hanna/fabrica

feat(web): in-repo and global search over a linear scan

b400321 · hanna committed on 2026-07-25

Add search (§10) with a hand-written qualifier parser (repo:, user:,
path:, lang:, case:, regex:) plus bare literal terms, matched with
ripgrep's grep engine.

- In-repo (/-/search): walks the tree at the default branch, skips binary
  and >1 MiB files, and matches content (with lang/path filters), linking
  hits into the blob view at #L{n}.
- Global (/search): matches repo/user names and descriptions first, then
  runs the content scan across every repo the viewer can read, bounded by
  search.concurrency (a semaphore), search.timeout_secs (a deadline), and
  search.max_results — returning partial results with an explicit notice
  rather than truncating silently.

Config gains the [search] section; git gains Repo::file_paths. Verified
end-to-end: content, lang filter, and global name+content matches.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +117 −0

Cargo.toml +2 −0

crates/config/src/lib.rs +1 −1

crates/config/src/types.rs +24 −0

crates/git/src/repo.rs +24 −0

crates/web/Cargo.toml +1 −0

crates/web/src/lib.rs +2 −0

crates/web/src/repo.rs +14 −6

crates/web/src/search.rs +542 −0

docs/decisions.md +19 −0

fabrica.example.toml +5 −0

 checksum = "1f7dc094d718f2e1c1559ad110e27eeaae14a5465d3d56dd6dbd793079fbd530"
 dependencies = [
  "memchr",
  "regex-automata",
  "serde_core",
+]
 checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
 dependencies = [
  "cfg-if",
+]
 [[package]]
 name = "encoding_rs_io"
 version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1cc3c5651fb62ab8aa3103998dade57efdd028544bd300516baa31840c252a83"
 dependencies = [
  "encoding_rs",
+]
 [[package]]
 name = "entities"
 version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2003,6 +2022,85 @@ dependencies = [ @@
+]
 [[package]]
 name = "grep"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "308ae749734e28d749a86f33212c7b756748568ce332f970ac1d9cd8531f32e6"
 dependencies = [
  "grep-cli",
  "grep-matcher",
  "grep-printer",
  "grep-regex",
  "grep-searcher",
+]
 [[package]]
 name = "grep-cli"
 version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf32d263c5d5cc2a23ce587097f5ddafdb188492ba2e6fb638eaccdc22453631"
 dependencies = [
  "bstr",
  "globset",
  "libc",
  "log",
  "termcolor",
  "winapi-util",
+]
 [[package]]
 name = "grep-matcher"
 version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9417543f4870fc8f1c8e1af870afae2431007626d9e703fce6471c468d33847"
 dependencies = [
  "memchr",
+]
 [[package]]
 name = "grep-printer"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c112110ae4a891aa4d83ab82ecf734b307497d066f437686175e83fbd4e013fe"
 dependencies = [
  "bstr",
  "grep-matcher",
  "grep-searcher",
  "log",
  "serde",
  "serde_json",
  "termcolor",
+]
 [[package]]
 name = "grep-regex"
 version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ce0c256c3ad82bcc07b812c15a45ec1d398122e8e15124f96695234db7112ef"
 dependencies = [
  "bstr",
  "grep-matcher",
  "log",
  "regex-automata",
  "regex-syntax",
+]
 [[package]]
 name = "grep-searcher"
 version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72348823a0eafc4bc2e9051064f28b5b42cc100b571b3a35d67918d711efcbc6"
 dependencies = [
  "bstr",
  "encoding_rs",
  "encoding_rs_io",
  "grep-matcher",
  "log",
  "memchr",
  "memmap2",
+]
 [[package]]
 name = "group"
 version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 [[package]]
 name = "memmap2"
 version = "0.9.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
 dependencies = [
  "libc",
+]
 [[package]]
 name = "mime"
 version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -4839,6 +4946,15 @@ dependencies = [ @@
+]
 [[package]]
 name = "termcolor"
 version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
 dependencies = [
  "winapi-util",
+]
 [[package]]
 name = "thiserror"
 version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -5462,6 +5578,7 @@ dependencies = [ @@
  "config",
  "flate2",
  "git",
  "grep",
  "highlight",
  "mail",
  "maud",

