diffing 0.11.0 → 0.12.0

package/dist/{mcp-DtVrMR2S.mjs → mcp-zDVzU1vl.mjs}

@@ -1,7 +1,8 @@
-import { i as buildGitDiffArgs, s as parseDiffOptions, t as startServer } from "./server-j0PnTVX1.mjs";
+import { i as buildGitDiffArgs, s as parseDiffOptions, t as startServer } from "./server-Dw3lkQ5q.mjs";
+import { i as reviewSessionUrl, n as joinSessionApiUrl, r as reviewSessionBaseUrl, t as appendSessionToken } from "./session-url-sr7lXXVc.mjs";
 import { t as formatComments } from "./comment-format-B85NHZnG.mjs";
 import { n as formatPlanReview } from "./plan-format-BwJh5JSE.mjs";
-import { c as removeServerLockIfOwned, i as isLockAlive, p as writeServerLock, r as diffScopeKey, s as removeServerLock, t as acquireServerStartupLease, u as resolveActiveServerLock } from "./server-lock-CY0_1mcS.mjs";
+import { c as removeServerLockIfOwned, h as SESSION_TOKEN_HEADER, i as isLockAlive, p as writeServerLock, r as diffScopeKey, s as removeServerLock, t as acquireServerStartupLease, u as resolveActiveServerLock, x as isLoopbackHost, y as generateSessionToken } from "./server-lock-BNI8FKV1.mjs";
 import { n as AWAIT_REVIEW_TIMEOUT_NEXT_ACTION, r as AWAIT_TOOL_DESCRIPTION_SUFFIX, s as PLAN_SUBMIT_NEXT_ACTION, t as AWAIT_PLAN_TIMEOUT_NEXT_ACTION } from "./handoff-LAFtmnHf.mjs";
 import { execFileSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
@@ -105,25 +106,18 @@ function resolveMcpRepository(repoPath = process.cwd(), explicit = false) {
 		throw new Error(`diffing mcp: path is not inside a Git repository: ${candidate}`);
 	}
 }
-function isLoopbackHost(host) {
-	const normalized = host.toLowerCase();
-	if (normalized === "localhost" || normalized === "::1" || normalized === "[::1]") return true;
-	const octets = normalized.split(".");
-	return octets.length === 4 && octets[0] === "127" && octets.every((part) => {
-		if (!/^\d{1,3}$/.test(part)) return false;
-		const value = Number(part);
-		return value >= 0 && value <= 255;
-	});
-}
 function lockUrl(lock) {
-	if (lock.port <= 0) return null;
-	if (!isLoopbackHost(lock.host)) return null;
-	return `http://${lock.host === "::1" ? "[::1]" : lock.host}:${lock.port}`;
+	return reviewSessionUrl(lock);
 }
-async function requestJson(base, path, init) {
+async function requestJson(base, path, init, authToken) {
 	let response;
 	try {
-		response = await fetch(`${base}${path}`, init);
+		const headers = new Headers(init?.headers);
+		if (authToken) headers.set(SESSION_TOKEN_HEADER, authToken);
+		response = await fetch(joinSessionApiUrl(base, path), {
+			...init,
+			headers
+		});
 	} catch (error) {
 		if (error instanceof Error && error.name === "AbortError") throw new Error(`Request to ${path} was cancelled. Retry the MCP tool when ready.`);
 		const detail = error instanceof Error ? error.message : String(error);
@@ -368,11 +362,11 @@ function createMcpServer(options) {
 		const lock = liveLock();
 		if (!lock) throw new Error(`No diffing review session is running for ${repoRoot}. Start one with start_review_session, \`diffing --web\`, or \`diffing "gh pr <ref>"\`, then retry.`);
