glassbox 0.10.1 → 0.11.0-rc.1

package/README.md

@@ -39,7 +39,7 @@ That's it. Data stays local. Works in any git repo.
 
 <br>
 
-<img src="assets/demo-guided-review.png" alt="Glassbox reviewing a diff with guided review notes" width="720">
+<img src="assets/demo.svg" alt="Glassbox: triage by AI risk, annotate a diff, and let Claude Code apply the fix — the full review loop" width="720">
 
 </div>
 

package/dist/cli.js

@@ -16207,7 +16207,34 @@ var DEMO_SCENARIOS = [
   { id: 4, label: "Annotations with different categories" },
   { id: 5, label: "Settings dialog with guided review" }
 ];
+function buildLargeMinifiedSvg(nudge) {
+  let body = "";
+  for (let i = 0; i < 12e3; i++) {
+    const hue = i * 37 % 360;
+    body += `<path d="M${i % 512} ${i * 3 % 512}l4 0 0 4-4 0z" fill="hsl(${hue} 70% 50%)" opacity="0.${i % 90}"/>`;
+  }
+  return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" data-build="${nudge}">${body}</svg>`;
+}
 var DEMO_FILES = [
+  {
+    // Regression guard for GB-821: a large minified SVG must not freeze the
+    // UI when selected. The diff viewer renders this as a text diff by
+    // default (svgViewMode = 'code'), so the server must truncate the giant
+    // single line for display instead of emitting a multi-hundred-KB text
+    // node whose layout/paint locks the main thread.
+    path: "src/assets/icons.min.svg",
+    status: "modified",
+    hunks: [{
+      oldStart: 1,
+      oldCount: 1,
+      newStart: 1,
+      newCount: 1,
+      lines: [
+        { type: "remove", oldNum: 1, newNum: null, content: buildLargeMinifiedSvg("a") },
+        { type: "add", oldNum: null, newNum: 1, content: buildLargeMinifiedSvg("b") }
+      ]
+    }]
+  },
   {
     path: "src/auth/session.ts",
     status: "modified",
@@ -16415,6 +16442,22 @@ var DEMO_FILES = [
         { type: "context", oldNum: 12, newNum: 14, content: '    "typescript": "^5.3.0"' }
       ]
     }]
+  },
+  {
+    // An image change, so the demo (and the e2e suite) exercises the image
+    // comparison modes — metadata / difference / slice. Modeled as a rename so
+    // the old and new sides resolve to two different real images in the repo
+    // (demo mode resolves to "uncommitted", so the image route reads the old
+    // side from git HEAD and the new side from the working tree), giving a
+    // genuine visual diff. The `src-tauri/icons/` path is deliberate: it sorts
+    // after `package.json` in the folder tree, so the auto-selected first file
+    // stays a text diff. Regression guard for GB-823: the slice tool's bottom
+    // handle must stay above the toolbar and be grabbable.
+    path: "src-tauri/icons/128x128.png",
+    oldPath: "src-tauri/icons/64x64.png",
+    status: "modified",
+    isBinary: true,
+    hunks: []
   }
 ];
 var GUIDED_NOTES = {
@@ -16569,10 +16612,10 @@ async function setupDemoReview(scenario) {
   for (const file2 of DEMO_FILES) {
     const diff = {
       filePath: file2.path,
-      oldPath: null,
+      oldPath: file2.oldPath ?? null,
       status: file2.status,
       hunks: file2.hunks,
-      isBinary: false
+      isBinary: file2.isBinary ?? false
     };
     const rf = await addReviewFile(review.id, file2.path, JSON.stringify(diff));
     fileIdMap.set(file2.path, rf.id);
@@ -16847,13 +16890,12 @@ function parseDiff(raw) {
     if (headerEnd === -1 && !header.includes("Binary")) {
       const pathMatch2 = chunk.match(/^a\/(.+?) b\/(.+)/m);
       if (pathMatch2) {
-        const isBinary3 = header.includes("Binary");
         files.push({
           filePath: pathMatch2[2],
           oldPath: pathMatch2[1] !== pathMatch2[2] ? pathMatch2[1] : null,