@@ @@ -151,6 +151,8 @@ ammonia = "4" @@
 # gzip-encoded upload-pack requests.
 tokio-util = { version = "0.7", features = ["io"] }
 flate2 = "1"
 # Content search (ripgrep's engine). Dual Unlicense/MIT — MIT satisfies the gate.
 grep = "0.3"
 # SSH server (default features: aws-lc-rs backend, no ring; re-exports ssh-key).
 russh = "0.62"
 tracing = "0.1"

@@ @@ -33,7 +33,7 @@ use figment::providers::{Env, Format, Serialized, Toml}; @@
 pub use crate::secret::{REDACTED, Secret};
 pub use crate::types::{
     Auth, Config, Database, Git, Instance, Log, LogFormat, LogLevel, Mail, MailBackend,
     MailEncryption, Server, Ssh, Storage, Ui,
     MailEncryption, Search, Server, Ssh, Storage, Ui,
 };
 /// System-wide configuration path, the lowest-priority file source.

@@ @@ -36,10 +36,34 @@ pub struct Config { @@
     pub ui: Ui,
     /// Git binary and pack-transport limits.
     pub git: Git,
     /// Search bounds.
     pub search: Search,
     /// Logging.
     pub log: Log,
+}
 /// `[search]` — bounds on the linear (index-free) search.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct Search {
     /// Maximum repositories searched concurrently in a global search.
     pub concurrency: usize,
     /// Total wall-clock budget for a global search, in seconds.
     pub timeout_secs: u64,
     /// Maximum results returned before truncating (with a notice).
     pub max_results: usize,
+}
 impl Default for Search {
     fn default() -> Self {
         Self {
             concurrency: 4,
             timeout_secs: 10,
             max_results: 200,
+        }
+    }
+}
 /// `[instance]` — identity and global policy.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]

@@ @@ -456,6 +456,30 @@ impl Repo { @@
         Ok(result)
+    }
     /// Every regular-file path in the tree of revision `rev`, for search walks.
     /// Directories, submodules, and symlinks are excluded.
     ///
     /// # Errors
     ///
     /// Returns [`GitError`] if the revision or its tree cannot be read.
     pub fn file_paths(&self, rev: &Resolved) -> Result<Vec<String>, GitError> {
         let commit = self.commit_at(&rev.oid)?;
         let tree = commit.tree()?;
         let mut paths = Vec::new();
         tree.walk(git2::TreeWalkMode::PreOrder, |root, entry| {
             if entry.filemode() != i32::from(git2::FileMode::Tree)
                 && entry.filemode() != i32::from(git2::FileMode::Commit)
                 && entry.filemode() != i32::from(git2::FileMode::Link)
+            {
                 if let Some(name) = entry.name() {
                     paths.push(format!("{root}{name}"));
+                }
+            }
             git2::TreeWalkResult::Ok
         })?;
         Ok(paths)
+    }
     /// The tree at `path` within a commit, or `None` if the path is absent or is
     /// not a directory. An empty `path` yields the root tree.
     fn subtree_at<'a>(

@@ @@ -28,6 +28,7 @@ comrak = { workspace = true } @@
 ammonia = { workspace = true }
 tokio-util = { workspace = true }
 flate2 = { workspace = true }
 grep = { workspace = true }
 base64 = { workspace = true }
 time = { workspace = true }
 serde = { workspace = true }

@@ @@ -18,6 +18,7 @@ mod layout; @@
 mod markdown;
 mod pages;
 mod repo;
 mod search;
 #[path = "serve.rs"]
 mod serve_assets;
 mod session;
@@ @@ -111,6 +112,7 @@ pub fn build_router(state: AppState) -> Router { @@
             "/invite/{token}",
             get(pages::invite_form).post(pages::invite_submit),
+        )
         .route("/search", get(search::global))
         .route("/settings", get(pages::settings))
         .route("/settings/theme", get(pages::set_theme))
         .route("/healthz", get(serve_assets::healthz))

