npm - @3sln/trove - Versions diffs - 0.0.12 → 0.0.13 - Mend

@3sln/trove 0.0.12 → 0.0.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (89) hide show

package/README.md +13 -1
package/package.json +2 -1
package/packages/core/src/collections/index.js +71 -10
package/packages/core/src/encryption/keys.js +4 -3
package/packages/core/src/encryption/policy.js +14 -7
package/packages/core/src/encryption/rotation.js +46 -12
package/packages/core/src/errors.js +8 -0
package/packages/core/src/index.js +8 -2
package/packages/core/src/indexers/contribution.js +18 -17
package/packages/core/src/indexing.js +8 -4
package/packages/core/src/issues.js +8 -0
package/packages/core/src/links.js +21 -9
package/packages/core/src/metadata/interface.js +22 -0
package/packages/core/src/metadata/memory.js +15 -0
package/packages/core/src/metadata/sqlite.js +23 -1
package/packages/core/src/plugins/contributions.js +13 -0
package/packages/core/src/rateLimit.js +253 -0
package/packages/core/src/scan.js +44 -16
package/packages/core/src/sidecar/document.js +18 -14
package/packages/core/src/sidecar/index.js +9 -10
package/packages/core/src/sidecar/manager.js +10 -15
package/packages/core/src/uploads.js +40 -15
package/packages/core/src/vfs.js +59 -34
package/packages/plugin-sdk/src/browser.js +155 -0
package/packages/plugin-sdk/src/protocol.js +13 -1
package/packages/server/src/adapters/bun.js +1 -2
package/packages/server/src/adapters/node.js +1 -2
package/packages/server/src/engine/index.js +1 -1
package/packages/server/src/engine/providers/access.js +17 -34
package/packages/server/src/engine/providers/core.js +112 -14
package/packages/server/src/index.js +145 -103
package/packages/server/src/mcp/index.js +7 -12
package/packages/server/src/mcp/tools.js +24 -29
package/packages/server/src/router.js +31 -8
package/packages/server/src/routes.js +74 -113
package/packages/server/src/scope.js +78 -0
package/packages/web/dist/assets/main-828yzsr7.js +511 -0
package/packages/web/dist/assets/main-828yzsr7.js.map +120 -0
package/packages/web/dist/index.html +1 -1
package/packages/web/dist/sw.js +1 -1
package/packages/web/src/bl/actions.js +226 -104
package/packages/web/src/bl/activity.js +32 -82
package/packages/web/src/bl/index.js +23 -11
package/packages/web/src/bl/launcher.js +2 -9
package/packages/web/src/bl/links.js +31 -18
package/packages/web/src/bl/offline.js +24 -10
package/packages/web/src/bl/pluginInstall.js +29 -26
package/packages/web/src/bl/queries.js +76 -68
package/packages/web/src/bl/services.js +22 -14
package/packages/web/src/bl/social.js +39 -25
package/packages/web/src/bl/state.js +22 -4
package/packages/web/src/bl/viewState.js +9 -0
package/packages/web/src/bl/watchQuery.js +1 -8
package/packages/web/src/dispatch.js +26 -0
package/packages/web/src/platform/api.js +32 -0
package/packages/web/src/platform/commands.js +14 -15
package/packages/web/src/platform/context.js +3 -58
package/packages/web/src/platform/contributions.js +1 -35
package/packages/web/src/platform/fileChunks.js +281 -0
package/packages/web/src/platform/index.js +8 -9
package/packages/web/src/platform/mediaUrls.js +10 -0
package/packages/web/src/platform/navigation.js +35 -21
package/packages/web/src/platform/pickers.js +39 -19
package/packages/web/src/platform/pluginHost.js +4 -1
package/packages/web/src/platform/pluginRpc.js +47 -2
package/packages/web/src/platform/spatialNav.js +1 -1
package/packages/web/src/platform/viewport.js +14 -6
package/packages/web/src/platform/voiceSearch.js +17 -9
package/packages/web/src/platform/whenclause.js +9 -19
package/packages/web/src/runtime.js +2 -37
package/packages/web/src/ui/activate.js +18 -2
package/packages/web/src/ui/components/activityPanel.js +1 -1
package/packages/web/src/ui/components/adminView.js +4 -7
