From e04d65ca2f1b82bdd5ec037e6340df05833b3613 Mon Sep 17 00:00:00 2001
From: gl0w <gl0w@world>
Date: Thu, 10 Sep 2026 07:09:44 +0100
Subject: [PATCH] m6/diff-colors: tokyo night diff classes dark+light (153
 tests)

---
 src/commits.rs |  78 +++++++++++++++++++++++++++++++--
 src/forge.rs   |  49 ++++++++++++++++++++-
 src/layout.rs  | 117 ++++++++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 237 insertions(+), 7 deletions(-)

diff --git a/src/commits.rs b/src/commits.rs
index 3467d9f..9c3b288 100644
--- a/src/commits.rs
+++ b/src/commits.rs
@@ -1,14 +1,15 @@
 //! `commits.html` + `commit/<sha>.html` (m2, f0rge issue #5).
 //!
-//! Commit subjects, messages, and diffs are untrusted: everything goes
-//! through [`crate::layout::esc`] into an escaped `<pre>`. Diffs come from
+//! Commit subjects and messages go through [`crate::layout::esc`]; diffs go
+//! through [`crate::layout::diff_html`] (escaped line-level color spans in an
+//! escaped `<pre>`, m6 diff-colors f0rge #22). Diffs come from
 //! [`crate::gitx::diff`] (binary content noted, output truncated past
 //! 2000 lines with a marker). Nothing here goes through markdown.
 
 use std::path::Path;
 
 use crate::gitx;
-use crate::layout::{esc, page_site};
+use crate::layout::{diff_html, esc, page_site};
 
 /// Short display form of a full sha (first 7 hex chars, git-style).
 #[must_use]
@@ -72,7 +73,7 @@ pub fn render_loaded(
             esc(&c.author),
             esc(&c.date),
             esc(&message),
-            esc(&diff),
+            diff_html(&diff),
         );
         let html = page_site(
             &format!("commit {} — {site_name}", short_sha(&c.sha)),
@@ -237,6 +238,75 @@ mod tests {
         );
     }
 
+    #[test]
+    fn diff_lines_carry_color_spans() {
+        // m6 diff-colors (f0rge #22): hunk cyan, +++/--- bold, + green, - red.
+        let repo = fixture_repo();
+        let out = mktemp("out");
+        render(&repo, &out, "main", 100, "test", "<nav>", None).expect("render");
+        let sha = shas(&repo)[1].clone(); // text hunk + binary commit
+        let detail = std::fs::read_to_string(out.join("commit").join(format!("{sha}.html")))
+            .expect("detail");
+        assert!(
+            detail.contains("<span class=\"diff-hunk\">@@"),
+            "hunk header cyan: {detail}"
+        );
+        assert!(
+            detail.contains("<span class=\"diff-file\">---"),
+            "--- file line bold: {detail}"
+        );
+        assert!(
+            detail.contains("<span class=\"diff-file\">+++"),
+            "+++ file line bold: {detail}"
+        );
+        assert!(
+            detail.contains("<span class=\"diff-add\">+line two added</span>"),
+            "added line green: {detail}"
+        );
+        // Binary note + truncation marker behavior intact (no span, still shown).
+        assert!(
+            detail.contains("Binary files") || detail.contains(gitx::BINARY_NOTE),
+            "binary note intact"
+        );
+        let huge_sha = shas(&repo)[0].clone();
+        let huge = std::fs::read_to_string(out.join("commit").join(format!("{huge_sha}.html")))
+            .expect("huge detail");
+        assert!(
+            huge.contains(gitx::DIFF_TRUNCATED_MARKER),
+            "truncation marker intact with spans"
+        );
+    }
+
+    #[test]
+    fn diff_escaping_intact_inside_spans() {
+        // Evil `<script>` added line: escaped, still inside the green span.
+        let dir = mktemp("evil-diff");
+        git(&dir, &["init", "-b", "main"]);
+        git(&dir, &["config", "user.name", "hu13-test"]);
+        git(&dir, &["config", "user.email", "hu13@test.local"]);
+        git(&dir, &["config", "commit.gpgsign", "false"]);
+        std::fs::write(dir.join("x.txt"), "ok\n").unwrap();
+        git(&dir, &["add", "-A"]);
+        git(&dir, &["commit", "-m", "base"]);
+        std::fs::write(dir.join("x.txt"), "ok\nevil <script>alert(1)</script>\n").unwrap();
+        git(&dir, &["add", "-A"]);
+        git(&dir, &["commit", "-m", "evil diff"]);
+        let out = mktemp("out");
+        render(&dir, &out, "main", 100, "test", "<nav>", None).expect("render");
+        let sha = shas(&dir)[0].clone();
+        let detail = std::fs::read_to_string(out.join("commit").join(format!("{sha}.html")))
+            .expect("detail");
+        assert!(!detail.contains("<script>alert(1)</script>"), "no raw HTML");
+        assert!(
+            detail.contains("&lt;script&gt;"),
+            "escaped form present: {detail}"
+        );
+        assert!(
+            detail.contains("<span class=\"diff-add\">+evil &lt;script&gt;"),
+            "escaped inside green span: {detail}"
+        );
+    }
+
     #[test]
     fn max_log_limits_list_and_details() {
         let repo = fixture_repo();
diff --git a/src/forge.rs b/src/forge.rs
index 951136b..1f8af3e 100644
--- a/src/forge.rs
+++ b/src/forge.rs
@@ -23,7 +23,7 @@ use std::path::Path;
 use serde::Deserialize;
 