@@ @@ -45,6 +45,9 @@ pub struct DiffQuery { @@
     to: Option<u32>,
     /// The smart-HTTP service, for `….git/info/refs?service=`.
     service: Option<String>,
     /// The search query, for the in-repo `/-/search` view.
     #[serde(default)]
     q: Option<String>,
+}
 /// The candidate README filenames, in lookup order.
@@ @@ -60,18 +63,18 @@ enum Tab { @@
+}
 /// A resolved repository plus the viewer's access to it.
 struct RepoCtx {
     owner: User,
     repo: Repo,
 pub(crate) struct RepoCtx {
     pub(crate) owner: User,
     pub(crate) repo: Repo,
     /// The viewer's access level. Reserved for gating mutation UI (settings, edit)
     /// in later phases; every browse view here requires only `Read`.
     #[allow(dead_code)]
     access: auth::Access,
     pub(crate) access: auth::Access,
+}
 /// Run a blocking libgit2 read for a repo on the blocking pool, opening the repo
 /// per operation (§3.7 threading).
 async fn git_read<T, F>(state: &AppState, repo_id: &str, f: F) -> AppResult<T>
 pub(crate) async fn git_read<T, F>(state: &AppState, repo_id: &str, f: F) -> AppResult<T>
 where
     F: FnOnce(&git::Repo) -> Result<T, git::GitError> + Send + 'static,
     T: Send + 'static,
@@ @@ -233,7 +236,12 @@ async fn dispatch_view( @@
         },
         "branches" => branches_view(state, viewer, jar, uri, ctx).await,
         "tags" => tags_view(state, viewer, jar, uri, ctx).await,
         // Reserved `runs`/`search`/`settings` slots return 404 until built.
         "search" => {
             let header = repo_header(state, &ctx, Tab::Search, &ctx.repo.default_branch);
             let raw_query = dq.q.clone().unwrap_or_default();
             crate::search::in_repo(state, viewer, jar, uri, &ctx, &raw_query, header).await
+        }
         // Reserved `runs`/`settings` slots return 404 until built.
         _ => Err(AppError::NotFound),
+    }
+}