package/packages/web/src/ui/components/editorArea.js +10 -1
package/packages/web/src/ui/components/launcher.js +29 -13
package/packages/web/src/ui/components/openers/index.js +17 -22
package/packages/web/src/ui/components/openers/markdown.js +2 -2
package/packages/web/src/ui/components/overlays.js +31 -5
package/packages/web/src/ui/components/pluginReview.js +7 -4
package/packages/web/src/ui/components/pluginsView.js +1 -1
package/packages/web/src/ui/components/settingsView.js +30 -27
package/packages/web/src/ui/components/statusBar.js +8 -6
package/packages/web/src/ui/components/views/grid.js +2 -2
package/packages/web/src/ui/components/views/parts.js +1 -1
package/packages/web/src/ui/compositions/workbench.js +20 -6
package/packages/web/src/ui/sanitize.js +0 -5
package/packages/web/src/workbench.js +37 -19
package/packages/web/dist/assets/main-c9dnnnc6.js +0 -356
package/packages/web/dist/assets/main-c9dnnnc6.js.map +0 -118

package/packages/web/dist/index.html CHANGED Viewed

@@ -17,6 +17,6 @@
   </head>
   <body>
     <div class="workbench"></div>
-    <script type="module" src="/assets/main-c9dnnnc6.js"></script>
+    <script type="module" src="/assets/main-828yzsr7.js"></script>
   </body>
 </html>

package/packages/web/dist/sw.js CHANGED Viewed

@@ -18,7 +18,7 @@
 // API and FILES deliberately do NOT rotate. API is data, not code, and FILES holds the
 // bytes of files the user pinned for offline use — naming it per build would throw away
 // someone's offline library every time the app was redeployed.
-const SHELL = 'trove-shell-10c4c8fa57';
+const SHELL = 'trove-shell-fbe8c37315';
 const API = 'trove-api-v1';
 const FILES = 'trove-files-v1';
 const KEEP = new Set([SHELL, API, FILES]);

package/packages/web/src/bl/actions.js CHANGED Viewed

@@ -5,7 +5,8 @@
 // they update flow straight back into the UI via `watch`.
 import { Action } from '@3sln/ngin';
-import { PROMPT } from './viewState.js';
+import { runAction } from '../dispatch.js';
+import { PROMPT, PLUGIN_REVIEW } from './viewState.js';
 import { beginInstallFromUrl } from './pluginInstall.js';
 import { newId } from '@3sln/trove/core/util.js';
 import { matchesTagFilters } from './tagQuery.js';
@@ -59,7 +60,7 @@ export class NavigateAction extends Action {
         nextCursor: res.nextCursor || null,
       });
       // Remember where they were, so the next visit opens there rather than guessing.
-      settings.set?.('explorer.lastCollection', collectionId);
+      settings.set('explorer.lastCollection', collectionId);
       explorer.set({ gate: null });
       // Explorer→context projection (collectionId/hasSelection) lives in bl/index.js
       // so it stays in sync with selection too — nothing to mirror here.
@@ -186,7 +187,9 @@ export class OpenInitialCollectionAction extends Action {
     }
     explorer.set({ gate: null });
-    await engine.dispatch(new NavigateAction(shared.collection));
+    // Sequenced, so the panel this opens below lands on top of the collection rather than
+    // racing its load — see src/dispatch.js for why a bare `await` here did nothing.
+    await runAction(engine, new NavigateAction(shared.collection));
     let node;
     try {
@@ -275,7 +278,10 @@ export class CreateCollectionAction extends Action {
     try {
       const res = await r.api.createCollection(this.record);
       r.notifications.success(`Created collection “${res.collection.name}”`);
-      await r.engine.dispatch(new LoadCollectionsAction());
+      // Sequenced: `NavigateAction` writes `collectionId` synchronously while the load
+      // writes `collections` after a round trip, so navigating first left the status bar's
+      // `collectionLabelOf` with nothing to look the id up in — it showed a raw `col_…`.