 		ensureReusableLock(lock);
-		const url = lockUrl(lock);
-		if (!url) throw new Error("The active diffing session does not expose a reachable loopback API.");
+		const apiOrigin = reviewSessionBaseUrl(lock);
+		if (!apiOrigin) throw new Error("The active diffing session does not expose a reachable loopback API.");
 		return {
 			lock,
-			url,
+			apiOrigin,
 			identity: `${lock.pid}:${lock.startedAt}:${lock.port}:${lock.ownerId ?? ""}`
 		};
 	}
@@ -391,11 +385,11 @@ function createMcpServer(options) {
 		if (session.lock.mode === "tui") {
 			if (!session.lock.capability) throw new Error("The TUI lock is missing its API capability.");
 			headers.set("X-Diffing-Capability", session.lock.capability);
-		}
-		return requestJson(session.url, path, {
+		} else if (session.lock.authToken) headers.set(SESSION_TOKEN_HEADER, session.lock.authToken);
+		return requestJson(session.apiOrigin, path, {
 			...init,
 			headers
-		});
+		}, session.lock.authToken);
 	}
 	function requestBaseJson(path, init) {
 		return requestSessionJson(requireWebSession(), path, init);
@@ -530,12 +524,17 @@ function createMcpServer(options) {
 			try {
 				const afterLease = liveLock();
 				if (afterLease) return reuse(afterLease);
+				const authToken = generateSessionToken();
 				const lock = {
 					port: (await startServerFn({
 						port: 0,
 						host: "127.0.0.1",
 						clientDir,
-						diffOpts: parsed
+						diffOpts: parsed,
+						security: {
+							bindHost: "127.0.0.1",
+							authToken
+						}
 					})).port,
 					host: "127.0.0.1",
 					pid: process.pid,
@@ -547,7 +546,8 @@ function createMcpServer(options) {
 					diffArgs: [...diffArgs],
 					owner: "mcp",
 					ownerId,
-					sessionId: ownerId
+					sessionId: ownerId,
+					authToken
 				};
 				try {
 					writeLock(lock);
@@ -749,7 +749,9 @@ function createMcpServer(options) {
 		if (author) params.set("author", author);
 		if (fullBody) params.set("fullBody", "true");
 		if (format === "xml") {
-			const res = await fetch(`${session.url}/api/gh/threads?${params}`);
+			const headers = new Headers();
+			if (session.lock.authToken) headers.set(SESSION_TOKEN_HEADER, session.lock.authToken);
+			const res = await fetch(joinSessionApiUrl(session.apiOrigin, `/api/gh/threads?${params}`), { headers });
 			const text = await res.text();
 			if (!res.ok) throw new Error(text || res.statusText);
 			return textResult(text, { result: {
@@ -784,7 +786,9 @@ function createMcpServer(options) {
 		if (fullBody) params.set("fullBody", "true");
 		if (state) params.set("state", state);
 		if (format === "xml") {
-			const res = await fetch(`${session.url}/api/gh/reviews?${params}`);
+			const headers = new Headers();
+			if (session.lock.authToken) headers.set(SESSION_TOKEN_HEADER, session.lock.authToken);
+			const res = await fetch(joinSessionApiUrl(session.apiOrigin, `/api/gh/reviews?${params}`), { headers });
 			const text = await res.text();
 			if (!res.ok) throw new Error(text || res.statusText);
 			return textResult(text, { result: {
