hanna/fabrica

feat(web): in-repo and global search over a linear scan

b400321 · hanna committed on 2026-07-25

Add search (§10) with a hand-written qualifier parser (repo:, user:,
path:, lang:, case:, regex:) plus bare literal terms, matched with
ripgrep's grep engine.

- In-repo (/-/search): walks the tree at the default branch, skips binary
  and >1 MiB files, and matches content (with lang/path filters), linking
  hits into the blob view at #L{n}.
- Global (/search): matches repo/user names and descriptions first, then
  runs the content scan across every repo the viewer can read, bounded by
  search.concurrency (a semaphore), search.timeout_secs (a deadline), and
  search.max_results — returning partial results with an explicit notice
  rather than truncating silently.

Config gains the [search] section; git gains Repo::file_paths. Verified
end-to-end: content, lang filter, and global name+content matches.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +117 −0

Cargo.toml +2 −0

crates/config/src/lib.rs +1 −1

crates/config/src/types.rs +24 −0

crates/git/src/repo.rs +24 −0

crates/web/Cargo.toml +1 −0

crates/web/src/lib.rs +2 −0

crates/web/src/repo.rs +14 −6

crates/web/src/search.rs +542 −0

docs/decisions.md +19 −0

fabrica.example.toml +5 −0

 checksum = "1f7dc094d718f2e1c1559ad110e27eeaae14a5465d3d56dd6dbd793079fbd530"
 dependencies = [
  "memchr",
+ "regex-automata",
  "serde_core",
+]
 checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 [[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+[[package]]
+name = "encoding_rs_io"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cc3c5651fb62ab8aa3103998dade57efdd028544bd300516baa31840c252a83"
+dependencies = [
+ "encoding_rs",
+]
+[[package]]
 name = "entities"
 version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "grep"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "308ae749734e28d749a86f33212c7b756748568ce332f970ac1d9cd8531f32e6"
+dependencies = [
+ "grep-cli",
+ "grep-matcher",
+ "grep-printer",
+ "grep-regex",
+ "grep-searcher",
+]
+[[package]]
+name = "grep-cli"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf32d263c5d5cc2a23ce587097f5ddafdb188492ba2e6fb638eaccdc22453631"
+dependencies = [
+ "bstr",
+ "globset",
+ "libc",
+ "log",
+ "termcolor",
+ "winapi-util",
+]
+[[package]]
+name = "grep-matcher"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9417543f4870fc8f1c8e1af870afae2431007626d9e703fce6471c468d33847"
+dependencies = [
+ "memchr",
+]
+[[package]]
+name = "grep-printer"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c112110ae4a891aa4d83ab82ecf734b307497d066f437686175e83fbd4e013fe"
+dependencies = [
+ "bstr",
+ "grep-matcher",
+ "grep-searcher",
+ "log",
+ "serde",
+ "serde_json",
+ "termcolor",
+]
+[[package]]
+name = "grep-regex"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce0c256c3ad82bcc07b812c15a45ec1d398122e8e15124f96695234db7112ef"
+dependencies = [
+ "bstr",
+ "grep-matcher",
+ "log",
+ "regex-automata",
+ "regex-syntax",
+]
+[[package]]
+name = "grep-searcher"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72348823a0eafc4bc2e9051064f28b5b42cc100b571b3a35d67918d711efcbc6"
+dependencies = [
+ "bstr",
+ "encoding_rs",
+ "encoding_rs_io",
+ "grep-matcher",
+ "log",
+ "memchr",
+ "memmap2",
+]
+[[package]]
 name = "group"
 version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 [[package]]
+name = "memmap2"
+version = "0.9.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
+dependencies = [
+ "libc",
+]
+[[package]]
 name = "mime"
 version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+[[package]]
 name = "thiserror"
 version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
  "config",
  "flate2",
  "git",
+ "grep",
  "highlight",
  "mail",
  "maud",