@@ @@ -0,0 +1,542 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Search: in-repo and global, over a linear (index-free) scan (§10).
 //!
 //! Queries carry a tiny hand-written qualifier syntax (`repo:`, `user:`, `path:`,
 //! `lang:`, `case:`, `regex:`) plus bare literal terms. Content matching uses
 //! ripgrep's engine. Global search is bounded by a worker-pool size, a total time
 //! budget, and a result cap; exhausting the budget returns partial results with an
 //! explicit notice rather than truncating silently.
 use std::path::Path as FsPath;
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 use axum::extract::{Query, State};
 use axum::http::Uri;
 use axum::response::{IntoResponse, Response};
 use axum_extra::extract::cookie::CookieJar;
 use grep::regex::RegexMatcherBuilder;
 use grep::searcher::Searcher;
 use grep::searcher::sinks::UTF8;
 use maud::{Markup, html};
 use model::{Repo, User};
 use serde::Deserialize;
 use tokio::sync::Semaphore;
 use tokio::task::JoinSet;
 use crate::AppState;
 use crate::error::AppResult;
 use crate::layout::page;
 use crate::pages::build_chrome;
 use crate::session::MaybeUser;
 /// Max matching lines kept per file, and max files per repo, to bound one repo's
 /// contribution.
 const LINES_PER_FILE: usize = 10;
 const FILES_PER_REPO: usize = 50;
 /// Files larger than this are skipped by the content scan.
 const MAX_FILE_BYTES: u64 = 1_048_576;
 /// A parsed query: the free text plus any qualifiers.
 #[derive(Debug, Default, Clone, PartialEq, Eq)]
 pub struct ParsedQuery {
     /// The literal or regex text to match.
     pub text: String,
     /// `repo:owner/path`.
     pub repo: Option<String>,
     /// `user:name`.
     pub user: Option<String>,
     /// `path:glob` (matched as a substring for the MVP).
     pub path: Option<String>,
     /// `lang:name`.
     pub lang: Option<String>,
     /// `case:yes` — case-sensitive matching.
     pub case_sensitive: bool,
     /// `regex:yes` — treat `text` as a regex rather than a literal.
     pub regex: bool,
+}
 /// Parse a raw query string into qualifiers and free text.
 #[must_use]
 pub fn parse(raw: &str) -> ParsedQuery {
     let mut query = ParsedQuery::default();
     let mut terms: Vec<&str> = Vec::new();
     for token in raw.split_whitespace() {
         match token.split_once(':') {
             Some(("repo", v)) => query.repo = Some(v.to_string()),
             Some(("user", v)) => query.user = Some(v.to_string()),
             Some(("path", v)) => query.path = Some(v.to_string()),
             Some(("lang", v)) => query.lang = Some(v.to_string()),
             Some(("case", v)) => query.case_sensitive = is_yes(v),
             Some(("regex", v)) => query.regex = is_yes(v),
             _ => terms.push(token),
+        }
+    }
     query.text = terms.join(" ");
     query
+}
 /// Whether a qualifier value means "yes".
 fn is_yes(v: &str) -> bool {
     matches!(v.to_ascii_lowercase().as_str(), "yes" | "true" | "1" | "on")
+}
 /// One matching line within a file.
 #[derive(Debug, Clone)]
 pub struct LineMatch {
     /// 1-based line number.
     pub line: u64,
     /// The (trimmed) line text.
     pub text: String,
+}
 /// A file's matches within a repo.
 #[derive(Debug, Clone)]
 pub struct FileResult {
     /// Repo-relative path.
     pub path: String,
     /// Matching lines (may be empty for a path-only match).
     pub lines: Vec<LineMatch>,
+}
 /// Search one already-open repository at `rev_name`. Returns matched files.
 fn search_repo_blocking(repo: &git::Repo, rev_name: &str, query: &ParsedQuery) -> Vec<FileResult> {
     let Ok(rev) = repo.resolve_ref(rev_name) else {
         return Vec::new();
     };
     let Ok(paths) = repo.file_paths(&rev) else {
         return Vec::new();
     };
     let matcher = (!query.text.is_empty())
         .then(|| {
             RegexMatcherBuilder::new()
                 .case_insensitive(!query.case_sensitive)
                 .fixed_strings(!query.regex)
                 .build(&query.text)
                 .ok()
         })
         .flatten();
     let mut searcher = Searcher::new();
     let mut results = Vec::new();
     for path in paths {
         if results.len() >= FILES_PER_REPO {
             break;
+        }
         if let Some(filter) = &query.path
             && !path.to_lowercase().contains(&filter.to_lowercase())
+        {
             continue;
+        }
         let Ok(blob) = repo.blob(&rev, FsPath::new(&path)) else {
             continue;
         };
         if blob.is_binary || blob.size > MAX_FILE_BYTES {
             continue;
+        }
         if let Some(lang) = &query.lang {
             let resolved = highlight::resolve(FsPath::new(&path), &blob.content, None);
             if resolved.name().map(str::to_ascii_lowercase) != Some(lang.to_ascii_lowercase()) {
                 continue;
+            }
+        }
         let mut lines = Vec::new();
         if let Some(matcher) = &matcher {
             let _ = searcher.search_slice(
                 matcher,
                 &blob.content,
                 UTF8(|lnum, line| {
                     if lines.len() < LINES_PER_FILE {
                         lines.push(LineMatch {
                             line: lnum,
                             text: line.trim_end().to_string(),
                         });
+                    }
                     Ok(true)
                 }),
             );
             if !lines.is_empty() {
                 results.push(FileResult { path, lines });
+            }
         } else if query.path.is_some() || query.lang.is_some() {
             // No text term but a path/lang filter matched: report the file itself.
             results.push(FileResult { path, lines });
+        }
+    }
     results
+}
 /// Query parameters for the global search route.
 #[derive(Debug, Default, Deserialize)]
 pub struct SearchParams {
     /// The raw query.