           status: header.includes("new file") ? "added" : header.includes("deleted file") ? "deleted" : "modified",
           hunks: [],
-          isBinary: isBinary3
+          isBinary: false
         });
       }
       continue;
@@ -17419,26 +17461,29 @@ async function sendGoogleRequest(apiKey, model, systemPrompt, messages) {
 }
 
 // src/ai/context-builder.ts
+function linePrefix(type) {
+  return type === "add" ? "+" : type === "remove" ? "-" : " ";
+}
 function summarizeHunk(hunk, maxLines) {
   const lines = [];
   lines.push(`@@ -${String(hunk.oldStart)},${String(hunk.oldCount)} +${String(hunk.newStart)},${String(hunk.newCount)} @@`);
   const hunkLines = hunk.lines;
   if (hunkLines.length <= maxLines) {
     for (const line of hunkLines) {
-      const prefix = line.type === "add" ? "+" : line.type === "remove" ? "-" : " ";
+      const prefix = linePrefix(line.type);
       lines.push(prefix + line.content);
     }
   } else {
     const half = Math.floor(maxLines / 2);
     for (let i = 0; i < half; i++) {
       const line = hunkLines[i];
-      const prefix = line.type === "add" ? "+" : line.type === "remove" ? "-" : " ";
+      const prefix = linePrefix(line.type);
       lines.push(prefix + line.content);
     }
     lines.push(`... (${String(hunkLines.length - maxLines)} lines omitted) ...`);
     for (let i = hunkLines.length - half; i < hunkLines.length; i++) {
       const line = hunkLines[i];
-      const prefix = line.type === "add" ? "+" : line.type === "remove" ? "-" : " ";
+      const prefix = linePrefix(line.type);
       lines.push(prefix + line.content);
     }
   }
@@ -17451,7 +17496,7 @@ function buildDiffText(diff, charBudget) {
   for (const hunk of diff.hunks) {
     fullLines.push(`@@ -${String(hunk.oldStart)},${String(hunk.oldCount)} +${String(hunk.newStart)},${String(hunk.newCount)} @@`);
     for (const line of hunk.lines) {
-      const prefix = line.type === "add" ? "+" : line.type === "remove" ? "-" : " ";
+      const prefix = linePrefix(line.type);
       fullLines.push(prefix + line.content);
     }
   }
@@ -18839,6 +18884,7 @@ __export(themes_exports, {
   PartialThemeColorsSchema: () => PartialThemeColorsSchema,
   SetActiveThemeReqSchema: () => SetActiveThemeReqSchema,
   SetActiveThemeRespSchema: () => SetActiveThemeRespSchema,
+  StoredCustomThemeSchema: () => StoredCustomThemeSchema,
   ThemeColorsSchema: () => ThemeColorsSchema,
   ThemeSummarySchema: () => ThemeSummarySchema,
   UpdateThemeBodySchema: () => UpdateThemeBodySchema,
@@ -19336,6 +19382,12 @@ function buildPartialThemeColorsSchema() {
   return external_exports.object(shape).partial();
 }
 var PartialThemeColorsSchema = buildPartialThemeColorsSchema();
+var StoredCustomThemeSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  baseTheme: external_exports.string().optional(),
+  colors: external_exports.record(external_exports.string(), external_exports.string())
+});
 var ThemeSummarySchema = external_exports.object({
   id: external_exports.string(),
   name: external_exports.string(),
@@ -19452,6 +19504,13 @@ function parseQuery(c, schema) {
   }
   return { ok: true, data: result.data };
 }
+function requirePathParam(c, name) {
+  const value = c.req.param(name);
+  if (value === void 0 || value.trim() === "") {
+    return { ok: false, response: c.json({ error: `Missing or empty path parameter: ${name}` }, 400) };
+  }
+  return { ok: true, data: value };
+}
 function errorResponse(c, message, status = 400) {
   return c.json({ error: message }, status);
 }
@@ -19469,6 +19528,13 @@ function parseAnalysisTimestamp(updatedAt) {
   }
   return /* @__PURE__ */ new Date(updatedAt + "Z");
 }
+function resolveFileId(fileIdMap, filePath) {