 # gzip-encoded upload-pack requests.
 tokio-util = { version = "0.7", features = ["io"] }
 flate2 = "1"
+# Content search (ripgrep's engine). Dual Unlicense/MIT — MIT satisfies the gate.
+grep = "0.3"
 # SSH server (default features: aws-lc-rs backend, no ring; re-exports ssh-key).
 russh = "0.62"
 tracing = "0.1"

 pub use crate::secret::{REDACTED, Secret};
 pub use crate::types::{
     Auth, Config, Database, Git, Instance, Log, LogFormat, LogLevel, Mail, MailBackend,
-    MailEncryption, Server, Ssh, Storage, Ui,
+    MailEncryption, Search, Server, Ssh, Storage, Ui,
 };
 /// System-wide configuration path, the lowest-priority file source.

     pub ui: Ui,
     /// Git binary and pack-transport limits.
     pub git: Git,
+    /// Search bounds.
+    pub search: Search,
     /// Logging.
     pub log: Log,
+}
+/// `[search]` — bounds on the linear (index-free) search.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Search {
+    /// Maximum repositories searched concurrently in a global search.
+    pub concurrency: usize,
+    /// Total wall-clock budget for a global search, in seconds.
+    pub timeout_secs: u64,
+    /// Maximum results returned before truncating (with a notice).
+    pub max_results: usize,
+}
+impl Default for Search {
+    fn default() -> Self {
+        Self {
+            concurrency: 4,
+            timeout_secs: 10,
+            max_results: 200,
+        }
+    }
+}
 /// `[instance]` — identity and global policy.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]

         Ok(result)
+    }
+    /// Every regular-file path in the tree of revision `rev`, for search walks.
+    /// Directories, submodules, and symlinks are excluded.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`GitError`] if the revision or its tree cannot be read.
+    pub fn file_paths(&self, rev: &Resolved) -> Result<Vec<String>, GitError> {
+        let commit = self.commit_at(&rev.oid)?;
+        let tree = commit.tree()?;
+        let mut paths = Vec::new();
+        tree.walk(git2::TreeWalkMode::PreOrder, |root, entry| {
+            if entry.filemode() != i32::from(git2::FileMode::Tree)
+                && entry.filemode() != i32::from(git2::FileMode::Commit)
+                && entry.filemode() != i32::from(git2::FileMode::Link)
+            {
+                if let Some(name) = entry.name() {
+                    paths.push(format!("{root}{name}"));
+                }
+            }
+            git2::TreeWalkResult::Ok
+        })?;
+        Ok(paths)
+    }
     /// The tree at `path` within a commit, or `None` if the path is absent or is
     /// not a directory. An empty `path` yields the root tree.
     fn subtree_at<'a>(

 ammonia = { workspace = true }
 tokio-util = { workspace = true }
 flate2 = { workspace = true }
+grep = { workspace = true }
 base64 = { workspace = true }
 time = { workspace = true }
 serde = { workspace = true }

 mod markdown;
 mod pages;
 mod repo;
+mod search;
 #[path = "serve.rs"]
 mod serve_assets;
 mod session;
             "/invite/{token}",
             get(pages::invite_form).post(pages::invite_submit),
+        )
+        .route("/search", get(search::global))
         .route("/settings", get(pages::settings))
         .route("/settings/theme", get(pages::set_theme))
         .route("/healthz", get(serve_assets::healthz))