     #[serde(default)]
     q: String,
+}
 /// `GET /search` — global search across visible repos.
 pub async fn global(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     uri: Uri,
     Query(params): Query<SearchParams>,
 ) -> AppResult<Response> {
     let query = parse(&params.q);
     let (jar, chrome) = build_chrome(&state, jar, viewer.clone(), uri.path().to_string());
     let body = if params.q.trim().is_empty() {
         html! { h1 { "Search" } (search_box(&params.q, None)) }
     } else {
         let entities = entity_matches(&state, &query, viewer.as_ref()).await?;
         let (content, timed_out, truncated) =
             content_matches(&state, &query, viewer.as_ref()).await?;
         html! {
             h1 { "Search" }
             (search_box(&params.q, None))
             @if timed_out {
                 div class="notice notice-error" { "Search timed out; showing partial results." }
             } @else if truncated {
                 div class="notice" { "Showing the first results; refine your query for more." }
+            }
             (entity_section(&entities))
             (content_section(&content))
             @if entities.is_empty() && content.is_empty() {
                 p class="muted" { "No results." }
+            }
+        }
     };
     Ok((jar, page(&chrome, "Search", body)).into_response())
+}
 /// A repo/user/group name-or-description match.
 struct EntityMatch {
     kind: &'static str,
     label: String,
     href: String,
+}
 /// Match repo/user names and descriptions (the "first" pass of global search).
 async fn entity_matches(
     state: &AppState,
     query: &ParsedQuery,
     viewer: Option<&User>,
 ) -> AppResult<Vec<EntityMatch>> {
     let needle = query.text.to_lowercase();
     if needle.is_empty() {
         return Ok(Vec::new());
+    }
     let mut out = Vec::new();
     for user in state.store.list_users().await? {
         if user.username.to_lowercase().contains(&needle) {
             out.push(EntityMatch {
                 kind: "user",
                 label: user.username.clone(),
                 href: format!("/{}", user.username),
             });
+        }
+    }
     for repo in visible_repos(state, viewer).await? {
         let owner = owner_name(state, &repo.owner_id).await;
         let hay = format!(
             "{} {} {}",
             repo.path,
             repo.name,
             repo.description.clone().unwrap_or_default()
+        )
         .to_lowercase();
         if hay.contains(&needle) {
             out.push(EntityMatch {
                 kind: "repo",
                 label: format!("{owner}/{}", repo.path),
                 href: format!("/{owner}/{}", repo.path),
             });
+        }
+    }
     Ok(out)
+}
 /// Run the bounded content search across visible repos. Returns matches plus
 /// whether the time budget or result cap was hit.
 async fn content_matches(
     state: &AppState,
     query: &ParsedQuery,
     viewer: Option<&User>,
 ) -> AppResult<(Vec<(String, Vec<FileResult>)>, bool, bool)> {
     let mut repos = visible_repos(state, viewer).await?;
     // Honour a repo: qualifier by filtering the candidate set.
     if let Some(repo_q) = &query.repo {
         let want = repo_q.to_lowercase();
         // Resolve owner names to filter by "owner/path".
         let mut kept = Vec::new();
         for repo in repos {
             let owner = owner_name(state, &repo.owner_id).await;
             if format!("{owner}/{}", repo.path).to_lowercase() == want {
                 kept.push(repo);
+            }
+        }
         repos = kept;
+    }
     let deadline = Instant::now() + Duration::from_secs(state.config.search.timeout_secs.max(1));
     let semaphore = Arc::new(Semaphore::new(state.config.search.concurrency.max(1)));
     let mut set: JoinSet<Option<(String, Vec<FileResult>)>> = JoinSet::new();
     for repo in repos {
         let state = state.clone();
         let query = query.clone();
         let semaphore = Arc::clone(&semaphore);
         set.spawn(async move {
             let _permit = semaphore.acquire().await.ok()?;
             let owner = owner_name(&state, &repo.owner_id).await;
             let rev = repo.default_branch.clone();
             let files = crate::repo::git_read(&state, &repo.id, move |repo| {
                 Ok(search_repo_blocking(repo, &rev, &query))
             })
             .await
             .ok()?;
             (!files.is_empty()).then(|| (format!("{owner}/{}", repo.path), files))
         });
+    }
     let cap = state.config.search.max_results;
     let mut results = Vec::new();
     let mut total = 0usize;
     let mut timed_out = false;
     let mut truncated = false;
     loop {
         let remaining = deadline.saturating_duration_since(Instant::now());
         if remaining.is_zero() {
             timed_out = true;
             break;
+        }
         match tokio::time::timeout(remaining, set.join_next()).await {
             Ok(Some(Ok(Some(entry)))) => {
                 total += entry.1.iter().map(|f| f.lines.len().max(1)).sum::<usize>();
                 results.push(entry);
                 if total >= cap {
                     truncated = true;
                     break;
+                }
+            }
             Ok(Some(_)) => {}  // a repo errored or had no matches
             Ok(None) => break, // all done
             Err(_) => {
                 timed_out = true;
                 break;
+            }
+        }
+    }
     set.abort_all();
     Ok((results, timed_out, truncated))
+}
 /// `search` view for a single repo (called from the repo dispatcher).
 pub async fn in_repo(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: &crate::repo::RepoCtx,
     raw_query: &str,
     header: Markup,
 ) -> AppResult<Response> {
     let owner = &ctx.owner.username;
     let repo = &ctx.repo;
     let default_branch = &ctx.repo.default_branch;