+  const id = fileIdMap.get(filePath);
+  if (id === void 0 || id === "") {
+    throw new Error(`No review_file id for path: ${filePath}`);
+  }
+  return id;
+}
 var canceledAnalyses = /* @__PURE__ */ new Set();
 aiAnalysisRoutes.post("/analyze", async (c) => {
   const reviewId = resolveReviewId(c);
@@ -19632,7 +19698,7 @@ async function saveBinaryFiles(args) {
   if (binaryFiles.length === 0) return;
   debugLog(`Saving ${String(binaryFiles.length)} binary files with score 0`);
   const binaryScoreEntries = binaryFiles.map((f, idx) => ({
-    reviewFileId: fileIdMap.get(f.file_path) ?? "",
+    reviewFileId: resolveFileId(fileIdMap, f.file_path),
     filePath: f.file_path,
     sortOrder: 99999 + idx,
     // re-sorted by `updateSortOrders` later
@@ -19701,7 +19767,7 @@ function riskAnalysisConfig(config2, repoRoot, fileIdMap, guidedReview, analysis
       r.aggregate = Math.max(r.aggregate, maxDimension);
     },
     mapResult: (r) => ({
-      reviewFileId: fileIdMap.get(r.filePath) ?? "",
+      reviewFileId: resolveFileId(fileIdMap, r.filePath),
       filePath: r.filePath,
       sortOrder: 0,
       // Placeholder — final sort happens after all batches
@@ -19724,7 +19790,7 @@ function narrativeAnalysisConfig(config2, repoRoot, fileIdMap, guidedReview, ana
       () => mockNarrativeAnalysisBatch(files)
     ),
     mapResult: (r) => ({
-      reviewFileId: fileIdMap.get(r.filePath) ?? "",
+      reviewFileId: resolveFileId(fileIdMap, r.filePath),
       filePath: r.filePath,
       sortOrder: r.position,
       // Batch-local position — will be re-sorted after merge
@@ -19749,7 +19815,7 @@ function guidedAnalysisConfig(config2, repoRoot, fileIdMap, guidedReview) {
       return runGuidedAnalysisBatch(files, config2, repoRoot, guidedReview);
     },
     mapResult: (r, idx) => ({
-      reviewFileId: fileIdMap.get(r.filePath) ?? "",
+      reviewFileId: resolveFileId(fileIdMap, r.filePath),
       filePath: r.filePath,
       sortOrder: idx,
       aggregateScore: null,
@@ -19921,6 +19987,7 @@ import { Hono as Hono4 } from "hono";
 init_queries();
 
 // src/export/generate.ts
+init_zod();
 init_queries();
 import { spawnSync as spawnSync5 } from "child_process";
 import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync5, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
@@ -19928,9 +19995,11 @@ import { homedir as homedir2 } from "os";
 import { join as join5 } from "path";
 var DISMISS_FILE = join5(homedir2(), ".glassbox", "gitignore-dismissed.json");
 var DISMISS_DAYS = 30;
+var DismissalsSchema = external_exports.record(external_exports.string(), external_exports.number());
 function loadDismissals() {
   try {
-    return JSON.parse(readFileSync5(DISMISS_FILE, "utf-8"));
+    const parsed = DismissalsSchema.safeParse(JSON.parse(readFileSync5(DISMISS_FILE, "utf-8")));
+    return parsed.success ? parsed.data : {};
   } catch {
     return {};
   }
@@ -20089,26 +20158,34 @@ annotationsRoutes.post("/annotations", async (c) => {
   return c.json(annotation, 201);
 });
 annotationsRoutes.patch("/annotations/:id", async (c) => {
+  const id = requirePathParam(c, "id");
+  if (!id.ok) return id.response;
   const parsed = await parseBody(c, UpdateAnnotationBodySchema);
   if (!parsed.ok) return parsed.response;
-  await updateAnnotation(c.req.param("id"), parsed.data.content, parsed.data.category);
+  await updateAnnotation(id.data, parsed.data.content, parsed.data.category);
   autoExport(c);
   return c.json({ ok: true });
 });
 annotationsRoutes.delete("/annotations/:id", async (c) => {
-  await deleteAnnotation(c.req.param("id"));
+  const id = requirePathParam(c, "id");
+  if (!id.ok) return id.response;
+  await deleteAnnotation(id.data);