@@ -1253,7 +1257,6 @@ function createMcpServer(options) {
 		annotations: MUTATING
 	}, async ({ title, body, source, model, planId }) => {
 		const session = requireWebSession();
-		const base = session.url;
 		await seedPlanCursor(session, void 0, true);
 		const plan = await requestSessionJson(session, "/api/plans", {
 			method: "POST",
@@ -1266,7 +1269,7 @@ function createMcpServer(options) {
 				model
 			})
 		});
-		const url = `${base}/plan/${plan.id}`;
+		const url = appendSessionToken(`${session.apiOrigin}/plan/${plan.id}`, session.lock.authToken);
 		return textResult(`Submitted plan ${plan.id} (v${plan.version}) at ${url}. ${PLAN_SUBMIT_NEXT_ACTION}`, {
 			status: "submitted",
 			planId: plan.id,

package/dist/{search-BMPY_ZW8.mjs → search-3R2E5xxr.mjs}

@@ -1,4 +1,4 @@
-import { d as getProjectStorageDir, p as getRepoRoot } from "./git-Czo96ymM.mjs";
+import { f as getProjectStorageDir, h as getRepoRoot } from "./git-BGj31GX-.mjs";
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
 //#region src/lib/symbols.ts
@@ -38,6 +38,11 @@ const SYMBOL_PATTERNS = [
 		kind: "enum",
 		nameGroup: 1
 	},
+	{
+		pattern: /^\s*namespace\s+((?:\w[\w$]*(?:\\\w[\w$]*)*)+)\s*;/i,
+		kind: "namespace",
+		nameGroup: 1
+	},
 	{
 		pattern: /^\s*(?:(?:export|declare)\s+)*namespace\s+(\w[\w$]*)/i,
 		kind: "namespace",
@@ -48,6 +53,16 @@ const SYMBOL_PATTERNS = [
 		kind: "variable",
 		nameGroup: 1
 	},
+	{
+		pattern: /^\s*(?:(?:public|private|protected|static|abstract|final)\s+)+function\s+(\w[\w$]*)\s*\(/i,
+		kind: "function",
+		nameGroup: 1
+	},
+	{
+		pattern: /^\s*(?:(?:abstract|final|readonly)\s+)+class\s+(\w[\w$]*)/i,
+		kind: "class",
+		nameGroup: 1
+	},
 	{
 		pattern: /^\s*(?!(?:if|for|while|switch|catch)\b)(?:(?:public|private|protected|static|async|abstract|readonly|override|get|set)\s+)*(\w[\w$]*)\s*(?:<[^>]+>)?\s*\([^)]*\)\s*(?:\{|:[^={]+[;{])/i,
 		kind: "method",

package/dist/{search-BO9Im7eu.mjs → search-CQ4nsjBX.mjs}

@@ -1,2 +1,2 @@
-import { a as searchFiles, i as searchContent, o as searchSymbols, r as searchAll, s as trackSelection } from "./search-BMPY_ZW8.mjs";
+import { a as searchFiles, i as searchContent, o as searchSymbols, r as searchAll, s as trackSelection } from "./search-3R2E5xxr.mjs";
 export { searchAll, searchContent, searchFiles, searchSymbols, trackSelection };

package/dist/{server-j0PnTVX1.mjs → server-Dw3lkQ5q.mjs}

@@ -1,9 +1,10 @@
-import { C as isSafePath, S as revertHunk, _ as getUntrackedFilePathsAsync, a as getCustomGitDiffAsync, b as listRepoFiles, c as getGitDiffAsync, d as getProjectStorageDir, f as getRepoName, g as getTabSizeForFiles, h as getShowDiff, i as getCommitSeriesSummary, l as getHunkHistory, o as getFileContent, p as getRepoRoot, r as getBranchName, u as getMergeStatus, v as gitAddFile, w as toSafeRelativePath, y as isGitRepo } from "./git-Czo96ymM.mjs";
-import { a as searchFiles, i as searchContent, o as searchSymbols, r as searchAll, s as trackSelection, t as getSearchStatus } from "./search-BMPY_ZW8.mjs";
