diffing 0.10.5 → 0.12.0

package/dist/{server-C9i4V36o.mjs → server-Dw3lkQ5q.mjs}

@@ -1,8 +1,10 @@
-import { C as isSafePath, S as revertHunk, _ as getUntrackedFilePathsAsync, a as getCustomGitDiffAsync, b as listRepoFiles, c as getGitDiffAsync, d as getProjectStorageDir, f as getRepoName, g as getTabSizeForFiles, h as getShowDiff, i as getCommitSeriesSummary, l as getHunkHistory, o as getFileContent, p as getRepoRoot, r as getBranchName, u as getMergeStatus, v as gitAddFile, w as toSafeRelativePath, y as isGitRepo } from "./git-Czo96ymM.mjs";
-import { a as searchContent, c as trackSelection, i as searchAll, n as saveSettings, o as searchFiles, r as getSearchStatus, s as searchSymbols, t as loadSettings } from "./settings-bwe7yQ8U.mjs";
-import { t as formatComments } from "./comment-format-B5AcGcR-.mjs";
-import { n as formatPlanReview, r as sectionTitleForLine, t as extractPlanLines } from "./plan-format-BQyx--mp.mjs";
-import { D as updatePrReviewComment, E as submitReview, S as refreshPrSession, T as setPrReviewThreadResolved, a as detectCwdRepo, b as parsePrRef, f as fetchPrFileContentViaGh, i as deletePrReviewComment, l as fetchExistingCommentsViaGh, t as buildPrSession, u as fetchExistingReviewsViaGh, w as resolvedFromSession } from "./github-CEjtGd41.mjs";
+import { C as listRepoFiles, D as toSafeRelativePath, E as isSafePath, S as isGitRepo, T as revertHunk, _ as getShowDiff, a as getCommitSeriesSummary, b as getUntrackedFilePathsAsync, d as getMergeStatus, f as getProjectStorageDir, h as getRepoRoot, l as getGitDiffAsync, m as getRepoMetadataAsync, o as getCustomGitDiffAsync, s as getFileContent, u as getHunkHistory, x as gitAddFile, y as getTabSizeForFilesAsync } from "./git-BGj31GX-.mjs";
+import { a as searchFiles, i as searchContent, o as searchSymbols, r as searchAll, s as trackSelection, t as getSearchStatus } from "./search-3R2E5xxr.mjs";
+import { a as loadSettings, o as saveSettings } from "./session-url-sr7lXXVc.mjs";
+import { t as formatComments } from "./comment-format-B85NHZnG.mjs";
+import { n as formatPlanReview, r as sectionTitleForLine, t as extractPlanLines } from "./plan-format-BwJh5JSE.mjs";
+import { _ as buildSessionTokenSetCookieValue, b as injectSessionTokenIntoHtml, v as createServerAuthMiddleware } from "./server-lock-BNI8FKV1.mjs";
+import { D as updatePrReviewComment, E as submitReview, S as refreshPrSession, T as setPrReviewThreadResolved, a as detectCwdRepo, b as parsePrRef, f as fetchPrFileContentViaGh, i as deletePrReviewComment, l as fetchExistingCommentsViaGh, t as buildPrSession, u as fetchExistingReviewsViaGh, w as resolvedFromSession } from "./github-DpzqNrUh.mjs";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
@@ -34,6 +36,7 @@ const DEFAULTS = {
 	pickaxeAll: false,
 	exitCode: false,
 	quiet: false,
+	suppressPatch: false,
 	noPrefix: false,
 	binary: false,
 	fullIndex: false,
@@ -51,6 +54,7 @@ const DEFAULTS = {
 	outputMode: "auto",
 	host: "127.0.0.1",
 	noOpen: false,
+	insecureNoAuth: false,
 	reuseSession: false,
 	replaceSession: false,
 	help: false,
@@ -58,6 +62,7 @@ const DEFAULTS = {
 	includeUnstaged: true,
 	includeUntracked: true,
 	tui: false,
+	viewOnly: false,
 	gpu: false,
 	showMode: false,
 	showRevspecs: []
@@ -181,6 +186,10 @@ const DIFFING_OPTIONS = {
 		type: "boolean",
 		default: false
 	},
+	"insecure-no-auth": {
+		type: "boolean",
+		default: false
+	},
 	"reuse-session": {
 		type: "boolean",
 		default: false
@@ -201,6 +210,10 @@ const DIFFING_OPTIONS = {
 		type: "boolean",
 		default: false
 	},
+	view: {
+		type: "boolean",
+		default: false
+	},
 	gpu: {
 		type: "boolean",
 		default: false
@@ -226,6 +239,7 @@ function printHelp() {
 
 Usage: diffing [<git diff options>] [<revision>...] [-- <path>...]
        diffing --web [<git diff options>] [<revision>...] [-- <path>...]