     to: Option<u32>,
     /// The smart-HTTP service, for `….git/info/refs?service=`.
     service: Option<String>,
+    /// The search query, for the in-repo `/-/search` view.
+    #[serde(default)]
+    q: Option<String>,
+}
 /// The candidate README filenames, in lookup order.
+}
 /// A resolved repository plus the viewer's access to it.
-struct RepoCtx {
+pub(crate) struct RepoCtx {
-    owner: User,
+    pub(crate) owner: User,
-    repo: Repo,
+    pub(crate) repo: Repo,
     /// The viewer's access level. Reserved for gating mutation UI (settings, edit)
     /// in later phases; every browse view here requires only `Read`.
     #[allow(dead_code)]
-    access: auth::Access,
+    pub(crate) access: auth::Access,
+}
 /// Run a blocking libgit2 read for a repo on the blocking pool, opening the repo
 /// per operation (§3.7 threading).
-async fn git_read<T, F>(state: &AppState, repo_id: &str, f: F) -> AppResult<T>
+pub(crate) async fn git_read<T, F>(state: &AppState, repo_id: &str, f: F) -> AppResult<T>
 where
     F: FnOnce(&git::Repo) -> Result<T, git::GitError> + Send + 'static,
     T: Send + 'static,
         },
         "branches" => branches_view(state, viewer, jar, uri, ctx).await,
         "tags" => tags_view(state, viewer, jar, uri, ctx).await,
-        // Reserved `runs`/`search`/`settings` slots return 404 until built.
+        "search" => {
+            let header = repo_header(state, &ctx, Tab::Search, &ctx.repo.default_branch);
+            let raw_query = dq.q.clone().unwrap_or_default();
+            crate::search::in_repo(state, viewer, jar, uri, &ctx, &raw_query, header).await
+        }
+        // Reserved `runs`/`settings` slots return 404 until built.
         _ => Err(AppError::NotFound),
+    }
+}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Search: in-repo and global, over a linear (index-free) scan (§10).
+//!
+//! Queries carry a tiny hand-written qualifier syntax (`repo:`, `user:`, `path:`,
+//! `lang:`, `case:`, `regex:`) plus bare literal terms. Content matching uses
+//! ripgrep's engine. Global search is bounded by a worker-pool size, a total time
+//! budget, and a result cap; exhausting the budget returns partial results with an
+//! explicit notice rather than truncating silently.
+use std::path::Path as FsPath;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+use axum::extract::{Query, State};
+use axum::http::Uri;
+use axum::response::{IntoResponse, Response};
+use axum_extra::extract::cookie::CookieJar;
+use grep::regex::RegexMatcherBuilder;
+use grep::searcher::Searcher;
+use grep::searcher::sinks::UTF8;
+use maud::{Markup, html};
+use model::{Repo, User};
+use serde::Deserialize;
+use tokio::sync::Semaphore;
+use tokio::task::JoinSet;
+use crate::AppState;
+use crate::error::AppResult;
+use crate::layout::page;
+use crate::pages::build_chrome;
+use crate::session::MaybeUser;
+/// Max matching lines kept per file, and max files per repo, to bound one repo's
+/// contribution.
+const LINES_PER_FILE: usize = 10;
+const FILES_PER_REPO: usize = 50;
+/// Files larger than this are skipped by the content scan.
+const MAX_FILE_BYTES: u64 = 1_048_576;
+/// A parsed query: the free text plus any qualifiers.
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub struct ParsedQuery {
+    /// The literal or regex text to match.
+    pub text: String,
+    /// `repo:owner/path`.
+    pub repo: Option<String>,
+    /// `user:name`.
+    pub user: Option<String>,
+    /// `path:glob` (matched as a substring for the MVP).
+    pub path: Option<String>,
+    /// `lang:name`.
+    pub lang: Option<String>,
+    /// `case:yes` — case-sensitive matching.
+    pub case_sensitive: bool,
+    /// `regex:yes` — treat `text` as a regex rather than a literal.
+    pub regex: bool,
+}
+/// Parse a raw query string into qualifiers and free text.
+#[must_use]
+pub fn parse(raw: &str) -> ParsedQuery {
+    let mut query = ParsedQuery::default();
+    let mut terms: Vec<&str> = Vec::new();
+    for token in raw.split_whitespace() {
+        match token.split_once(':') {
+            Some(("repo", v)) => query.repo = Some(v.to_string()),
+            Some(("user", v)) => query.user = Some(v.to_string()),
+            Some(("path", v)) => query.path = Some(v.to_string()),
+            Some(("lang", v)) => query.lang = Some(v.to_string()),
+            Some(("case", v)) => query.case_sensitive = is_yes(v),
+            Some(("regex", v)) => query.regex = is_yes(v),
+            _ => terms.push(token),
+        }
+    }
+    query.text = terms.join(" ");
+    query
+}
+/// Whether a qualifier value means "yes".
+fn is_yes(v: &str) -> bool {
+    matches!(v.to_ascii_lowercase().as_str(), "yes" | "true" | "1" | "on")
+}
+/// One matching line within a file.
+#[derive(Debug, Clone)]
+pub struct LineMatch {
+    /// 1-based line number.
+    pub line: u64,