-import { n as saveSettings, t as loadSettings } from "./settings-yK0GYpbn.mjs";
+import { C as listRepoFiles, D as toSafeRelativePath, E as isSafePath, S as isGitRepo, T as revertHunk, _ as getShowDiff, a as getCommitSeriesSummary, b as getUntrackedFilePathsAsync, d as getMergeStatus, f as getProjectStorageDir, h as getRepoRoot, l as getGitDiffAsync, m as getRepoMetadataAsync, o as getCustomGitDiffAsync, s as getFileContent, u as getHunkHistory, x as gitAddFile, y as getTabSizeForFilesAsync } from "./git-BGj31GX-.mjs";
+import { a as searchFiles, i as searchContent, o as searchSymbols, r as searchAll, s as trackSelection, t as getSearchStatus } from "./search-3R2E5xxr.mjs";
+import { a as loadSettings, o as saveSettings } from "./session-url-sr7lXXVc.mjs";
 import { t as formatComments } from "./comment-format-B85NHZnG.mjs";
 import { n as formatPlanReview, r as sectionTitleForLine, t as extractPlanLines } from "./plan-format-BwJh5JSE.mjs";
-import { D as updatePrReviewComment, E as submitReview, S as refreshPrSession, T as setPrReviewThreadResolved, a as detectCwdRepo, b as parsePrRef, f as fetchPrFileContentViaGh, i as deletePrReviewComment, l as fetchExistingCommentsViaGh, t as buildPrSession, u as fetchExistingReviewsViaGh, w as resolvedFromSession } from "./github-DBsZ0h_l.mjs";
+import { _ as buildSessionTokenSetCookieValue, b as injectSessionTokenIntoHtml, v as createServerAuthMiddleware } from "./server-lock-BNI8FKV1.mjs";
+import { D as updatePrReviewComment, E as submitReview, S as refreshPrSession, T as setPrReviewThreadResolved, a as detectCwdRepo, b as parsePrRef, f as fetchPrFileContentViaGh, i as deletePrReviewComment, l as fetchExistingCommentsViaGh, t as buildPrSession, u as fetchExistingReviewsViaGh, w as resolvedFromSession } from "./github-DpzqNrUh.mjs";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
@@ -53,6 +54,7 @@ const DEFAULTS = {
 	outputMode: "auto",
 	host: "127.0.0.1",
 	noOpen: false,
+	insecureNoAuth: false,
 	reuseSession: false,
 	replaceSession: false,
 	help: false,
@@ -184,6 +186,10 @@ const DIFFING_OPTIONS = {
 		type: "boolean",
 		default: false
 	},
+	"insecure-no-auth": {
+		type: "boolean",
+		default: false
+	},
 	"reuse-session": {
 		type: "boolean",
 		default: false
@@ -241,8 +247,12 @@ Git Diff Options (drop-in replacement for git diff):`);
 	console.log(`
 Diffing Server Options:
   --port <port>        Port to run the server on (default: random available port)
-  --host <host>        Host address to bind to (default: 127.0.0.1). Pass
-                       0.0.0.0 to expose the server to the local network.
+  --host <host>        Host address to bind to (default: 127.0.0.1). Loopback
+                       binds require a per-session API token. To expose the
+                       review UI on your LAN, pass 0.0.0.0 together with
+                       --insecure-no-auth (disables API authentication).
+  --insecure-no-auth   Allow binding to 0.0.0.0 without API tokens (unsafe on
+                       shared networks). Ignored on loopback binds.
