+    const stats = lstatSync(join(cwd, path));
+    const inode = 'ino' in stats ? stats.ino : 0;
+    return `state:file|size:${stats.size}|mtime:${stats.mtimeMs}|ctime:${stats.ctimeMs}|ino:${inode}`;
+  } catch {
+    return 'state:missing';
+  }
+}
+
+export function fileDiffCacheKey(options: {
+  path: string;
+  oldPath?: string | null;
+  isUntracked: boolean;
+  range: { from?: string; to?: string };
+  extras: string[];
+  args: string[];
+  cwd: string;
+}): string {
+  const worktreeTarget = options.range.from === 'worktree' || !options.range.to || options.range.to === 'worktree';
+  if (options.isUntracked && !worktreeTarget) {
+    throw new Error('untracked file diffs require a worktree range');
+  }
+  const signature = worktreeTarget
+    ? `\0${worktreeFileSignature(options.path, options.cwd)}`
+    : '';
+  if (options.isUntracked) {
+    return `u\0${options.path}${signature}\0${options.extras.join('\0')}`;
+  }
+  return `t\0${options.path}\0${options.oldPath || ''}${signature}\0${[...options.extras, ...options.args].join('\0')}`;
+}

package/web-src/server/preview.ts

@@ -1,13 +1,23 @@
 #!/usr/bin/env bun
 
-import { closeSync, constants, existsSync, openSync, readFileSync, realpathSync, statSync, unlinkSync, watch, writeFileSync } from 'node:fs';
+import { closeSync, constants, existsSync, lstatSync, openSync, readFileSync, realpathSync, statSync, unlinkSync, watch, writeFileSync } from 'node:fs';
 import { basename, dirname, extname, join, normalize, relative } from 'node:path';
 import { APP_ENTRY_PATHS, SPA_PATHS } from '../routes';
-import type { DiffMeta, FileDiffResponse, FileMeta, FileRangeResponse, RepoTreeResponse } from '../types';
-import { cacheFresh, type TimedCacheEntry } from './cache';
+import type { DiffMeta, FileDiffResponse, FileMeta, FileRangeResponse, FileSearchListResponse, GrepMatch, GrepResponse, RepoTreeResponse } from '../types';
+import { cacheFresh, fileDiffCacheKey, setTimedCacheEntry, type TimedCacheEntry } from './cache';
 import { startDevAssetReload } from './dev-assets';
 import * as git from './git';
 import { isSameWorktreeRange } from './range';
+import {
+  GREP_MAX_FILE_BYTES,
+  buildFileSearchList,
+  buildRgArgs,
+  fixedStringLineMatches,
+  isSkippableSearchPath,
+  normalizeGrepMax,
+  parseGitGrepOutput,
+  parseRgOutput,
+} from './search';
 
 const ROOT = normalize(join(import.meta.dir, '..', '..'));
 const WEB_ROOT = join(ROOT, 'web');
@@ -35,11 +45,13 @@ let cliArgs = DEFAULT_ARGS;
 let listenPort = 0;
 let allowUpload = false;
 let uploadAllowedByCli = false;
+let rgAvailableCache: boolean | null = null;
 
 const enc = new TextEncoder();
 const sseClients = new Set<ReadableStreamDefaultController<Uint8Array>>();
 const fileCache = new Map<string, TimedCacheEntry<{ diffText: string }>>();
 const metaCache = new Map<string, TimedCacheEntry<{ body: string; sig: string }>>();
+const fileListCache = new Map<string, { generation: number; body: FileSearchListResponse }>();
 
 function parseCli() {
   const rest: string[] = [];
@@ -273,14 +285,14 @@ function handleDiffJson(url: URL) {
       fileCache.clear();
     }
     const body = JSON.stringify(payload);
-    metaCache.set(key, { body, sig, storedAt: Date.now() });
+    setTimedCacheEntry(metaCache, key, { body, sig });
     return new Response(body, { headers: { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' } });
   }
   const cached = metaCache.get(key);
   if (cacheFresh(cached)) return new Response(cached.body, { headers: { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' } });
   const payload = computePayload(extras, range);
   const body = JSON.stringify(payload);
-  metaCache.set(key, { body, sig: JSON.stringify({ ...payload, generation: undefined }), storedAt: Date.now() });
+  setTimedCacheEntry(metaCache, key, { body, sig: JSON.stringify({ ...payload, generation: undefined }) });
   return new Response(body, { headers: { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' } });
 }
 
@@ -395,6 +407,98 @@ function handleTree(url: URL) {
   } satisfies RepoTreeResponse);
 }
 