   autoExport(c);
   return c.json({ ok: true });
 });
 annotationsRoutes.patch("/annotations/:id/move", async (c) => {
+  const id = requirePathParam(c, "id");
+  if (!id.ok) return id.response;
   const parsed = await parseBody(c, MoveAnnotationBodySchema);
   if (!parsed.ok) return parsed.response;
-  await moveAnnotation(c.req.param("id"), parsed.data.lineNumber, parsed.data.side);
+  await moveAnnotation(id.data, parsed.data.lineNumber, parsed.data.side);
   autoExport(c);
   return c.json({ ok: true });
 });
 annotationsRoutes.post("/annotations/:id/keep", async (c) => {
-  await markAnnotationCurrent(c.req.param("id"));
+  const id = requirePathParam(c, "id");
+  if (!id.ok) return id.response;
+  await markAnnotationCurrent(id.data);
   autoExport(c);
   return c.json({ ok: true });
 });
@@ -20136,7 +20213,9 @@ init_queries();
 var contextRoutes = new Hono5();
 contextRoutes.get("/context/:fileId", async (c) => {
   const repoRoot = c.get("repoRoot");
-  const file2 = await getReviewFile(c.req.param("fileId"));
+  const fileId = requirePathParam(c, "fileId");
+  if (!fileId.ok) return fileId.response;
+  const file2 = await getReviewFile(fileId.data);
   if (!file2) return c.json({ error: "Not found" }, 404);
   const parsed = parseQuery(c, GetContextLinesQuerySchema);
   if (!parsed.ok) return parsed.response;
@@ -20192,19 +20271,25 @@ filesRoutes.get("/files", async (c) => {
   return c.json({ files, annotationCounts, staleCounts });
 });
 filesRoutes.get("/files/:fileId", async (c) => {
-  const file2 = await getReviewFile(c.req.param("fileId"));
+  const fileId = requirePathParam(c, "fileId");
+  if (!fileId.ok) return fileId.response;
+  const file2 = await getReviewFile(fileId.data);
   if (!file2) return c.json({ error: "Not found" }, 404);
   const annotations = await getAnnotationsForFile(file2.id);
   return c.json({ file: file2, annotations });
 });
 filesRoutes.patch("/files/:fileId/status", async (c) => {
+  const fileId = requirePathParam(c, "fileId");
+  if (!fileId.ok) return fileId.response;
   const parsed = await parseBody(c, SetFileStatusBodySchema);
   if (!parsed.ok) return parsed.response;
-  await updateFileStatus(c.req.param("fileId"), parsed.data.status);
+  await updateFileStatus(fileId.data, parsed.data.status);
   return c.json({ ok: true });
 });
 filesRoutes.post("/files/:fileId/reveal", async (c) => {
-  const file2 = await getReviewFile(c.req.param("fileId"));
+  const fileId = requirePathParam(c, "fileId");
+  if (!fileId.ok) return fileId.response;
+  const file2 = await getReviewFile(fileId.data);
   if (!file2) return c.json({ error: "Not found" }, 404);
   const repoRoot = c.get("repoRoot");
   const fullPath = resolve4(repoRoot, file2.file_path);
@@ -20528,13 +20613,16 @@ function getNewImage(mode, filePath, repoRoot) {
 }
 
 // src/git/svg-rasterize.ts
+import { Worker } from "worker_threads";
+
+// src/git/svg-rasterize-render.ts
 import { existsSync as existsSync5, readFileSync as readFileSync7 } from "fs";
 import { createRequire } from "module";
 import { join as join6 } from "path";
 var initialized = false;
 var ResvgClass;
 var fontBuffers = [];
-async function ensureInit() {
+async function ensureRenderInit() {
   if (initialized) return;
   const require2 = createRequire(import.meta.url);
   const resvgPath = require2.resolve("@resvg/resvg-wasm");
@@ -20637,9 +20725,8 @@ function svgUsesExternalFonts(svgData) {
   const svg = svgData.toString("utf-8");
   return /<text[\s>]/i.test(svg) || /font-family/i.test(svg) || /@font-face/i.test(svg);
 }
-async function rasterizeSvg(svgData) {
-  await ensureInit();
-  const svgString = svgData.toString("utf-8");