   --no-open            Don't open the browser automatically
   --reuse-session      Open the active review instead of starting another
   --replace-session    Stop the active review and start a replacement
@@ -300,7 +310,8 @@ Examples:
   diffing -U10                   Diff with 10 context lines
   diffing --word-diff=color      Word-level diff in color
   diffing -b -w                  Ignore whitespace changes
-  diffing --host 0.0.0.0         Allow other machines on the LAN to review
+  diffing --host 0.0.0.0 --insecure-no-auth
+                       Expose the review UI on the LAN without API tokens
   diffing view                   Browse the working-tree diff in the TUI
   diffing view --staged          Browse staged changes
   diffing --view main..feature   Browse a branch comparison
@@ -454,6 +465,15 @@ function preprocessOptionalValueArgs(rawArgs) {
 		"find-renames",
 		"break-rewrites"
 	]);
+	/** Git accepts values only as `--flag=value` for these; never `--flag value`. */
+	const ATTACHED_ONLY_LONGS = new Set([
+		"stat",
+		"dirstat",
+		"relative",
+		"word-diff",
+		"color-moved",
+		"submodule"
+	]);
 	const startsWithDigit = (s) => typeof s === "string" && /^[0-9]/.test(s);
 	const out = [];
 	for (let i = 0; i < rawArgs.length; i++) {
@@ -482,6 +502,13 @@ function preprocessOptionalValueArgs(rawArgs) {
 			}
 			continue;
 		}
+		const attachedOnlyMatch = /^--(stat|dirstat|relative|word-diff|color-moved|submodule)$/.exec(arg);
+		if (attachedOnlyMatch) {
+			const name = attachedOnlyMatch[1];
+			if (ATTACHED_ONLY_LONGS.has(name)) out.push(`--${name}=`);
+			else out.push(arg);
+			continue;
+		}
 		out.push(arg);
 	}
 	return out;
@@ -517,6 +544,7 @@ function parseDiffOptions(rawArgs, defaultInteractiveMode = "web") {
 	if (values.port) opts.port = parseInt(values.port, 10);
 	if (values.host) opts.host = values.host;
 	if (values["no-open"]) opts.noOpen = true;
+	if (values["insecure-no-auth"]) opts.insecureNoAuth = true;
 	if (values["reuse-session"]) opts.reuseSession = true;
 	if (values["replace-session"]) opts.replaceSession = true;
 	if (values["gh-pr"]) opts.ghPr = String(values["gh-pr"]);
@@ -594,7 +622,11 @@ function parseDiffOptions(rawArgs, defaultInteractiveMode = "web") {
 	if (values.raw) opts.outputFormat = "raw";
 	if (values.numstat) opts.outputFormat = "numstat";
 	if (values.shortstat) opts.outputFormat = "shortstat";
-	if (values.stat !== void 0) opts.outputFormat = "stat";
+	if (values.stat !== void 0) {
+		opts.outputFormat = "stat";
+		const statVal = values.stat;
+		if (statVal) opts.statParam = statVal;
+	}
 	if (values.summary) opts.outputFormat = "summary";
 	if (values["name-only"]) opts.outputFormat = "name-only";
 	if (values["name-status"]) opts.outputFormat = "name-status";
@@ -654,11 +686,9 @@ function parseDiffOptions(rawArgs, defaultInteractiveMode = "web") {
 	}
 	const dashDashIdx = rawArgs.indexOf("--");
 	if (dashDashIdx >= 0) {
-		for (let i = 0; i < dashDashIdx; i++) {
-			const arg = rawArgs[i];
-			if (!arg.startsWith("-")) opts.revisions.push(arg);
-		}
 		for (let i = dashDashIdx + 1; i < rawArgs.length; i++) opts.pathspecs.push(rawArgs[i]);
+		const pathspecSet = new Set(opts.pathspecs);
+		for (const p of positionals) if (!pathspecSet.has(p)) opts.revisions.push(p);
 	} else for (const p of positionals) opts.revisions.push(p);
 	if (values.view) opts.outputMode = "tui";
 	else if (values.tui) opts.outputMode = "tui";
@@ -707,7 +737,7 @@ function buildGitDiffArgs(opts) {
 	if (opts.outputFormat === "raw") args.push("--raw");