+       diffing view [<git diff options>] [<revision>...] [-- <path>...]
        diffing [server options]
 
 Git Diff Options (drop-in replacement for git diff):`);
@@ -233,26 +247,33 @@ Git Diff Options (drop-in replacement for git diff):`);
 	console.log(`
 Diffing Server Options:
   --port <port>        Port to run the server on (default: random available port)
-  --host <host>        Host address to bind to (default: 127.0.0.1). Pass
-                       0.0.0.0 to expose the server to the local network.
+  --host <host>        Host address to bind to (default: 127.0.0.1). Loopback
+                       binds require a per-session API token. To expose the
+                       review UI on your LAN, pass 0.0.0.0 together with
+                       --insecure-no-auth (disables API authentication).
+  --insecure-no-auth   Allow binding to 0.0.0.0 without API tokens (unsafe on
+                       shared networks). Ignored on loopback binds.
   --no-open            Don't open the browser automatically
-  --reuse-session      If a review is already running, open it instead of prompting
-  --replace-session    If a review is already running, stop it and start a new one
+  --reuse-session      Open the active review instead of starting another
+  --replace-session    Stop the active review and start a replacement
   --gh-pr <ref>        Open a GitHub PR review session (number, owner/repo#N, or URL)
                        Same as: diffing "gh pr <ref>"
 
 Output Modes:
   By default diffing auto-selects the best output mode:
   - Terminal mode: when output is a pipe, redirect, or non-TTY
-  - Web mode:     when output is a TTY (interactive terminal)
+  - Web or TUI:   saved preference for an interactive terminal (web by default)
 
-  Force a mode with --web, --terminal, or --tui flags.
+  Force a mode with --web, --terminal, --tui, or --view flags.
+  Change the interactive default with: diffing mode <web|tui>
+  --view opens a focused, read-only diff browser with fff-powered search.
   --tui is experimental and opt-in. It opens a native-Rust terminal
   interface that mirrors the web dashboard. Falls back to git diff
   output if the environment cannot support a TUI (piped stdin, CI,
   missing binary).
 
 Subcommands:
+  view [diff options]    Browse diffs in the focused read-only native TUI
   show <revspec>...    Drop-in for 'git show'. Renders commit metadata
                        above the diff. Accepts commits, ranges, tags.
   await-review         Block until human clicks Send to agent; print XML
@@ -262,11 +283,13 @@ Subcommands:
   comment edit|delete <id>
   progress --message … Live agent progress toast
   url                  Print the active review base URL
+  sessions             List, select, open, and stop running review sessions
   plan <submit|await|list|show|versions|reply|resolve>
   gh <status|overview|threads|reviews|pr-fetch|pr-list-comments|pr-review>
   mcp [--repo PATH]    Stdio MCP server for agents
   inspect <summary|files|hunks|slice|search>
                        Bounded reads from a running web, TUI, or PR session
+  mode [web|tui]       Get or set the default interactive review mode
   doctor               Environment self-check
   completion <bash|zsh|fish>
   update               Check for a newer npm release
@@ -275,7 +298,7 @@ Custom ranges (e.g. main..feature) and 'gh pr' sessions also display a
 "what is this diff" banner in the web UI summarising the diff source.