 use crate::build::markdown_to_html;
-use crate::layout::{esc, page_site};
+use crate::layout::{diff_html, esc, page_site};
 
 /// `.forge/` files larger than this are skipped (schema SEC-01: 256 KiB).
 pub const FORGE_MAX_BYTES: u64 = 256 * 1024;
@@ -898,7 +898,7 @@ fn render_pr_page(pr: &Pr, site_name: &str, nav: &str, description: Option<&str>
         Some(patch) if !patch.is_empty() => {
             body.push_str(&format!(
                 "<div class=\"pre-scroll\"><pre class=\"diff\">{}</pre></div>\n",
-                esc(patch)
+                diff_html(patch)
             ));
         }
         _ => body.push_str("<p class=\"muted\">No patch attached.</p>\n"),
@@ -1326,6 +1326,51 @@ mod tests {
         assert!(html.contains("lgtm"), "review body shown");
     }
 
+    #[test]
+    fn pr_patch_lines_carry_diff_spans() {
+        // m6 diff-colors (f0rge #22): PR patch.diff shares the commit renderer.
+        let repo = mktemp("pr-diff");
+        write_forge(
+            &repo,
+            "prs/cccccccc-cccc-cccc-cccc-cccccccccccc/pr.md",
+            "---\nid: cccccccc-cccc-cccc-cccc-cccccccccccc\ntitle: Fix it\nstate: open\nbase: main\nhead: fix\ncreated: 2026-09-10T03:00:00Z\n---\ndesc\n",
+        );
+        let dest = repo
+            .join(".forge")
+            .join("prs/cccccccc-cccc-cccc-cccc-cccccccccccc/patch.diff");
+        std::fs::write(
+            &dest,
+            "diff --git a/x b/x\n--- a/x\n+++ b/x\n@@ -1 +1 @@\n-old\n+evil <script>\n",
+        )
+        .unwrap();
+        let out = mktemp("pr-diff-out");
+        render_loaded(&load(&repo), &out, "test", "<nav>", None).expect("render");
+        let html =
+            std::fs::read_to_string(out.join("pulls/cccccccc-cccc-cccc-cccc-cccccccccccc.html"))
+                .expect("pr page");
+        assert!(
+            html.contains("<span class=\"diff-hunk\">@@ -1 +1 @@</span>"),
+            "hunk cyan: {html}"
+        );
+        assert!(
+            html.contains("<span class=\"diff-file\">--- a/x</span>"),
+            "--- file bold"
+        );
+        assert!(
+            html.contains("<span class=\"diff-file\">+++ b/x</span>"),
+            "+++ file bold"
+        );
+        assert!(
+            html.contains("<span class=\"diff-del\">-old</span>"),
+            "removed red"
+        );
+        assert!(!html.contains("<script>"), "patch escaped");
+        assert!(
+            html.contains("<span class=\"diff-add\">+evil &lt;script&gt;</span>"),
+            "added green, escaped in span"
+        );
+    }
+
     #[test]
     fn tasks_group_and_ci_fail_badge() {
         let repo = mktemp("taskci");
diff --git a/src/layout.rs b/src/layout.rs
index fbecd44..af31aa2 100644
--- a/src/layout.rs
+++ b/src/layout.rs
@@ -24,6 +24,60 @@ pub fn esc(input: &str) -> String {
     out
 }
 