 	if (opts.outputFormat === "numstat") args.push("--numstat");
 	if (opts.outputFormat === "shortstat") args.push("--shortstat");
-	if (opts.outputFormat === "stat") args.push("--stat");
+	if (opts.outputFormat === "stat") args.push(opts.statParam ? `--stat=${opts.statParam}` : "--stat");
 	if (opts.outputFormat === "summary") args.push("--summary");
 	if (opts.outputFormat === "name-only") args.push("--name-only");
 	if (opts.outputFormat === "name-status") args.push("--name-status");
@@ -781,6 +811,88 @@ function intoShowMode(opts) {
 	return opts;
 }
 //#endregion
+//#region src/lib/git-path.ts
+/** Decode Git `core.quotePath` C-quoted pathnames from diff headers. */
+function decodeGitPath$1(raw) {
+	const input = raw.trim();
+	if (!(input.startsWith("\"") && input.endsWith("\""))) return input;
+	const bytes = [];
+	const pushText = (value) => bytes.push(...Buffer.from(value, "utf8"));
+	for (let i = 1; i < input.length - 1; i++) {
+		if (input[i] !== "\\") {
+			const codePoint = input.codePointAt(i);
+			pushText(String.fromCodePoint(codePoint));
+			if (codePoint > 65535) i++;
+			continue;
+		}
+		const escaped = input[++i];
+		if (escaped == null) break;
+		const simple = {
+			a: 7,
+			b: 8,
+			t: 9,
+			n: 10,
+			v: 11,
+			f: 12,
+			r: 13,
+			"\"": 34,
+			"\\": 92
+		};
+		if (escaped in simple) {
+			bytes.push(simple[escaped]);
+			continue;
+		}
+		if (/[0-7]/.test(escaped)) {
+			let octal = escaped;
+			while (octal.length < 3 && i + 1 < input.length - 1 && /[0-7]/.test(input[i + 1])) octal += input[++i];
+			bytes.push(Number.parseInt(octal, 8));
+			continue;
+		}
+		pushText(escaped);
+	}
+	return Buffer.from(bytes).toString("utf8");
+}
+function stripSidePrefix$1(path, prefix) {
+	return path.startsWith(prefix) ? path.slice(prefix.length) : path;
+}
+function consumeGitToken$1(input, start) {
+	if (input[start] !== "\"") {
+		const end = input.indexOf(" ", start);
+		return {
+			token: input.slice(start, end < 0 ? input.length : end),
+			next: end < 0 ? input.length : end
+		};
+	}
+	let escaped = false;
+	for (let i = start + 1; i < input.length; i++) {
+		const char = input[i];
+		if (!escaped && char === "\"") return {
+			token: input.slice(start, i + 1),
+			next: i + 1
+		};
+		if (!escaped && char === "\\") escaped = true;
+		else escaped = false;
+	}
+	return null;
+}
+/** Parse `diff --git` header paths, including quoted paths and spaces in names. */
+function parseGitDiffHeaderPaths(line) {
+	if (!line.startsWith("diff --git ")) return null;
+	const rest = line.slice(11);
+	if (rest.startsWith("\"")) {
+		const first = consumeGitToken$1(rest, 0);
+		if (!first) return null;
+		let cursor = first.next;
+		while (cursor < rest.length && /\s/.test(rest[cursor])) cursor++;
+		const second = consumeGitToken$1(rest, cursor);
+		if (!second) return null;
+		return [stripSidePrefix$1(decodeGitPath$1(first.token), "a/"), stripSidePrefix$1(decodeGitPath$1(second.token), "b/")];
+	}
+	const separator = rest.lastIndexOf(" b/");
+	if (separator < 0) return null;
+	return [stripSidePrefix$1(rest.slice(0, separator), "a/"), stripSidePrefix$1(rest.slice(separator + 1), "b/")];
+}
+//#endregion
 //#region src/lib/diff-overview.ts
 /**
 * Compose the working-tree banner. Used by the default `git diff` (unstaged +
@@ -973,7 +1085,6 @@ function summariseCommitSeries(series, rows) {
 }
 //#endregion
 //#region src/lib/diff-engine.ts
-const MAX_BUFFER = 50 * 1024 * 1024;
 /**
 * Determine whether to use the "standard" web mode (unstaged+staged+untracked)
 * or a "custom" mode (specific revisions / pathspecs).