 
 Examples:
-  diffing                        Review uncommitted changes (web UI)
+  diffing                        Review uncommitted changes (preferred UI)
   diffing --staged               Review staged changes
   diffing HEAD~3                 Review last 3 commits
   diffing main..feature          Compare branches
@@ -287,8 +310,13 @@ Examples:
   diffing -U10                   Diff with 10 context lines
   diffing --word-diff=color      Word-level diff in color
   diffing -b -w                  Ignore whitespace changes
-  diffing --host 0.0.0.0         Allow other machines on the LAN to review
+  diffing --host 0.0.0.0 --insecure-no-auth
+                       Expose the review UI on the LAN without API tokens
+  diffing view                   Browse the working-tree diff in the TUI
+  diffing view --staged          Browse staged changes
+  diffing --view main..feature   Browse a branch comparison
   diffing --tui                  Open the experimental TUI (native Rust)
+  diffing mode tui               Use the TUI by default in interactive terminals
   diffing await-review           Agent: wait for human handoff
   diffing plan submit PLAN.md    Agent: submit a plan for approval
   diffing mcp --repo /abs/path   MCP server bound to one repository
@@ -437,6 +465,15 @@ function preprocessOptionalValueArgs(rawArgs) {
 		"find-renames",
 		"break-rewrites"
 	]);
+	/** Git accepts values only as `--flag=value` for these; never `--flag value`. */
+	const ATTACHED_ONLY_LONGS = new Set([
+		"stat",
+		"dirstat",
+		"relative",
+		"word-diff",
+		"color-moved",
+		"submodule"
+	]);
 	const startsWithDigit = (s) => typeof s === "string" && /^[0-9]/.test(s);
 	const out = [];
 	for (let i = 0; i < rawArgs.length; i++) {
@@ -465,6 +502,13 @@ function preprocessOptionalValueArgs(rawArgs) {
 			}
 			continue;
 		}
+		const attachedOnlyMatch = /^--(stat|dirstat|relative|word-diff|color-moved|submodule)$/.exec(arg);
+		if (attachedOnlyMatch) {
+			const name = attachedOnlyMatch[1];
+			if (ATTACHED_ONLY_LONGS.has(name)) out.push(`--${name}=`);
+			else out.push(arg);
+			continue;
+		}
 		out.push(arg);
 	}
 	return out;
@@ -479,7 +523,7 @@ function preprocessOptionalValueArgs(rawArgs) {
 * 3. Parse known flags via node:util.parseArgs
 * 4. Anything unknown / positional becomes a revision or pathspec
 */
-function parseDiffOptions(rawArgs) {
+function parseDiffOptions(rawArgs, defaultInteractiveMode = "web") {
 	const { values, positionals } = parseArgs({
 		options: {
 			...GIT_DIFF_OPTIONS,
@@ -500,9 +544,11 @@ function parseDiffOptions(rawArgs) {
 	if (values.port) opts.port = parseInt(values.port, 10);
 	if (values.host) opts.host = values.host;
 	if (values["no-open"]) opts.noOpen = true;
+	if (values["insecure-no-auth"]) opts.insecureNoAuth = true;
 	if (values["reuse-session"]) opts.reuseSession = true;
 	if (values["replace-session"]) opts.replaceSession = true;
 	if (values["gh-pr"]) opts.ghPr = String(values["gh-pr"]);
+	if (values.view) opts.viewOnly = true;
 	if (values.staged || values.cached) opts.staged = true;
 	if (values.merge) opts.merge = true;
 	const algo = values["diff-algorithm"];
@@ -576,7 +622,11 @@ function parseDiffOptions(rawArgs) {
 	if (values.raw) opts.outputFormat = "raw";
 	if (values.numstat) opts.outputFormat = "numstat";
 	if (values.shortstat) opts.outputFormat = "shortstat";
-	if (values.stat !== void 0) opts.outputFormat = "stat";
+	if (values.stat !== void 0) {
+		opts.outputFormat = "stat";
+		const statVal = values.stat;
+		if (statVal) opts.statParam = statVal;
+	}
 	if (values.summary) opts.outputFormat = "summary";
 	if (values["name-only"]) opts.outputFormat = "name-only";
 	if (values["name-status"]) opts.outputFormat = "name-status";
@@ -586,8 +636,14 @@ function parseDiffOptions(rawArgs) {
 	if (values.dirstat) opts.dirstat = values.dirstat;
 	if (values["dirstat-by-file"]) opts.dirstatByFile = values["dirstat-by-file"];
 	if (values.cumulative) opts.cumulative = true;
-	if (values["no-patch"]) opts.outputFormat = void 0;
-	if (values.check) opts.outputFormat = void 0;
+	if (values["no-patch"]) {
+		opts.outputFormat = void 0;
+		opts.suppressPatch = true;
+	}
+	if (values.check) {
+		opts.outputFormat = void 0;
+		opts.check = true;
+	}
 	if (values["diff-filter"]) opts.diffFilter = values["diff-filter"];
 	if (values.S) opts.pickaxeString = values.S;
 	if (values.G) opts.pickaxeRegex = values.G;
@@ -630,18 +686,17 @@ function parseDiffOptions(rawArgs) {
 	}
 	const dashDashIdx = rawArgs.indexOf("--");
 	if (dashDashIdx >= 0) {
-		for (let i = 0; i < dashDashIdx; i++) {