     let query = parse(raw_query);
     let rev = default_branch.clone();
     let files = if raw_query.trim().is_empty() {
         Vec::new()
     } else {
         let query = query.clone();
         let rev = rev.clone();
         crate::repo::git_read(state, &repo.id, move |repo| {
             Ok(search_repo_blocking(repo, &rev, &query))
         })
         .await?
     };
     let base = format!("/{owner}/{}", repo.path);
     let body = html! {
         (header)
         h2 { "Search this repository" }
         (search_box(raw_query, Some(&format!("{base}/-/search"))))
         @if raw_query.trim().is_empty() {
             p class="muted" { "Enter a query to search the code." }
         } @else if files.is_empty() {
             p class="muted" { "No matches." }
         } @else {
             (repo_content(owner, &repo.path, default_branch, &files))
+        }
     };
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let title = format!("{owner}/{}: search", repo.path);
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 // ---- components ----
 /// The search input form.
 fn search_box(value: &str, action: Option<&str>) -> Markup {
     html! {
         form method="get" action=[action] {
             input type="search" name="q" value=(value) placeholder="Search…"
                   data-search-input aria-label="Search query" autofocus;
             button class="btn" type="submit" { "Search" }
+        }
+    }
+}
 /// Render entity (name) matches.
 fn entity_section(entities: &[EntityMatch]) -> Markup {
     html! {
         @if !entities.is_empty() {
             section {
                 h2 { "Repositories & users" }
                 ul class="repo-list" {
                     @for entity in entities {
                         li {
                             span class="badge" { (entity.kind) }
                             " " a href=(entity.href) { (entity.label) }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
 /// Render global content matches, grouped by repo then file.
 fn content_section(content: &[(String, Vec<FileResult>)]) -> Markup {
     html! {
         @if !content.is_empty() {
             section {
                 h2 { "Code" }
                 @for (repo, files) in content {
                     h3 { (repo) }
                     @for file in files {
                         (file_result(&format!("/{repo}"), None, file))
+                    }
+                }
+            }
+        }
+    }
+}
 /// Render in-repo content matches with links into the blob view.
 fn repo_content(owner: &str, repo_path: &str, rev: &str, files: &[FileResult]) -> Markup {
     let base = format!("/{owner}/{repo_path}/-/blob/{rev}");
     html! {
         @for file in files {
             (file_result(&base, Some(rev), file))
+        }
+    }
+}
 /// One file's matches. `blob_base` links each line to the blob (with `#L{n}`).
 fn file_result(blob_base: &str, in_repo: Option<&str>, file: &FileResult) -> Markup {
     html! {
         div class="card" style="margin-bottom:0.5rem" {
             div class="mono" {
                 @if in_repo.is_some() {
                     a href=(format!("{blob_base}/{}", file.path)) { (file.path) }
                 } @else {
                     (file.path)
+                }
+            }
             @for m in &file.lines {
                 div class="mono" style="font-size:0.85em" {
                     @if in_repo.is_some() {
                         a href=(format!("{blob_base}/{}#L{}", file.path, m.line))
                           class="muted" { (m.line) }
                     } @else {
                         span class="muted" { (m.line) }
+                    }
                     "  " (m.text)
+                }
+            }
+        }
+    }
+}
 // ---- shared repo visibility ----
 /// Every repo the viewer may read (across owners), for global search.
 async fn visible_repos(state: &AppState, viewer: Option<&User>) -> AppResult<Vec<Repo>> {
     let all = state.store.list_repos().await?;
     let mut out = Vec::new();
     for repo in all {
         if can_read(state, &repo, viewer).await? {
             out.push(repo);
+        }
+    }
     Ok(out)
+}
 /// Whether the viewer can read `repo`.
 async fn can_read(state: &AppState, repo: &Repo, viewer: Option<&User>) -> AppResult<bool> {
     let viewer_id = viewer.map(|u| auth::Viewer {
         id: u.id.clone(),
         is_admin: u.is_admin,
     });
     let collaborator = match viewer {
         Some(u) => state
             .store
             .collaborator_permission(&repo.id, &u.id)
             .await?
             .and_then(|p| auth::Permission::parse(&p)),
         None => None,
     };
     let access = auth::access(
         viewer_id.as_ref(),
         repo,
         collaborator,
         state.config.instance.allow_anonymous,
     );
     Ok(access >= auth::Access::Read)
+}
 /// Resolve an owner id to a username, falling back to the id.
 async fn owner_name(state: &AppState, owner_id: &str) -> String {
     state
         .store
         .user_by_id(owner_id)
         .await
         .ok()
         .flatten()
         .map_or_else(|| owner_id.to_string(), |u| u.username)
+}
 #[cfg(test)]
 mod tests {
     use super::*;
     #[test]
     fn parses_qualifiers_and_free_text() {
         let q = parse("foo bar repo:ada/api lang:rust case:yes regex:no path:src");
         assert_eq!(q.text, "foo bar");
         assert_eq!(q.repo.as_deref(), Some("ada/api"));
         assert_eq!(q.lang.as_deref(), Some("rust"));
         assert_eq!(q.path.as_deref(), Some("src"));
         assert!(q.case_sensitive);
         assert!(!q.regex);
+    }
     #[test]
     fn bare_query_has_no_qualifiers() {
         let q = parse("hello world");
         assert_eq!(q.text, "hello world");
         assert!(q.repo.is_none());
         assert!(!q.case_sensitive);
         assert!(!q.regex);
+    }
+}