+function handleFiles(url: URL) {
+  const target = url.searchParams.get('ref') || url.searchParams.get('target') || 'worktree';
+  if (target !== 'worktree' && !git.verifyTreeRef(target, cwd)) return text('invalid target', 400);
+  const key = target || 'worktree';
+  const cached = fileListCache.get(key);
+  if (cached && cached.generation === generation) return json(cached.body);
+  const entries = git.listTree(key, '', cwd, { recursive: true }).entries;
+  const body = buildFileSearchList(key, generation, entries);
+  fileListCache.set(key, { generation, body });
+  return json(body);
+}
+
+function parseGrepPaths(url: URL): string[] {
+  return url.searchParams.getAll('path').filter(path => safePath(path) && !isGitInternalPath(path));
+}
+
+function rgAvailable(): boolean {
+  if (rgAvailableCache !== null) return rgAvailableCache;
+  const proc = Bun.spawnSync(['rg', '--version'], { cwd, stdout: 'pipe', stderr: 'pipe' });
+  rgAvailableCache = proc.exitCode === 0;
+  return rgAvailableCache;
+}
+
+function grepWorktreeFallback(query: string, max: number, paths: string[]): GrepMatch[] {
+  const candidates = paths.length ? paths : git.worktreeFiles(cwd).map(entry => entry.path);
+  const matches: GrepMatch[] = [];
+  for (const path of candidates) {
+    if (matches.length >= max) break;
+    if (!safePath(path) || isGitInternalPath(path) || isSkippableSearchPath(path)) continue;
+    const full = safeWorktreePath(path);
+    if (!full) continue;
+    let stat;
+    try {
+      stat = lstatSync(full);
+    } catch {
+      continue;
+    }
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > GREP_MAX_FILE_BYTES) continue;
+    let data: Buffer;
+    try {
+      data = readFileSync(full);
+    } catch {
+      continue;
+    }
+    if (data.subarray(0, 8192).includes(0)) continue;
+    matches.push(...fixedStringLineMatches(path, data.toString('utf8'), query, max - matches.length));
+  }
+  return matches;
+}
+
+function grepWorktree(query: string, max: number, paths: string[], regex: boolean): GrepResponse {
+  if (rgAvailable()) {
+    const safePaths = paths.filter(path => safePath(path) && !isGitInternalPath(path) && safeWorktreePath(path));
+    const args = buildRgArgs(query, max, safePaths, regex);
+    const proc = Bun.spawnSync(args, { cwd, stdout: 'pipe', stderr: 'pipe', stdin: 'ignore', timeout: 5000, killSignal: 'SIGKILL' });
+    const stdout = new TextDecoder().decode(proc.stdout);
+    const matches = parseRgOutput(stdout, max)
+      .filter(match => safePath(match.path) && !isGitInternalPath(match.path) && !!safeWorktreePath(match.path));
+    return { ref: 'worktree', engine: 'rg', truncated: matches.length >= max, matches };
+  }
+  if (regex) return { ref: 'worktree', engine: 'fallback', truncated: false, matches: [] };
+  const matches = grepWorktreeFallback(query, max, paths);
+  return { ref: 'worktree', engine: 'fallback', truncated: matches.length >= max, matches };
+}
+
+function grepTreeRef(ref: string, query: string, max: number, paths: string[], regex: boolean): GrepResponse {
+  const safePaths = paths.filter(path => safePath(path) && !isGitInternalPath(path));
+  const args = [
+    'git', '-c', 'core.quotepath=false', 'grep',
+    '-n', '--column', '-i', regex ? '-E' : '-F', '--no-color',
+    '-e', query,
+    ref, '--',
+    ...safePaths,
+  ];
+  const proc = Bun.spawnSync(args, { cwd, stdout: 'pipe', stderr: 'pipe', stdin: 'ignore', timeout: 5000, killSignal: 'SIGKILL' });
+  const stdout = new TextDecoder().decode(proc.stdout);
+  const matches = parseGitGrepOutput(stdout, ref, max).slice(0, max);
+  return { ref, engine: 'git', truncated: matches.length >= max, matches };
+}
+
+function handleGrep(url: URL) {
+  const query = url.searchParams.get('q') || '';
+  const ref = url.searchParams.get('ref') || 'worktree';
+  const max = normalizeGrepMax(url.searchParams.get('max'));
+  const paths = parseGrepPaths(url);
+  const regex = url.searchParams.get('regex') === '1';
+  if (!query.trim()) return json({ ref, engine: ref === 'worktree' ? 'fallback' : 'git', truncated: false, matches: [] } satisfies GrepResponse);
+  if (ref === 'worktree' || ref === '') return json(grepWorktree(query, max, paths, regex));
+  if (!git.verifyTreeRef(ref, cwd)) return text('invalid target', 400);
+  return json(grepTreeRef(ref, query, max, paths, regex));
+}
+
 function handleFileDiff(url: URL) {
   const path = url.searchParams.get('path') || '';
   if (!safePath(path)) return text('invalid path', 400);
@@ -420,9 +524,12 @@ function handleFileDiff(url: URL) {
   }
   const { args } = buildRangeArgs(range);
   const oldPath = url.searchParams.get('old_path');
-  const cacheKey = isUntracked
-    ? `u\0${path}\0${extras.join('\0')}`
-    : `t\0${path}\0${oldPath || ''}\0${[...extras, ...args].join('\0')}`;
+  let cacheKey: string;
+  try {
+    cacheKey = fileDiffCacheKey({ path, oldPath, isUntracked, range, extras, args, cwd });
+  } catch {
+    return text('invalid diff range', 400);
+  }
   const cached = fileCache.get(cacheKey);
   let diffText: string;
   let errText = '';
@@ -436,7 +543,7 @@ function handleFileDiff(url: URL) {
       diffText = res.stdout || '';
       if (res.code !== 0) errText = res.stderr;
     }
-    fileCache.set(cacheKey, { diffText, storedAt: Date.now() });
+    setTimedCacheEntry(fileCache, cacheKey, { diffText });
   }
   const mode = url.searchParams.get('mode') || 'full';
   const truncated = mode === 'preview'
@@ -736,6 +843,8 @@ const server = Bun.serve({
     if (staticResponse) return staticResponse;
     if (url.pathname === '/diff.json') return handleDiffJson(url);
     if (url.pathname === '/_tree') return handleTree(url);
+    if (url.pathname === '/_files') return handleFiles(url);
+    if (url.pathname === '/_grep') return handleGrep(url);
     if (url.pathname === '/file_diff') return handleFileDiff(url);
     if (url.pathname === '/file_range') return handleFileRange(url);
     if (url.pathname === '/_file') return handleRawFile(req, url);
@@ -747,6 +856,7 @@ const server = Bun.serve({
       generation++;
       fileCache.clear();
       metaCache.clear();
+      fileListCache.clear();
       sendSse('update');
       return json({ ok: true, generation });
     }