+async function renderSvgToPng(svgString) {
+  await ensureRenderInit();
   const { width, height } = parseSvgDimensions(svgString);
   const maxDim = Math.max(width, height);
   const scale = Math.min(10, 8e3 / maxDim);
@@ -20659,11 +20746,118 @@ async function rasterizeSvg(svgData) {
   return png;
 }
 
+// src/git/svg-rasterize.ts
+var RENDER_TIMEOUT_MS = 15e3;
+var worker = null;
+var workerReady = false;
+var workerDisabled = false;
+var nextJobId = 0;
+var pending = /* @__PURE__ */ new Map();
+function resolveWorkerUrl() {
+  return import.meta.url.endsWith(".ts") ? new URL("./svg-rasterize-worker-boot.mjs", import.meta.url) : new URL("./svg-rasterize-worker.js", import.meta.url);
+}
+function clearJobTimer(job) {
+  if (job.timer !== void 0) clearTimeout(job.timer);
+}
+function fallbackAllPending() {
+  for (const [id, job] of pending) {
+    pending.delete(id);
+    clearJobTimer(job);
+    renderSvgToPng(job.svg).then(job.resolve, job.reject);
+  }
+}
+function rejectAllPending(err) {
+  for (const [id, job] of pending) {
+    pending.delete(id);
+    clearJobTimer(job);
+    job.reject(err);
+  }
+}
+function disposeWorker() {
+  if (worker) {
+    worker.removeAllListeners();
+    void worker.terminate();
+  }
+  worker = null;
+  workerReady = false;
+}
+function onJobTimeout(id) {
+  const job = pending.get(id);
+  if (!job) return;
+  pending.delete(id);
+  clearJobTimer(job);
+  const requeue = [...pending.values()];
+  pending.clear();
+  for (const r of requeue) clearJobTimer(r);
+  disposeWorker();
+  job.reject(new Error(`SVG rasterization timed out after ${RENDER_TIMEOUT_MS} ms`));
+  for (const r of requeue) submit(r);
+}
+function getWorker() {
+  if (workerDisabled) return null;
+  if (worker) return worker;
+  let spawned;
+  try {
+    spawned = new Worker(resolveWorkerUrl());
+  } catch {
+    workerDisabled = true;
+    return null;
+  }
+  spawned.on("message", (msg) => {
+    if (msg.type === "ready") {
+      workerReady = true;
+      return;
+    }
+    const job = pending.get(msg.id);
+    if (!job) return;
+    pending.delete(msg.id);
+    clearJobTimer(job);
+    if (msg.type === "result") job.resolve(Buffer.from(msg.png));
+    else job.reject(new Error(msg.message));
+  });
+  const handleFailure = (err) => {
+    const startupFailure = !workerReady;
+    disposeWorker();
+    if (startupFailure) {
+      workerDisabled = true;
+      fallbackAllPending();
+    } else {
+      rejectAllPending(err);
+    }
+  };
+  spawned.on("error", handleFailure);
+  spawned.on("exit", (code) => {
+    if (code !== 0) handleFailure(new Error(`SVG rasterization worker exited with code ${code}`));
+  });
+  worker = spawned;
+  return spawned;
+}
+function submit(job) {
+  const activeWorker = getWorker();
+  if (!activeWorker) {
+    renderSvgToPng(job.svg).then(job.resolve, job.reject);
+    return;
+  }
+  const id = nextJobId++;
+  job.timer = setTimeout(() => {
+    onJobTimeout(id);
+  }, RENDER_TIMEOUT_MS);
+  pending.set(id, job);
+  activeWorker.postMessage({ id, svg: job.svg });
+}
+async function rasterizeSvg(svgData) {
+  const svg = svgData.toString("utf-8");
+  return new Promise((resolve9, reject) => {
+    submit({ svg, resolve: resolve9, reject });
+  });
+}
+
 // src/routes/api/image.ts
 var imageRoutes = new Hono7();
 imageRoutes.get("/image/:fileId/metadata", async (c) => {
-  const fileId = c.req.param("fileId");
-  const file2 = await getReviewFile(fileId);
+  const fileIdParam = requirePathParam(c, "fileId");
+  if (!fileIdParam.ok) return fileIdParam.response;
+  const file2 = await getReviewFile(fileIdParam.data);
   if (!file2) return c.json({ error: "Not found" }, 404);
   const repoRoot = c.get("repoRoot");