@@ @@ -65,6 +65,25 @@ file. There is no `server start` / `server stop` pair. @@
 **Rationale:** Foreground is correct for systemd and Docker, which own process
 lifecycle. This deviates from an earlier `server start`/`server stop` sketch.
 ## 2026-07-25 — Search lives in `web`; `path:` is a substring for the MVP
 **Decision:** Search (the qualifier parser, in-repo scan, and bounded global scan)
 is implemented in `crates/web`, not a separate crate, using ripgrep's `grep`
 engine. The `path:` qualifier matches as a case-insensitive **substring**, not a
 full glob.
 **Alternatives:** A dedicated `search` crate; full glob path matching via
 `globset`.
 **Rationale:** Search is a web-only feature with no other consumer, so a crate of
 its own adds indirection for no reuse; the content scan runs inside the existing
 `git_read` blocking closure. The global scan bounds itself with a
 `Semaphore(search.concurrency)` and a `tokio::time::timeout(search.timeout_secs)`
 deadline, returning partial results with an explicit notice on either the time or
 `search.max_results` cap. A substring `path:` covers the common case; upgrading to
 `globset` is a contained change if needed. `linguist-vendored`/`-generated`
 exclusion is deferred (binary and >1 MiB files are already skipped).
 ## 2026-07-24 — Linear search, no index
 **Decision:** Search (in-repo and global) is a linear scan over repo contents at

@@ @@ -85,6 +85,11 @@ binary = "git" # must be >= 2.41 and on PATH @@
 transport_timeout_secs = 3600
 max_pack_size_bytes    = 536870912   # reject pushes with a larger received pack
 [search]
 concurrency = 4     # repos searched at once in a global search
 timeout_secs = 10   # total budget; partial results are returned past it
 max_results = 200   # cap before truncating with a notice
 [log]
 level  = "info"     # trace | debug | info | warn | error (RUST_LOG also honoured)
 format = "pretty"   # pretty | json