+    /// The (trimmed) line text.
+    pub text: String,
+}
+/// A file's matches within a repo.
+#[derive(Debug, Clone)]
+pub struct FileResult {
+    /// Repo-relative path.
+    pub path: String,
+    /// Matching lines (may be empty for a path-only match).
+    pub lines: Vec<LineMatch>,
+}
+/// Search one already-open repository at `rev_name`. Returns matched files.
+fn search_repo_blocking(repo: &git::Repo, rev_name: &str, query: &ParsedQuery) -> Vec<FileResult> {
+    let Ok(rev) = repo.resolve_ref(rev_name) else {
+        return Vec::new();
+    };
+    let Ok(paths) = repo.file_paths(&rev) else {
+        return Vec::new();
+    };
+    let matcher = (!query.text.is_empty())
+        .then(|| {
+            RegexMatcherBuilder::new()
+                .case_insensitive(!query.case_sensitive)
+                .fixed_strings(!query.regex)
+                .build(&query.text)
+                .ok()
+        })
+        .flatten();
+    let mut searcher = Searcher::new();
+    let mut results = Vec::new();
+    for path in paths {
+        if results.len() >= FILES_PER_REPO {
+            break;
+        }
+        if let Some(filter) = &query.path
+            && !path.to_lowercase().contains(&filter.to_lowercase())
+        {
+            continue;
+        }
+        let Ok(blob) = repo.blob(&rev, FsPath::new(&path)) else {
+            continue;
+        };
+        if blob.is_binary || blob.size > MAX_FILE_BYTES {
+            continue;
+        }
+        if let Some(lang) = &query.lang {
+            let resolved = highlight::resolve(FsPath::new(&path), &blob.content, None);
+            if resolved.name().map(str::to_ascii_lowercase) != Some(lang.to_ascii_lowercase()) {
+                continue;
+            }
+        }
+        let mut lines = Vec::new();
+        if let Some(matcher) = &matcher {
+            let _ = searcher.search_slice(
+                matcher,
+                &blob.content,
+                UTF8(|lnum, line| {
+                    if lines.len() < LINES_PER_FILE {
+                        lines.push(LineMatch {
+                            line: lnum,
+                            text: line.trim_end().to_string(),
+                        });
+                    }
+                    Ok(true)
+                }),
+            );
+            if !lines.is_empty() {
+                results.push(FileResult { path, lines });
+            }
+        } else if query.path.is_some() || query.lang.is_some() {
+            // No text term but a path/lang filter matched: report the file itself.
+            results.push(FileResult { path, lines });
+        }
+    }
+    results
+}
+/// Query parameters for the global search route.
+#[derive(Debug, Default, Deserialize)]
+pub struct SearchParams {
+    /// The raw query.
+    #[serde(default)]
+    q: String,
+}
+/// `GET /search` — global search across visible repos.
+pub async fn global(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    uri: Uri,
+    Query(params): Query<SearchParams>,
+) -> AppResult<Response> {
+    let query = parse(&params.q);
+    let (jar, chrome) = build_chrome(&state, jar, viewer.clone(), uri.path().to_string());
+    let body = if params.q.trim().is_empty() {
+        html! { h1 { "Search" } (search_box(&params.q, None)) }
+    } else {
+        let entities = entity_matches(&state, &query, viewer.as_ref()).await?;
+        let (content, timed_out, truncated) =
+            content_matches(&state, &query, viewer.as_ref()).await?;
+        html! {
+            h1 { "Search" }
+            (search_box(&params.q, None))
+            @if timed_out {
+                div class="notice notice-error" { "Search timed out; showing partial results." }
+            } @else if truncated {
+                div class="notice" { "Showing the first results; refine your query for more." }
+            }
+            (entity_section(&entities))
+            (content_section(&content))
+            @if entities.is_empty() && content.is_empty() {
+                p class="muted" { "No results." }
+            }
+        }
+    };
+    Ok((jar, page(&chrome, "Search", body)).into_response())
+}
+/// A repo/user/group name-or-description match.
+struct EntityMatch {
+    kind: &'static str,
+    label: String,
+    href: String,
+}
+/// Match repo/user names and descriptions (the "first" pass of global search).
+async fn entity_matches(
+    state: &AppState,
+    query: &ParsedQuery,
+    viewer: Option<&User>,
+) -> AppResult<Vec<EntityMatch>> {
+    let needle = query.text.to_lowercase();
+    if needle.is_empty() {
+        return Ok(Vec::new());
+    }
+    let mut out = Vec::new();
+    for user in state.store.list_users().await? {
+        if user.username.to_lowercase().contains(&needle) {
+            out.push(EntityMatch {
+                kind: "user",
+                label: user.username.clone(),