+      await runAction(r.engine, new LoadCollectionsAction());
       r.engine.dispatch(new NavigateAction(res.collection.id));
     } catch (err) {
       r.notifications.error(`Couldn’t create collection: ${err.message}`);
@@ -348,7 +354,7 @@ export class TrashAction extends Action {
       const { items } = await api.trash(collection);
       explorer.set({ trash: items });
       // Restoring puts something back in the drive, so the list on screen is now stale.
-      if (this.op !== 'list') await r.engine.dispatch(new NavigateAction(collection));
+      if (this.op !== 'list') r.engine.dispatch(new NavigateAction(collection));
     } catch (err) {
       notifications.error(`Trash: ${err.message}`);
     }
@@ -518,7 +524,7 @@ export class FilterAction extends Action {
       return;
     }
     search.set({ query: this.text, loading: true, error: null, filtered: true });
-    if (r.offline && !r.offline.state.online) {
+    if (r.offline && !r.offline.get().online) {
       const items = (r.explorer.get().items || []).filter((n) => matchesTagFilters(n, this.filters));
       search.set({ results: items.map((node) => ({ node })), loading: false, ran: true, filtered: true, offline: true });
       return;
@@ -583,14 +589,23 @@ export class SearchAction extends Action {
       return;
     }
     const mode = this.mode || settings.get('search.mode');
-    search.set({ query: this.query, mode, loading: true, error: null, resolved: null });
+    search.set({ query: this.query, mode, loading: true, error: null, resolved: null, filtered: false });
+    // The query itself is the sequence token, the same guard QuickOpenAction uses and for
+    // the same reason: keystrokes outrun the network, and a slower request for an earlier
+    // query must not land on top of a newer one's results. It matters most for the query
+    // that was CLEARED — pressing Escape inside the debounce window used to let
+    // `SearchAction('contract')` land after the clear, leaving "Searching for contract"
+    // over the home list.
+    const superseded = () => search.get().query !== this.query;
     const offline = r.offline;
     // Offline (or server unreachable) → search the pinned corpus locally.
-    if (offline && !offline.state.online) {
+    if (offline && !offline.get().online) {
       try {
         const results = await offline.searchOffline(q, { limit: 40 });
+        if (superseded()) return;
         search.set({ results, loading: false, ran: true, offline: true, resolved: null });
       } catch (err) {
+        if (superseded()) return;
         search.set({ results: [], loading: false, ran: true, offline: true, error: err.message });
       }
       return;
@@ -605,10 +620,13 @@ export class SearchAction extends Action {
       // content types. It can only name a view from this list.
       const views = contributions.ofType('view').map((v) => ({ id: v.id, title: v.title || v.id }));
       const res = await api.query(q, { mode, limit: 40, views });
+      if (superseded()) return;
       search.set({ results: res.results, resolved: res.resolved || null, loading: false, ran: true, offline: false });
     } catch (err) {
+      if (superseded()) return;
       if (offline) {
         const results = await offline.searchOffline(q, { limit: 40 });
+        if (superseded()) return;
         search.set({ results, loading: false, ran: true, offline: true, error: results.length ? null : err.message });
       } else {
         search.set({ loading: false, error: err.message, ran: true });
@@ -622,9 +640,14 @@ export class SearchAction extends Action {
 /**
  * Load the key list.
  *
- * Silent on failure rather than noisy: this fires when Settings opens, and a non-admin
- * opening Settings gets a 403 that is the correct answer, not an error worth a toast.
- * The section simply does not render.
+ * Silent on REFUSAL rather than noisy: this fires when Settings opens, and a non-admin
+ * opening Settings gets a 403 that is the correct answer, not an error worth a toast. That
+ * is `loaded` with an empty list — the section simply is not part of their settings screen.