@@ -988,8 +1099,8 @@ function isCustomMode$1(opts) {
 function parseFilePaths(patch) {
 	const paths = /* @__PURE__ */ new Set();
 	for (const line of patch.split("\n")) {
-		const match = line.match(/^diff --git a\/.+ b\/(.+)$/);
-		if (match) paths.add(match[1]);
+		const parsed = parseGitDiffHeaderPaths(line);
+		if (parsed) paths.add(parsed[1]);
 	}
 	return [...paths];
 }
@@ -1001,9 +1112,9 @@ function parseBinaryFiles(patch, untrackedFiles) {
 		if (!line.startsWith("Binary files ") || !line.includes(" differ")) continue;
 		let filePath = "";
 		for (let j = i - 1; j >= 0; j--) {
-			const match = lines[j].match(/^diff --git a\/.+ b\/(.+)$/);
-			if (match) {
-				filePath = match[1];
+			const parsed = parseGitDiffHeaderPaths(lines[j]);
+			if (parsed) {
+				filePath = parsed[1];
 				break;
 			}
 		}
@@ -1068,12 +1179,10 @@ async function executeDiffAsync(opts) {
 */
 async function executeDiffWithMeta(opts) {
 	const { patch, commits, truncated } = await executeDiffAsync(opts);
-	const repoName = getRepoName();
-	const branch = getBranchName();
-	const untrackedFiles = opts.includeUntracked && !opts.showMode ? await getUntrackedFilePathsAsync() : [];
+	const [{ repoName, branch }, untrackedFiles] = await Promise.all([getRepoMetadataAsync(), opts.includeUntracked && !opts.showMode ? getUntrackedFilePathsAsync() : Promise.resolve([])]);
 	const binaryFiles = parseBinaryFiles(patch, new Set(untrackedFiles));
 	const filePaths = parseFilePaths(patch);
-	const tabSizeMap = getTabSizeForFiles(filePaths);
+	const tabSizeMap = await getTabSizeForFilesAsync(filePaths);
 	let overview;
 	if (opts.showMode && commits && commits.length > 0) overview = buildCommitOverview({
 		commits: commits.map((c) => ({
@@ -1150,11 +1259,7 @@ function runTerminalDiff(opts) {
 	}
 	finalArgs.push(...args);
 	try {
-		execFileSync("git", ["diff", ...finalArgs], {
-			encoding: "utf-8",
-			maxBuffer: MAX_BUFFER,
-			stdio: "inherit"
-		});
+		execFileSync("git", ["diff", ...finalArgs], { stdio: "inherit" });
 		return 0;
 	} catch (err) {
 		if (err.status === 1 && opts.exitCode) return 1;
@@ -1175,11 +1280,7 @@ function runTerminalShow(opts) {
 	];
 	if (opts.pathspecs.length > 0) args.push("--", ...opts.pathspecs);
 	try {
-		execFileSync("git", args, {
-			encoding: "utf-8",
-			maxBuffer: MAX_BUFFER,
-			stdio: "inherit"
-		});
+		execFileSync("git", args, { stdio: "inherit" });
 		return 0;
 	} catch (err) {
 		return err.status ?? 1;
@@ -1683,7 +1784,7 @@ function guiEditorCommand(bin, absolutePath, platform) {
 function terminalEditorCommand(bin, absolutePath, platform, env) {
 	if (platform === "darwin") return {
 		cmd: "osascript",
-		args: ["-e", `tell application "Terminal" to do script "${bin} \\"${absolutePath.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}\\""`]
+		args: ["-e", `tell application "Terminal" to do script ("${bin} " & quoted form of "${absolutePath.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}")`]
 	};
 	if (platform === "win32") return {
 		cmd: "cmd.exe",
@@ -2835,8 +2936,13 @@ function collectPrAvatarUrls(session) {
 function isCustomMode(opts) {
 	return opts.revisions.length > 0 || opts.pathspecs.length > 0 || opts.showMode;
 }
-function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore, prSessionStore, prMode = false) {
+function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore, prSessionStore, prMode = false, security = {
+	bindHost: "127.0.0.1",
+	authToken: null,
+	insecureNoAuth: true
+}) {
 	const app = new Hono();
+	app.use("*", createServerAuthMiddleware(security));
 	let diffOpts = { ...diffOptsInput };