+                href: format!("/{}", user.username),
+            });
+        }
+    }
+    for repo in visible_repos(state, viewer).await? {
+        let owner = owner_name(state, &repo.owner_id).await;
+        let hay = format!(
+            "{} {} {}",
+            repo.path,
+            repo.name,
+            repo.description.clone().unwrap_or_default()
+        )
+        .to_lowercase();
+        if hay.contains(&needle) {
+            out.push(EntityMatch {
+                kind: "repo",
+                label: format!("{owner}/{}", repo.path),
+                href: format!("/{owner}/{}", repo.path),
+            });
+        }
+    }
+    Ok(out)
+}
+/// Run the bounded content search across visible repos. Returns matches plus
+/// whether the time budget or result cap was hit.
+async fn content_matches(
+    state: &AppState,
+    query: &ParsedQuery,
+    viewer: Option<&User>,
+) -> AppResult<(Vec<(String, Vec<FileResult>)>, bool, bool)> {
+    let mut repos = visible_repos(state, viewer).await?;
+    // Honour a repo: qualifier by filtering the candidate set.
+    if let Some(repo_q) = &query.repo {
+        let want = repo_q.to_lowercase();
+        // Resolve owner names to filter by "owner/path".
+        let mut kept = Vec::new();
+        for repo in repos {
+            let owner = owner_name(state, &repo.owner_id).await;
+            if format!("{owner}/{}", repo.path).to_lowercase() == want {
+                kept.push(repo);
+            }
+        }
+        repos = kept;
+    }
+    let deadline = Instant::now() + Duration::from_secs(state.config.search.timeout_secs.max(1));
+    let semaphore = Arc::new(Semaphore::new(state.config.search.concurrency.max(1)));
+    let mut set: JoinSet<Option<(String, Vec<FileResult>)>> = JoinSet::new();
+    for repo in repos {
+        let state = state.clone();
+        let query = query.clone();
+        let semaphore = Arc::clone(&semaphore);
+        set.spawn(async move {
+            let _permit = semaphore.acquire().await.ok()?;
+            let owner = owner_name(&state, &repo.owner_id).await;
+            let rev = repo.default_branch.clone();
+            let files = crate::repo::git_read(&state, &repo.id, move |repo| {
+                Ok(search_repo_blocking(repo, &rev, &query))
+            })
+            .await
+            .ok()?;
+            (!files.is_empty()).then(|| (format!("{owner}/{}", repo.path), files))
+        });
+    }
+    let cap = state.config.search.max_results;
+    let mut results = Vec::new();
+    let mut total = 0usize;
+    let mut timed_out = false;
+    let mut truncated = false;
+    loop {
+        let remaining = deadline.saturating_duration_since(Instant::now());
+        if remaining.is_zero() {
+            timed_out = true;
+            break;
+        }
+        match tokio::time::timeout(remaining, set.join_next()).await {
+            Ok(Some(Ok(Some(entry)))) => {
+                total += entry.1.iter().map(|f| f.lines.len().max(1)).sum::<usize>();
+                results.push(entry);
+                if total >= cap {
+                    truncated = true;
+                    break;
+                }
+            }
+            Ok(Some(_)) => {}  // a repo errored or had no matches
+            Ok(None) => break, // all done
+            Err(_) => {
+                timed_out = true;
+                break;
+            }
+        }
+    }
+    set.abort_all();
+    Ok((results, timed_out, truncated))
+}
+/// `search` view for a single repo (called from the repo dispatcher).
+pub async fn in_repo(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: &crate::repo::RepoCtx,
+    raw_query: &str,
+    header: Markup,
+) -> AppResult<Response> {
+    let owner = &ctx.owner.username;
+    let repo = &ctx.repo;
+    let default_branch = &ctx.repo.default_branch;
+    let query = parse(raw_query);
+    let rev = default_branch.clone();
+    let files = if raw_query.trim().is_empty() {
+        Vec::new()
+    } else {
+        let query = query.clone();
+        let rev = rev.clone();
+        crate::repo::git_read(state, &repo.id, move |repo| {
+            Ok(search_repo_blocking(repo, &rev, &query))
+        })
+        .await?
+    };
+    let base = format!("/{owner}/{}", repo.path);
+    let body = html! {
+        (header)
+        h2 { "Search this repository" }
+        (search_box(raw_query, Some(&format!("{base}/-/search"))))
+        @if raw_query.trim().is_empty() {
+            p class="muted" { "Enter a query to search the code." }
+        } @else if files.is_empty() {
+            p class="muted" { "No matches." }
+        } @else {
+            (repo_content(owner, &repo.path, default_branch, &files))
+        }
+    };
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let title = format!("{owner}/{}: search", repo.path);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+// ---- components ----