+ *
+ * Any other failure sets `error` and leaves `loaded` alone, because they are different
+ * facts. Setting both meant one transient failure rendered the section blank with no
+ * message and no way back: `loaded` was true so the "not yet" branch passed, and the empty
+ * list was indistinguishable from a drive with no keys.
  */
 export class LoadApiKeysAction extends Action {
   static deps = ['api', 'apiKeys'];
@@ -635,7 +658,11 @@ export class LoadApiKeysAction extends Action {
       const res = await r.api.apiKeys();
       r.apiKeys.set({ keys: res.keys || [], loading: false, loaded: true, error: null });
     } catch (err) {
-      r.apiKeys.set({ loading: false, loaded: true, error: err?.message || 'Could not load API keys' });
+      if (err?.status === 403 || err?.code === 'forbidden') {
+        r.apiKeys.set({ keys: [], loading: false, loaded: true, error: null, forbidden: true });
+        return;
+      }
+      r.apiKeys.set({ loading: false, error: err?.message || 'Could not load API keys' });
     }
   }
 }
@@ -752,21 +779,6 @@ export class CopyTextAction extends Action {
   }
 }
-/** Say something to the user. `kind` is one of info, success, warn, error. */
-export class NotifyAction extends Action {
-  static deps = ['notifications'];
-  constructor(kind, message, opts) {
-    super();
-    this.kind = kind;
-    this.message = message;
-    this.opts = opts;
-  }
-  async execute({ notifications: notes }) {
-    (notes[this.kind] ?? notes.info).call(notes, this.message, this.opts);
-  }
-}
 /** Dismiss one notification, by id. */
 export class DismissNotificationAction extends Action {
   static deps = ['notifications'];
@@ -791,11 +803,11 @@ export class DismissNotificationAction extends Action {
 // discriminated blob would make every one of them read as "ShellAction" and give back
 // exactly the observability this is for.
 //
-// NOT here yet, deliberately: `showDialog` and `showContextMenu`. Both take callbacks —
-// a dialog carries `onConfirm`, a menu carries an item's `run` — so converting them
-// mechanically would post a closure through the engine and call it an action. They want
-// the outcome to be an ACTION TO DISPATCH rather than a function to call, which is a real
-// change at each call site rather than a swap. See docs/tickets/009.
+// `showDialog` and `showContextMenu` are here too, and the reason they arrived last is the
+// reason they are worth having: both used to take callbacks — a dialog carried `onConfirm`,
+// a menu carried an item's `run` — so converting them mechanically would have posted a
+// closure through the engine and called it an action. Every outcome is an ACTION TO
+// DISPATCH now, which is why nothing in a dialog spec or a menu item is callable.
 class ShellAction extends Action {
   static deps = ['workbench'];
@@ -967,9 +979,22 @@ class ActivityAction extends Action {
   static deps = ['activity'];
   async execute(r) { this.apply(r.activity); }
 }
-export class ToggleActivityPanelAction extends ActivityAction {
+/**
+ * Show or hide the activity panel.
+ *
+ * The FLAG is overlay state like every other transient surface; the REFRESH is the
+ * poller's. Opening has to refresh because polling backs off to 60s when nothing is
+ * running, so a panel opened on an idle drive would otherwise show a list up to a minute
+ * stale — which is exactly the moment someone is looking to find out what just happened.
+ */
+export class ToggleActivityPanelAction extends Action {
+  static deps = ['activity', 'overlay'];
   constructor(which) { super(); this.which = which; }
-  apply(s) { s.togglePanel(this.which); }
+  async execute({ activity, overlay }) {
+    const open = this.which ?? !overlay.get().activityPanel;
+    overlay.set({ activityPanel: open });
+    if (open) await activity.refresh();
+  }
 }
 export class CancelTaskAction extends ActivityAction {
   constructor(id) { super(); this.id = id; }
@@ -1100,37 +1125,6 @@ export class ToggleApiKeyCapAction extends ApiKeysAction {
   }
 }
-/**
- * Select items in the explorer.