   const review = await getReview(file2.review_id);
@@ -20682,10 +20876,11 @@ imageRoutes.get("/image/:fileId/metadata", async (c) => {
   });
 });
 imageRoutes.get("/image/:fileId/:side", async (c) => {
-  const fileId = c.req.param("fileId");
+  const fileIdParam = requirePathParam(c, "fileId");
+  if (!fileIdParam.ok) return fileIdParam.response;
   const side = c.req.param("side");
   if (side !== "old" && side !== "new") return c.text("Invalid side", 400);
-  const file2 = await getReviewFile(fileId);
+  const file2 = await getReviewFile(fileIdParam.data);
   if (!file2) return c.text("Not found", 404);
   const repoRoot = c.get("repoRoot");
   const review = await getReview(file2.review_id);
@@ -21040,7 +21235,9 @@ function pushIndentSymbol(root, stack, sym, indent, lines, lineIdx) {
 var outlineRoutes = new Hono8();
 outlineRoutes.get("/outline/:fileId", async (c) => {
   const repoRoot = c.get("repoRoot");
-  const file2 = await getReviewFile(c.req.param("fileId"));
+  const fileId = requirePathParam(c, "fileId");
+  if (!fileId.ok) return fileId.response;
+  const file2 = await getReviewFile(fileId.data);
   if (!file2) return c.json({ error: "Not found" }, 404);
   const diff = parseDiffData(file2.diff_data);
   const isDeleted = diff?.status === "deleted";
@@ -21211,7 +21408,9 @@ reviewsRoutes.post("/review/refresh", async (c) => {
   });
 });
 reviewsRoutes.delete("/review/:id", async (c) => {
-  const reviewId = c.req.param("id");
+  const idParam = requirePathParam(c, "id");
+  if (!idParam.ok) return idParam.response;
+  const reviewId = idParam.data;
   const currentReviewId2 = c.get("currentReviewId");
   if (reviewId === currentReviewId2) {
     return c.json({ error: "Cannot delete the current review" }, 400);
@@ -21499,6 +21698,17 @@ function buildSegments(str, commonPositions) {
   return segments;
 }
 
+// src/utils/lineTruncate.ts
+var MAX_DIFF_LINE_LENGTH = 5e3;
+function truncateDiffLine(content) {
+  if (content.length <= MAX_DIFF_LINE_LENGTH) return null;
+  return {
+    text: content.slice(0, MAX_DIFF_LINE_LENGTH),
+    hidden: content.length - MAX_DIFF_LINE_LENGTH,
+    fullLength: content.length
+  };
+}
+
 // src/components/imageDiff.tsx
 import { jsx as jsx2, jsxs as jsxs2 } from "kerfjs/jsx-runtime";
 function ImageDiff({ file: file2, diff, fontWarning, baseWidth, baseHeight }) {
@@ -21719,6 +21929,25 @@ function renderSplitColumn(items, side) {
 function renderSegments(segments) {
   return /* @__PURE__ */ jsx3(Fragment, { children: segments.map((s) => s.changed ? /* @__PURE__ */ jsx3("span", { className: "char-change", children: s.text }) : /* @__PURE__ */ jsx3(Fragment, { children: s.text })) });
 }
+function renderLineContent(content) {
+  const t = truncateDiffLine(content);
+  if (t === null) return content;
+  return /* @__PURE__ */ jsxs3(Fragment, { children: [
+    t.text,
+    /* @__PURE__ */ jsxs3(
+      "span",
+      {
+        className: "line-truncated",
+        title: `Line too long to display \u2014 ${t.fullLength.toLocaleString("en-US")} characters total`,
+        children: [
+          "\u2026 \u27E8",
+          t.hidden.toLocaleString("en-US"),
+          " more characters hidden\u27E9"
+        ]
+      }
+    )
+  ] });
+}
 function renderPairContent(pair, side) {
   const line = side === "left" ? pair.left : pair.right;
   if (!line) return "";
@@ -21728,7 +21957,7 @@ function renderPairContent(pair, side) {
       return renderSegments(side === "left" ? diff.oldSegments : diff.newSegments);
     }
   }
-  return line.content;
+  return renderLineContent(line.content);
 }
 function pairLines(lines) {
   const pairs = [];
@@ -21836,7 +22065,7 @@ function UnifiedDiff({ hunks, annotationsByLine }) {