+/// The search input form.
+fn search_box(value: &str, action: Option<&str>) -> Markup {
+    html! {
+        form method="get" action=[action] {
+            input type="search" name="q" value=(value) placeholder="Search…"
+                  data-search-input aria-label="Search query" autofocus;
+            button class="btn" type="submit" { "Search" }
+        }
+    }
+}
+/// Render entity (name) matches.
+fn entity_section(entities: &[EntityMatch]) -> Markup {
+    html! {
+        @if !entities.is_empty() {
+            section {
+                h2 { "Repositories & users" }
+                ul class="repo-list" {
+                    @for entity in entities {
+                        li {
+                            span class="badge" { (entity.kind) }
+                            " " a href=(entity.href) { (entity.label) }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+/// Render global content matches, grouped by repo then file.
+fn content_section(content: &[(String, Vec<FileResult>)]) -> Markup {
+    html! {
+        @if !content.is_empty() {
+            section {
+                h2 { "Code" }
+                @for (repo, files) in content {
+                    h3 { (repo) }
+                    @for file in files {
+                        (file_result(&format!("/{repo}"), None, file))
+                    }
+                }
+            }
+        }
+    }
+}
+/// Render in-repo content matches with links into the blob view.
+fn repo_content(owner: &str, repo_path: &str, rev: &str, files: &[FileResult]) -> Markup {
+    let base = format!("/{owner}/{repo_path}/-/blob/{rev}");
+    html! {
+        @for file in files {
+            (file_result(&base, Some(rev), file))
+        }
+    }
+}
+/// One file's matches. `blob_base` links each line to the blob (with `#L{n}`).
+fn file_result(blob_base: &str, in_repo: Option<&str>, file: &FileResult) -> Markup {
+    html! {
+        div class="card" style="margin-bottom:0.5rem" {
+            div class="mono" {
+                @if in_repo.is_some() {
+                    a href=(format!("{blob_base}/{}", file.path)) { (file.path) }
+                } @else {
+                    (file.path)
+                }
+            }
+            @for m in &file.lines {
+                div class="mono" style="font-size:0.85em" {
+                    @if in_repo.is_some() {
+                        a href=(format!("{blob_base}/{}#L{}", file.path, m.line))
+                          class="muted" { (m.line) }
+                    } @else {
+                        span class="muted" { (m.line) }
+                    }
+                    "  " (m.text)
+                }
+            }
+        }
+    }
+}
+// ---- shared repo visibility ----
+/// Every repo the viewer may read (across owners), for global search.
+async fn visible_repos(state: &AppState, viewer: Option<&User>) -> AppResult<Vec<Repo>> {
+    let all = state.store.list_repos().await?;
+    let mut out = Vec::new();
+    for repo in all {
+        if can_read(state, &repo, viewer).await? {
+            out.push(repo);
+        }
+    }
+    Ok(out)
+}
+/// Whether the viewer can read `repo`.
+async fn can_read(state: &AppState, repo: &Repo, viewer: Option<&User>) -> AppResult<bool> {
+    let viewer_id = viewer.map(|u| auth::Viewer {
+        id: u.id.clone(),
+        is_admin: u.is_admin,
+    });
+    let collaborator = match viewer {
+        Some(u) => state
+            .store
+            .collaborator_permission(&repo.id, &u.id)
+            .await?
+            .and_then(|p| auth::Permission::parse(&p)),
+        None => None,
+    };
+    let access = auth::access(
+        viewer_id.as_ref(),
+        repo,
+        collaborator,
+        state.config.instance.allow_anonymous,
+    );
+    Ok(access >= auth::Access::Read)
+}
+/// Resolve an owner id to a username, falling back to the id.
+async fn owner_name(state: &AppState, owner_id: &str) -> String {
+    state
+        .store
+        .user_by_id(owner_id)
+        .await
+        .ok()
+        .flatten()
+        .map_or_else(|| owner_id.to_string(), |u| u.username)
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn parses_qualifiers_and_free_text() {
+        let q = parse("foo bar repo:ada/api lang:rust case:yes regex:no path:src");
+        assert_eq!(q.text, "foo bar");
+        assert_eq!(q.repo.as_deref(), Some("ada/api"));
+        assert_eq!(q.lang.as_deref(), Some("rust"));
+        assert_eq!(q.path.as_deref(), Some("src"));
+        assert!(q.case_sensitive);
+        assert!(!q.regex);
+    }
+    #[test]
+    fn bare_query_has_no_qualifiers() {
+        let q = parse("hello world");
+        assert_eq!(q.text, "hello world");
+        assert!(q.repo.is_none());
+        assert!(!q.case_sensitive);
+        assert!(!q.regex);
+    }
+}