 	const customMode = isCustomMode(diffOpts);
 	const store = commentStore ?? new FileCommentStore();
@@ -3733,7 +3839,7 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 		const session = await prStore.get();
 		if (!session) return notInPrMode(c);
 		try {
-			const { fetchPrChecks } = await import("./github-CErBub2y.mjs");
+			const { fetchPrChecks } = await import("./github-DXiEeHzk.mjs");
 			const checks = await fetchPrChecks(resolvedFromSession(session), session.headSha);
 			const summary = {
 				total: checks.length,
@@ -3765,7 +3871,7 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 		const text = typeof body.body === "string" ? body.body.trim() : "";
 		if (!text) return c.json({ error: "body is required" }, 400);
 		try {
-			const { replyToPrComment } = await import("./github-CErBub2y.mjs");
+			const { replyToPrComment } = await import("./github-DXiEeHzk.mjs");
 			const result = await replyToPrComment({
 				resolved: resolvedFromSession(session),
 				inReplyTo: id,
@@ -3979,8 +4085,8 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 		if (decision !== "approve" && decision !== "comment" && decision !== "request-changes" && decision !== "draft") return c.json({ error: "decision must be one of: approve, comment, request-changes, draft" }, 400);
 		const generalBody = typeof body.body === "string" ? body.body : "";
 		if (body.dryRun === true) {
-			const { buildReviewPayload, resolvedFromSession } = await import("./github-CErBub2y.mjs");
-			const { rewriteLocalAttachmentsInBodies } = await import("./github-attachments-plDeB0iE.mjs");
+			const { buildReviewPayload, resolvedFromSession } = await import("./github-DXiEeHzk.mjs");
+			const { rewriteLocalAttachmentsInBodies } = await import("./github-attachments-DgOf7BhP.mjs");
 			const resolved = resolvedFromSession(session);
 			const comments = session.comments ?? [];
 			const rewritten = await rewriteLocalAttachmentsInBodies(resolved, [generalBody, ...comments.map((c) => c.body ?? "")], { dryRun: true });
@@ -4370,10 +4476,19 @@ function createApp(clientDir, diffOptsInput = DEFAULTS, commentStore, planStore,
 		try {
 			const content = await readFile(fullPath);
 			const contentType = MIME_TYPES[extname(fullPath)] || "application/octet-stream";
+			if (contentType === "text/html" && security.authToken) {
+				const html = injectSessionTokenIntoHtml(content.toString("utf-8"), security.authToken);
+				return new Response(html, { headers: {
+					"Content-Type": contentType,
+					"Set-Cookie": buildSessionTokenSetCookieValue(security.authToken)
+				} });
+			}
 			return new Response(content, { headers: { "Content-Type": contentType } });
 		} catch {
-			const indexContent = await readFile(join(clientDir, "index.html"));
-			return new Response(indexContent, { headers: { "Content-Type": "text/html" } });
+			const html = injectSessionTokenIntoHtml((await readFile(join(clientDir, "index.html"))).toString("utf-8"), security.authToken);
+			const spaHeaders = { "Content-Type": "text/html" };
+			if (security.authToken) spaHeaders["Set-Cookie"] = buildSessionTokenSetCookieValue(security.authToken);
+			return new Response(html, { headers: spaHeaders });
 		}
 	});
 	return app;
@@ -4464,7 +4579,7 @@ async function startServer(options) {
 			throw new Error(`Failed to build PR session for ${options.prRef}: ${detail}`);
 		}
 	}
-	const app = createApp(options.clientDir, options.diffOpts, void 0, void 0, void 0, prMode);
+	const app = createApp(options.clientDir, options.diffOpts, void 0, void 0, void 0, prMode, options.security);
 	return new Promise((resolve) => {
 		serve({
 			fetch: app.fetch,