+/// Render unified diff / patch text as escaped HTML with line-level color
+/// spans (m6 diff-colors, f0rge issue #22; Tokyo Night vars in
+/// `static/style.css`, dark + light).
+///
+/// Line kinds (line-level only, no word-diff): `@@` hunk headers go in
+/// `<span class="diff-hunk">`, `+++`/`---` file lines in
+/// `<span class="diff-file">` (bold fg), `+` additions in
+/// `<span class="diff-add">`, `-` removals in `<span class="diff-del">`.
+/// Everything else (context, `diff --git` / `index` headers, commit
+/// metadata, `Binary files ... differ` notes, `[hu13: ...]` truncation /
+/// binary markers) is escaped as-is with no span so truncation and binary
+/// behavior stay intact. Every line is escaped with [`esc`] before wrapping,
+/// so hostile `<script>` inside an added line renders as text. Output joins
+/// lines with `\n` (preserving a trailing newline) for use inside an
+/// already-escaped `<pre class="diff">`.
+#[must_use]
+pub fn diff_html(raw: &str) -> String {
+    if raw.is_empty() {
+        return String::new();
+    }
+    let mut out = String::with_capacity(raw.len() + raw.len() / 4);
+    let mut first = true;
+    for line in raw.lines() {
+        if !first {
+            out.push('\n');
+        }
+        first = false;
+        let e = esc(line);
+        if line.starts_with("@@") {
+            out.push_str("<span class=\"diff-hunk\">");
+            out.push_str(&e);
+            out.push_str("</span>");
+        } else if line.starts_with("+++") || line.starts_with("---") {
+            out.push_str("<span class=\"diff-file\">");
+            out.push_str(&e);
+            out.push_str("</span>");
+        } else if line.starts_with('+') {
+            out.push_str("<span class=\"diff-add\">");
+            out.push_str(&e);
+            out.push_str("</span>");
+        } else if line.starts_with('-') {
+            out.push_str("<span class=\"diff-del\">");
+            out.push_str(&e);
+            out.push_str("</span>");
+        } else {
+            out.push_str(&e);
+        }
+    }
+    if raw.ends_with('\n') {
+        out.push('\n');
+    }
+    out
+}
+
 /// Render a full HTML page. `title` is escaped; `nav` and `body` are
 /// inlined as-is (caller must escape untrusted text with [`esc`]).
 #[allow(dead_code)]
@@ -189,7 +243,7 @@ pub fn healthcheck_page() -> String {
 
 #[cfg(test)]
 mod tests {
-    use super::{esc, healthcheck_page, page};
+    use super::{diff_html, esc, healthcheck_page, page};
 
     #[test]
     fn esc_escapes_angle_amp_quote() {
@@ -349,4 +403,65 @@ mod tests {
         let pre = "<a href=\"/\" aria-current=\"page\">code</a>";
         assert_eq!(apply_active(pre, "/"), pre);
     }
+
+    #[test]
+    fn diff_html_colors_each_line_kind() {
+        // m6 diff-colors (f0rge #22): line-level only, spans + classes.
+        let raw = "diff --git a/notes.txt b/notes.txt\n\
+--- a/notes.txt\n+++ b/notes.txt\n\
+@@ -1 +1,2 @@\n line one\n-line gone\n+line two added\n";
+        let html = diff_html(raw);
+        assert!(
+            html.contains("<span class=\"diff-hunk\">@@ -1 +1,2 @@</span>"),
+            "hunk cyan: {html}"
+        );
+        assert!(
+            html.contains("<span class=\"diff-file\">--- a/notes.txt</span>"),
+            "--- file bold: {html}"
+        );
+        assert!(
+            html.contains("<span class=\"diff-file\">+++ b/notes.txt</span>"),
+            "+++ file bold: {html}"
+        );
+        assert!(
+            html.contains("<span class=\"diff-add\">+line two added</span>"),
+            "added green: {html}"
+        );
+        assert!(
+            html.contains("<span class=\"diff-del\">-line gone</span>"),
+            "removed red: {html}"
+        );
+        // Context + `diff --git` header stay plain (no span).
+        assert!(html.contains(" line one"), "context kept");
+        assert!(html.contains("diff --git"), "diff header kept");
+        assert!(!html.contains("<span> line one"), "context has no span");
+    }
+
+    #[test]
+    fn diff_html_escapes_before_wrapping() {
+        let html = diff_html("+evil <script>alert(1)</script>\n-old & \"quoted\"\n");
+        assert!(!html.contains("<script>"), "no raw HTML: {html}");
+        assert!(
+            html.contains(
+                "<span class=\"diff-add\">+evil &lt;script&gt;alert(1)&lt;/script&gt;</span>"
+            ),
+            "added line escaped in span: {html}"
+        );
+        assert!(
+            html.contains("<span class=\"diff-del\">-old &amp; &quot;quoted&quot;</span>"),
+            "removed line escaped in span: {html}"
+        );
+    }
+
+    #[test]
+    fn diff_html_keeps_markers_as_plain_text() {
+        // Truncation + binary notes pass through escaped, span-free.
+        let marker = "[hu13: diff truncated at 2000 lines]";
+        let binary = "Binary files a/bin.dat and b/bin.dat differ";
+        let html = diff_html(&format!("+x\n{marker}\n{binary}\n"));
+        assert!(html.contains("<span class=\"diff-add\">+x</span>"));
+        assert!(html.contains(marker), "truncation marker intact");
+        assert!(html.contains("Binary files"), "binary note intact");
+        assert!(!html.contains("<span>\n[hu13"), "markers have no span");
+    }
 }
-- 
2.55.0