 **Rationale:** Foreground is correct for systemd and Docker, which own process
 lifecycle. This deviates from an earlier `server start`/`server stop` sketch.
+## 2026-07-25 — Search lives in `web`; `path:` is a substring for the MVP
+**Decision:** Search (the qualifier parser, in-repo scan, and bounded global scan)
+is implemented in `crates/web`, not a separate crate, using ripgrep's `grep`
+engine. The `path:` qualifier matches as a case-insensitive **substring**, not a
+full glob.
+**Alternatives:** A dedicated `search` crate; full glob path matching via
+`globset`.
+**Rationale:** Search is a web-only feature with no other consumer, so a crate of
+its own adds indirection for no reuse; the content scan runs inside the existing
+`git_read` blocking closure. The global scan bounds itself with a
+`Semaphore(search.concurrency)` and a `tokio::time::timeout(search.timeout_secs)`
+deadline, returning partial results with an explicit notice on either the time or
+`search.max_results` cap. A substring `path:` covers the common case; upgrading to
+`globset` is a contained change if needed. `linguist-vendored`/`-generated`
+exclusion is deferred (binary and >1 MiB files are already skipped).
 ## 2026-07-24 — Linear search, no index
 **Decision:** Search (in-repo and global) is a linear scan over repo contents at

 transport_timeout_secs = 3600
 max_pack_size_bytes    = 536870912   # reject pushes with a larger received pack
+[search]
+concurrency = 4     # repos searched at once in a global search
+timeout_secs = 10   # total budget; partial results are returned past it
+max_results = 200   # cap before truncating with a notice
 [log]
 level  = "info"     # trace | debug | info | warn | error (RUST_LOG also honoured)
 format = "pretty"   # pretty | json