-			const arg = rawArgs[i];
-			if (!arg.startsWith("-")) opts.revisions.push(arg);
-		}
 		for (let i = dashDashIdx + 1; i < rawArgs.length; i++) opts.pathspecs.push(rawArgs[i]);
+		const pathspecSet = new Set(opts.pathspecs);
+		for (const p of positionals) if (!pathspecSet.has(p)) opts.revisions.push(p);
 	} else for (const p of positionals) opts.revisions.push(p);
-	if (values.tui) opts.outputMode = "tui";
+	if (values.view) opts.outputMode = "tui";
+	else if (values.tui) opts.outputMode = "tui";
 	else if (values.web) opts.outputMode = "web";
 	else if (values.terminal) opts.outputMode = "terminal";
-	if (process.stdout.isTTY && opts.outputMode === "auto") opts.outputMode = "web";
+	if (process.stdout.isTTY && opts.outputMode === "auto") opts.outputMode = values["gh-pr"] ? "web" : defaultInteractiveMode;
 	else if (!process.stdout.isTTY && opts.outputMode === "auto") opts.outputMode = "terminal";
-	if (opts.outputFormat || opts.patchWithRaw || opts.patchWithStat || opts.exitCode || opts.quiet || opts.outputFile) opts.outputMode = "terminal";
+	if (opts.outputFormat || opts.patchWithRaw || opts.patchWithStat || opts.compactSummary || opts.dirstat || opts.dirstatByFile || opts.cumulative || opts.suppressPatch || opts.check || opts.exitCode || opts.quiet || opts.outputFile || opts.colorMoved || opts.colorMovedWs || opts.srcPrefix || opts.dstPrefix || opts.noPrefix || opts.linePrefix || opts.submodule !== void 0 && opts.submodule !== "diff" || opts.extDiff) opts.outputMode = "terminal";
 	return opts;
 }
 /**
@@ -682,7 +737,7 @@ function buildGitDiffArgs(opts) {
 	if (opts.outputFormat === "raw") args.push("--raw");
 	if (opts.outputFormat === "numstat") args.push("--numstat");
 	if (opts.outputFormat === "shortstat") args.push("--shortstat");
-	if (opts.outputFormat === "stat") args.push("--stat");
+	if (opts.outputFormat === "stat") args.push(opts.statParam ? `--stat=${opts.statParam}` : "--stat");
 	if (opts.outputFormat === "summary") args.push("--summary");
 	if (opts.outputFormat === "name-only") args.push("--name-only");
 	if (opts.outputFormat === "name-status") args.push("--name-status");
@@ -693,6 +748,7 @@ function buildGitDiffArgs(opts) {
 	if (opts.dirstatByFile) args.push(`--dirstat-by-file=${opts.dirstatByFile}`);
 	if (opts.cumulative) args.push("--cumulative");
 	if (opts.check) args.push("--check");
+	if (opts.suppressPatch) args.push("--no-patch");
 	if (opts.diffFilter) args.push(`--diff-filter=${opts.diffFilter}`);
 	if (opts.pickaxeString) args.push(`-S${opts.pickaxeString}`);
 	if (opts.pickaxeRegex) args.push(`-G${opts.pickaxeRegex}`);
@@ -723,6 +779,23 @@ function buildGitDiffArgs(opts) {
 	return args;
 }
 /**
+* Build the machine-stable patch arguments consumed by the native index.
+* Presentation-only word/color modes are implemented by the renderer and
+* must not rewrite the unified patch stream that Rust parses.
+*/
+function buildTuiGitDiffArgs(opts) {
+	return buildGitDiffArgs({
+		...opts,
+		revisions: opts.showMode ? [...opts.showRevspecs] : [...opts.revisions],
+		pathspecs: [...opts.pathspecs],
+		wordDiff: void 0,
+		wordDiffRegex: void 0,
+		colorWords: void 0,
+		colorMoved: void 0,
+		colorMovedWs: void 0
+	});
+}
+/**
 * Transform a `parseDiffOptions(...)` result into a "show mode" variant:
 * moves any parsed revisions into `showRevspecs`, clears `revisions` (so the
 * existing diff-engine path does not try to `git diff` them), and sets the
@@ -738,6 +811,88 @@ function intoShowMode(opts) {
 	return opts;
 }
 //#endregion
+//#region src/lib/git-path.ts
+/** Decode Git `core.quotePath` C-quoted pathnames from diff headers. */
+function decodeGitPath$1(raw) {
+	const input = raw.trim();
+	if (!(input.startsWith("\"") && input.endsWith("\""))) return input;
+	const bytes = [];
+	const pushText = (value) => bytes.push(...Buffer.from(value, "utf8"));
+	for (let i = 1; i < input.length - 1; i++) {
+		if (input[i] !== "\\") {
+			const codePoint = input.codePointAt(i);
+			pushText(String.fromCodePoint(codePoint));
+			if (codePoint > 65535) i++;
+			continue;
+		}
+		const escaped = input[++i];
+		if (escaped == null) break;
+		const simple = {
+			a: 7,
+			b: 8,
+			t: 9,
+			n: 10,
+			v: 11,
+			f: 12,
+			r: 13,
+			"\"": 34,
+			"\\": 92
+		};
+		if (escaped in simple) {
+			bytes.push(simple[escaped]);
+			continue;
+		}
+		if (/[0-7]/.test(escaped)) {
+			let octal = escaped;
+			while (octal.length < 3 && i + 1 < input.length - 1 && /[0-7]/.test(input[i + 1])) octal += input[++i];
+			bytes.push(Number.parseInt(octal, 8));
+			continue;
+		}
+		pushText(escaped);
+	}
+	return Buffer.from(bytes).toString("utf8");