                 children: [
                   /* @__PURE__ */ jsx3("span", { className: "gutter-old", "data-line-number": line.oldNum ?? "" }),
                   /* @__PURE__ */ jsx3("span", { className: "gutter-new", "data-line-number": line.newNum ?? "" }),
-                  /* @__PURE__ */ jsx3("span", { className: "code", children: segments ? renderSegments(segments) : line.content })
+                  /* @__PURE__ */ jsx3("span", { className: "code", children: segments ? renderSegments(segments) : renderLineContent(line.content) })
                 ]
               }
             ),
@@ -21893,10 +22122,10 @@ function loadCustomThemes() {
     const files = readdirSync(THEMES_DIR).filter((f) => f.endsWith(".json"));
     for (const file2 of files) {
       try {
-        const data = JSON.parse(readFileSync10(join9(THEMES_DIR, file2), "utf-8"));
-        if (data.id !== void 0 && data.id !== "" && data.name !== void 0 && data.name !== "" && data.colors !== void 0) {
-          themes.push({ id: data.id, name: data.name, colors: data.colors, builtIn: false, baseTheme: data.baseTheme ?? "" });
-        }
+        const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync10(join9(THEMES_DIR, file2), "utf-8")));
+        if (!parsed.success) continue;
+        const d = parsed.data;
+        themes.push({ id: d.id, name: d.name, colors: d.colors, builtIn: false, baseTheme: d.baseTheme ?? "" });
       } catch {
       }
     }
@@ -21919,8 +22148,10 @@ function getCustomTheme(id) {
   const filePath = join9(THEMES_DIR, `${id}.json`);
   if (!existsSync7(filePath)) return void 0;
   try {
-    const data = JSON.parse(readFileSync10(filePath, "utf-8"));
-    return { ...data, builtIn: false };
+    const parsed = StoredCustomThemeSchema.safeParse(JSON.parse(readFileSync10(filePath, "utf-8")));
+    if (!parsed.success) return void 0;
+    const d = parsed.data;
+    return { id: d.id, name: d.name, colors: d.colors, builtIn: false, baseTheme: d.baseTheme ?? "" };
   } catch {
     return void 0;
   }
@@ -22393,7 +22624,9 @@ themeApiRoutes.post("/", async (c) => {
   return c.json(newTheme, 201);
 });
 themeApiRoutes.post("/:id/edit", async (c) => {
-  const id = c.req.param("id");
+  const idParam = requirePathParam(c, "id");
+  if (!idParam.ok) return idParam.response;
+  const id = idParam.data;
   const parsed = await parseBody(c, EditThemeBodySchema);
   if (!parsed.ok) return parsed.response;
   const body = parsed.data;
@@ -22421,7 +22654,9 @@ themeApiRoutes.post("/:id/edit", async (c) => {
   return c.json({ theme: updated, copied: false });
 });
 themeApiRoutes.patch("/:id", async (c) => {
-  const id = c.req.param("id");
+  const idParam = requirePathParam(c, "id");
+  if (!idParam.ok) return idParam.response;
+  const id = idParam.data;
   if (getBuiltInTheme(id)) {
     return c.json({ error: "Cannot edit built-in theme" }, 400);
   }
@@ -22441,7 +22676,9 @@ themeApiRoutes.patch("/:id", async (c) => {
   return c.json(updated);
 });
 themeApiRoutes.delete("/:id", (c) => {
-  const id = c.req.param("id");
+  const idParam = requirePathParam(c, "id");
+  if (!idParam.ok) return idParam.response;
+  const id = idParam.data;
   if (getBuiltInTheme(id)) {
     return c.json({ error: "Cannot delete built-in theme" }, 400);
   }
@@ -22909,7 +23146,7 @@ async function main() {
     console.log("AI service test mode enabled \u2014 using mock AI responses");
   }
   if (debug) {
-    console.log(`[debug] Build timestamp: ${"2026-05-25T01:05:23.807Z"}`);
+    console.log(`[debug] Build timestamp: ${"2026-05-27T07:53:08.605Z"}`);
   }
   if (projectDir !== null) {
     process.chdir(projectDir);