Function build_unified_diff 

pub fn build_unified_diff(file: &str, before: &str, after: &str) -> String

Build the unified-diff string used by internal permission previews.

The OpenCode approval prompt expects a plain unified-diff string in metadata.diff. Host wrappers may alternatively consume the diff.before / diff.after response fields and render their own patch, but returning the ready-to-display string keeps the bridge contract self-contained.