+}
+function stripSidePrefix$1(path, prefix) {
+	return path.startsWith(prefix) ? path.slice(prefix.length) : path;
+}
+function consumeGitToken$1(input, start) {
+	if (input[start] !== "\"") {
+		const end = input.indexOf(" ", start);
+		return {
+			token: input.slice(start, end < 0 ? input.length : end),
+			next: end < 0 ? input.length : end
+		};
+	}
+	let escaped = false;
+	for (let i = start + 1; i < input.length; i++) {
+		const char = input[i];
+		if (!escaped && char === "\"") return {
+			token: input.slice(start, i + 1),
+			next: i + 1
+		};
+		if (!escaped && char === "\\") escaped = true;
+		else escaped = false;
+	}
+	return null;
+}
+/** Parse `diff --git` header paths, including quoted paths and spaces in names. */
+function parseGitDiffHeaderPaths(line) {
+	if (!line.startsWith("diff --git ")) return null;
+	const rest = line.slice(11);
+	if (rest.startsWith("\"")) {
+		const first = consumeGitToken$1(rest, 0);
+		if (!first) return null;
+		let cursor = first.next;
+		while (cursor < rest.length && /\s/.test(rest[cursor])) cursor++;
+		const second = consumeGitToken$1(rest, cursor);
+		if (!second) return null;
+		return [stripSidePrefix$1(decodeGitPath$1(first.token), "a/"), stripSidePrefix$1(decodeGitPath$1(second.token), "b/")];
+	}
+	const separator = rest.lastIndexOf(" b/");
+	if (separator < 0) return null;
+	return [stripSidePrefix$1(rest.slice(0, separator), "a/"), stripSidePrefix$1(rest.slice(separator + 1), "b/")];
+}
+//#endregion
 //#region src/lib/diff-overview.ts
 /**
 * Compose the working-tree banner. Used by the default `git diff` (unstaged +
@@ -930,7 +1085,6 @@ function summariseCommitSeries(series, rows) {
 }
 //#endregion
 //#region src/lib/diff-engine.ts
-const MAX_BUFFER = 50 * 1024 * 1024;
 /**
 * Determine whether to use the "standard" web mode (unstaged+staged+untracked)
 * or a "custom" mode (specific revisions / pathspecs).
@@ -945,8 +1099,8 @@ function isCustomMode$1(opts) {
 function parseFilePaths(patch) {
 	const paths = /* @__PURE__ */ new Set();
 	for (const line of patch.split("\n")) {
-		const match = line.match(/^diff --git a\/.+ b\/(.+)$/);
-		if (match) paths.add(match[1]);
+		const parsed = parseGitDiffHeaderPaths(line);
+		if (parsed) paths.add(parsed[1]);
 	}
 	return [...paths];
 }
@@ -958,9 +1112,9 @@ function parseBinaryFiles(patch, untrackedFiles) {
 		if (!line.startsWith("Binary files ") || !line.includes(" differ")) continue;
 		let filePath = "";
 		for (let j = i - 1; j >= 0; j--) {
-			const match = lines[j].match(/^diff --git a\/.+ b\/(.+)$/);
-			if (match) {
-				filePath = match[1];
+			const parsed = parseGitDiffHeaderPaths(lines[j]);
+			if (parsed) {
+				filePath = parsed[1];
 				break;
 			}
 		}
@@ -1025,12 +1179,10 @@ async function executeDiffAsync(opts) {
 */
 async function executeDiffWithMeta(opts) {
 	const { patch, commits, truncated } = await executeDiffAsync(opts);
-	const repoName = getRepoName();
-	const branch = getBranchName();
-	const untrackedFiles = opts.includeUntracked && !opts.showMode ? await getUntrackedFilePathsAsync() : [];
+	const [{ repoName, branch }, untrackedFiles] = await Promise.all([getRepoMetadataAsync(), opts.includeUntracked && !opts.showMode ? getUntrackedFilePathsAsync() : Promise.resolve([])]);
 	const binaryFiles = parseBinaryFiles(patch, new Set(untrackedFiles));
 	const filePaths = parseFilePaths(patch);
-	const tabSizeMap = getTabSizeForFiles(filePaths);
+	const tabSizeMap = await getTabSizeForFilesAsync(filePaths);
 	let overview;
 	if (opts.showMode && commits && commits.length > 0) overview = buildCommitOverview({
 		commits: commits.map((c) => ({
@@ -1107,11 +1259,7 @@ function runTerminalDiff(opts) {
 	}
 	finalArgs.push(...args);
 	try {
-		execFileSync("git", ["diff", ...finalArgs], {
-			encoding: "utf-8",
-			maxBuffer: MAX_BUFFER,
-			stdio: "inherit"
-		});
+		execFileSync("git", ["diff", ...finalArgs], { stdio: "inherit" });
 		return 0;
 	} catch (err) {
 		if (err.status === 1 && opts.exitCode) return 1;
@@ -1132,11 +1280,7 @@ function runTerminalShow(opts) {
 	];
 	if (opts.pathspecs.length > 0) args.push("--", ...opts.pathspecs);
 	try {
-		execFileSync("git", args, {
-			encoding: "utf-8",
-			maxBuffer: MAX_BUFFER,
-			stdio: "inherit"
-		});
+		execFileSync("git", args, { stdio: "inherit" });
 		return 0;
 	} catch (err) {
 		return err.status ?? 1;
@@ -1155,6 +1299,7 @@ function validateEnvironment() {
 var FileCommentStore = class {
 	dirPath;
 	filePath;
+	mutationQueue = Promise.resolve();
 	/**
 	* @param storageDir Absolute directory to persist `comments.json` in.
 	*   Defaults to the per-repo storage dir under `~/.diffing` — comments are
@@ -1186,74 +1331,100 @@ var FileCommentStore = class {
 			console.error("Failed to save comments to file:", err);
 		}
 	}
+	/** Serialize each read-modify-write cycle so concurrent API calls cannot overwrite one another. */
+	enqueueMutation(operation) {
+		const result = this.mutationQueue.then(operation, operation);
+		this.mutationQueue = result.then(() => void 0, () => void 0);
+		return result;
+	}
 	async add(comment) {
-		const comments = await this.getAll();
-		comments.push(comment);
-		await this.save(comments);
-		return comment;
+		return this.enqueueMutation(async () => {
+			const comments = await this.getAll();
+			comments.push(comment);
+			await this.save(comments);
+			return comment;
+		});
 	}
 	async update(id, fields) {
-		const comments = await this.getAll();
-		const index = comments.findIndex((c) => c.id === id);
-		if (index === -1) return null;
-		const comment = comments[index];
-		if (fields.body !== void 0) comment.body = fields.body;
-		if (fields.status !== void 0) comment.status = fields.status;
-		await this.save(comments);
-		return comment;
+		return this.enqueueMutation(async () => {
+			const comments = await this.getAll();
+			const index = comments.findIndex((c) => c.id === id);
+			if (index === -1) return null;
+			const comment = comments[index];
+			if (fields.body !== void 0) comment.body = fields.body;
+			if (fields.status !== void 0) comment.status = fields.status;
+			await this.save(comments);
+			return comment;
+		});
 	}
 	async resolveAllOpen() {
-		const comments = await this.getAll();
-		let n = 0;
-		for (const c of comments) if (c.status === "open") {
-			c.status = "resolved";
-			n++;
-		}
-		if (n > 0) await this.save(comments);
-		return n;
+		return this.enqueueMutation(async () => {
+			const comments = await this.getAll();
+			let n = 0;
+			for (const c of comments) if (c.status === "open") {
+				c.status = "resolved";
+				n++;
+			}
+			if (n > 0) await this.save(comments);
+			return n;
+		});
 	}
 	async remove(id) {
-		const comments = await this.getAll();
-		const index = comments.findIndex((c) => c.id === id);
-		if (index === -1) return false;
-		comments.splice(index, 1);
-		await this.save(comments);
-		return true;
+		return this.enqueueMutation(async () => {
+			const comments = await this.getAll();
+			const index = comments.findIndex((c) => c.id === id);
+			if (index === -1) return false;
+			comments.splice(index, 1);
+			await this.save(comments);
+			return true;
+		});
 	}
 	async addReply(commentId, reply) {
-		const comments = await this.getAll();
-		const index = comments.findIndex((c) => c.id === commentId);
-		if (index === -1) return null;
-		const comment = comments[index];
-		if (!comment.replies) comment.replies = [];
-		comment.replies.push(reply);
-		await this.save(comments);
-		return comment;
+		return this.enqueueMutation(async () => {
+			const comments = await this.getAll();
+			const index = comments.findIndex((c) => c.id === commentId);
+			if (index === -1) return null;
+			const comment = comments[index];
+			if (!comment.replies) comment.replies = [];
+			comment.replies.push(reply);
+			await this.save(comments);
+			return comment;
+		});
 	}
 	async removeReply(commentId, replyId) {
-		const comments = await this.getAll();
-		const index = comments.findIndex((c) => c.id === commentId);
-		if (index === -1) return null;
-		const comment = comments[index];
-		const replyIndex = comment.replies.findIndex((r) => r.id === replyId);
-		if (replyIndex === -1) return null;
-		comment.replies.splice(replyIndex, 1);
-		await this.save(comments);
-		return comment;
+		return this.enqueueMutation(async () => {
+			const comments = await this.getAll();
+			const index = comments.findIndex((c) => c.id === commentId);
+			if (index === -1) return null;
+			const comment = comments[index];
+			const replyIndex = comment.replies.findIndex((r) => r.id === replyId);
+			if (replyIndex === -1) return null;
+			comment.replies.splice(replyIndex, 1);
+			await this.save(comments);
+			return comment;
+		});
 	}
 	async updateReply(commentId, replyId, body) {
-		const comments = await this.getAll();
-		const index = comments.findIndex((c) => c.id === commentId);
-		if (index === -1) return null;
-		const comment = comments[index];
-		const reply = comment.replies.find((r) => r.id === replyId);
-		if (!reply) return null;
-		reply.body = body;
-		await this.save(comments);
-		return comment;
+		return this.enqueueMutation(async () => {
+			const comments = await this.getAll();
+			const index = comments.findIndex((c) => c.id === commentId);
+			if (index === -1) return null;
+			const comment = comments[index];
+			const reply = comment.replies.find((r) => r.id === replyId);
+			if (!reply) return null;
+			reply.body = body;
+			await this.save(comments);
+			return comment;
+		});
 	}
 };
 //#endregion
+//#region src/lib/types.ts
+/** Runtime guard for comment data crossing HTTP or persisted-storage boundaries. */
+function isReviewCommentSide(value) {
+	return value === "deletions" || value === "additions";
+}
+//#endregion
 //#region src/lib/plans.ts
 /** Absolute path of the persisted markdown mirror for a plan id. */
 function planSourceFilePath(storageDir, planId) {
@@ -1613,7 +1784,7 @@ function guiEditorCommand(bin, absolutePath, platform) {
 function terminalEditorCommand(bin, absolutePath, platform, env) {
 	if (platform === "darwin") return {
 		cmd: "osascript",
-		args: ["-e", `tell application "Terminal" to do script "${bin} \\"${absolutePath.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}\\""`]
+		args: ["-e", `tell application "Terminal" to do script ("${bin} " & quoted form of "${absolutePath.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}")`]
 	};
 	if (platform === "win32") return {
 		cmd: "cmd.exe",
@@ -2765,8 +2936,13 @@ function collectPrAvatarUrls(session) {
 function isCustomMode(opts) {
 	return opts.revisions.length > 0 || opts.pathspecs.length > 0 || opts.showMode;
 }
-function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore, prSessionStore, prMode = false) {
+function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore, prSessionStore, prMode = false, security = {
+	bindHost: "127.0.0.1",
+	authToken: null,
+	insecureNoAuth: true
+}) {
 	const app = new Hono();
+	app.use("*", createServerAuthMiddleware(security));
 	let diffOpts = { ...diffOptsInput };
 	const customMode = isCustomMode(diffOpts);
 	const store = commentStore ?? new FileCommentStore();
@@ -3347,6 +3523,7 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 	});
 	app.post("/api/comments", async (c) => {
 		const body = await c.req.json();
+		if (!isReviewCommentSide(body.side)) return c.json({ error: "side must be additions or deletions" }, 400);
 		const severityRaw = body.severity;
 		const severity = severityRaw === "blocking" || severityRaw === "nit" || severityRaw === "question" || severityRaw === "praise" || severityRaw === "none" ? severityRaw : void 0;
 		const comment = {
@@ -3415,7 +3592,7 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 			if (!relPath) return c.json({ error: "Forbidden file path" }, 403);
 			const absolutePath = resolve(root, relPath);
 			const content = await readFile(absolutePath, "utf-8");
-			const { applySuggestionToContent } = await import("./apply-suggestion-DNNsC5gx.mjs");
+			const { applySuggestionToContent } = await import("./apply-suggestion-CHYnw68I.mjs");
 			const result = applySuggestionToContent({
 				content,
 				lineNumber: comment.lineNumber,
@@ -3662,7 +3839,7 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 		const session = await prStore.get();
 		if (!session) return notInPrMode(c);
 		try {
-			const { fetchPrChecks } = await import("./github-DKT0lJXv.mjs");
+			const { fetchPrChecks } = await import("./github-DXiEeHzk.mjs");
 			const checks = await fetchPrChecks(resolvedFromSession(session), session.headSha);
 			const summary = {
 				total: checks.length,
@@ -3694,7 +3871,7 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 		const text = typeof body.body === "string" ? body.body.trim() : "";
 		if (!text) return c.json({ error: "body is required" }, 400);
 		try {
-			const { replyToPrComment } = await import("./github-DKT0lJXv.mjs");
+			const { replyToPrComment } = await import("./github-DXiEeHzk.mjs");
 			const result = await replyToPrComment({
 				resolved: resolvedFromSession(session),
 				inReplyTo: id,
@@ -3908,8 +4085,8 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 		if (decision !== "approve" && decision !== "comment" && decision !== "request-changes" && decision !== "draft") return c.json({ error: "decision must be one of: approve, comment, request-changes, draft" }, 400);
 		const generalBody = typeof body.body === "string" ? body.body : "";
 		if (body.dryRun === true) {
-			const { buildReviewPayload, resolvedFromSession } = await import("./github-DKT0lJXv.mjs");
-			const { rewriteLocalAttachmentsInBodies } = await import("./github-attachments-Cf17YWp4.mjs");
+			const { buildReviewPayload, resolvedFromSession } = await import("./github-DXiEeHzk.mjs");
+			const { rewriteLocalAttachmentsInBodies } = await import("./github-attachments-DgOf7BhP.mjs");
 			const resolved = resolvedFromSession(session);
 			const comments = session.comments ?? [];
 			const rewritten = await rewriteLocalAttachmentsInBodies(resolved, [generalBody, ...comments.map((c) => c.body ?? "")], { dryRun: true });
@@ -4006,7 +4183,7 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 		const openCount = all.filter((x) => x.status === "open").length;
 		let diffFingerprints;
 		try {
-			const { fingerprintDiffFiles } = await import("./diff-fingerprint-C8YO3TTE.mjs");
+			const { fingerprintDiffFiles } = await import("./diff-fingerprint-BgR0tu1o.mjs");
 			if (prMode) {
 				const prSession = await prStore.get();
 				if (prSession?.diff) diffFingerprints = fingerprintDiffFiles(prSession.diff);
@@ -4074,7 +4251,7 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 		} catch (err) {
 			return c.json({ error: err?.message ?? "Failed to compute current diff" }, 500);
 		}
-		const { fingerprintDiffFiles, diffSinceLast, filesToReviewSinceLast } = await import("./diff-fingerprint-C8YO3TTE.mjs");
+		const { fingerprintDiffFiles, diffSinceLast, filesToReviewSinceLast } = await import("./diff-fingerprint-BgR0tu1o.mjs");
 		const delta = diffSinceLast(previous, fingerprintDiffFiles(currentPatch));
 		return c.json({
 			hasBaseline: true,
@@ -4299,10 +4476,19 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 		try {
 			const content = await readFile(fullPath);
 			const contentType = MIME_TYPES[extname(fullPath)] || "application/octet-stream";
+			if (contentType === "text/html" && security.authToken) {
+				const html = injectSessionTokenIntoHtml(content.toString("utf-8"), security.authToken);
+				return new Response(html, { headers: {
+					"Content-Type": contentType,
+					"Set-Cookie": buildSessionTokenSetCookieValue(security.authToken)
+				} });
+			}
 			return new Response(content, { headers: { "Content-Type": contentType } });
 		} catch {
-			const indexContent = await readFile(join(clientDir, "index.html"));
-			return new Response(indexContent, { headers: { "Content-Type": "text/html" } });
+			const html = injectSessionTokenIntoHtml((await readFile(join(clientDir, "index.html"))).toString("utf-8"), security.authToken);
+			const spaHeaders = { "Content-Type": "text/html" };
+			if (security.authToken) spaHeaders["Set-Cookie"] = buildSessionTokenSetCookieValue(security.authToken);
+			return new Response(html, { headers: spaHeaders });
 		}
 	});
 	return app;
@@ -4393,7 +4579,7 @@ async function startServer(options) {
 			throw new Error(`Failed to build PR session for ${options.prRef}: ${detail}`);
 		}
 	}
-	const app = createApp(options.clientDir, options.diffOpts, void 0, void 0, void 0, prMode);
+	const app = createApp(options.clientDir, options.diffOpts, void 0, void 0, void 0, prMode, options.security);
 	return new Promise((resolve) => {
 		serve({
 			fetch: app.fetch,
@@ -4408,4 +4594,4 @@ async function startServer(options) {
 	});
 }
 //#endregion
-export { intoShowMode as a, buildGitDiffArgs as i, runTerminalDiff as n, parseDiffOptions as o, validateEnvironment as r, printHelp as s, startServer as t };
+export { buildTuiGitDiffArgs as a, printHelp as c, buildGitDiffArgs as i, runTerminalDiff as n, intoShowMode as o, validateEnvironment as r, parseDiffOptions as s, startServer as t };