- *
- * `opts` is `{ additive, nodes }`, matching the service — NOT a boolean. It was written as
- * `additive` first, which worked at the one call site only because the options object passed
- * through positionally unchanged. `new SelectItemsAction(ids, true)` would have destructured
- * a boolean into `{additive = false, nodes = null}` and quietly not been additive at all.
- *
- * `nodes` matters when the selection cannot be resolved from the loaded page: the launcher's
- * rows come from search, which is scoped across collections, so the node has to travel with
- * the id.
- */
-export class SelectItemsAction extends Action {
-  static deps = ['explorer'];
-  constructor(ids, opts = {}) { super(); this.ids = ids; this.opts = opts; }
-  async execute({ explorer }) {
-    const { additive = false, nodes = null } = this.opts;
-    const current = explorer.get().selection;
-    const next = additive ? Array.from(new Set([...current, ...this.ids])) : this.ids;
-    // Selecting what is already selected must not emit. The launcher syncs the highlighted
-    // row into here on every mouseenter, and a state push per mouse move would re-render
-    // the list under the pointer. The rule lives with the mutation now rather than inside
-    // the resource, so the resource only holds and only `set` writes.
-    const same = next.length === current.length && next.every((id, i) => id === current[i]);
-    if (same) return;
-    explorer.set({ selection: next, selectionNodes: nodes && !additive ? nodes : null });
-  }
-}
 /**
  * Move the launcher's highlight and sync the selection to whatever it landed on.
  *
@@ -1166,7 +1160,19 @@ export class SelectLaunchAction extends Action {
   }
 }
-/** Select exactly one node, or nothing. Carries the node itself — see SelectItemsAction. */
+/**
+ * Select exactly one node, or nothing.
+ *
+ * `selectionNodes` carries the NODE and not just the id, because the selection often cannot
+ * be resolved from the loaded page: the launcher's rows come from search, which is scoped
+ * across collections, so the node has to travel with the id or `selectedNodesOf` finds
+ * nothing and rename/trash/copy-link return quietly while `hasSelection` disagrees.
+ *
+ * Selecting what is already selected must not emit. The launcher syncs the highlighted row
+ * into here on every mouseenter, and a state push per mouse move would re-render the list
+ * under the pointer. The rule lives with the mutation rather than inside the resource, so
+ * the resource only holds and only `set` writes.
+ */
 function selectNode(explorer, node) {
   const ids = node?.id ? [node.id] : [];
   const current = explorer.get().selection;
@@ -1196,8 +1202,26 @@ export class SetViewStateAction extends Action {
  * the feed. See ui/activate.js.
  */
 export class ShowContextMenuAction extends OverlayAction {
-  constructor(x, y, items) { super(); this.x = x; this.y = y; this.items = items; }
-  apply(o) { o.set({ contextMenu: { x: this.x, y: this.y, items: this.items } }); }
+  /**
+   * @param {Array} items
+   * @param {{x?: number, y?: number, rect?: DOMRect, prefer?: 'up'|'down'}|null} [at]
+   *   A POINT (a right-click) or a rect to hang off (a button), not a resolved position.
+   *   Callers used to resolve it themselves — `r.top - 8 - items.length * 34`, a row height
+   *   hardcoded in two files that had to agree with the CSS and did not have to agree with
+   *   the overlay's clamp, which compensated by a different amount. Only the overlay can
+   *   measure, so only the overlay decides. Omit `at` for a keyboard-invoked menu.
+   */
+  constructor(items, at = null) {
+    super();
+    this.items = items;
+    // Flattened to plain numbers: a DOMRect is a live object with methods, and this lands
+    // in engine state, where nothing is callable.
+    this.at = at?.rect
+      ? { prefer: at.prefer || 'down', rect: { left: at.rect.left, top: at.rect.top, right: at.rect.right, bottom: at.rect.bottom } }
+      : (at ? { x: at.x, y: at.y } : null);
+  }
+  apply(o) { o.set({ contextMenu: { items: this.items, at: this.at } }); }
 }
 /**
@@ -1279,22 +1303,30 @@ export class SetPluginSecretAction extends Action {
  * lost access to. Either way the click must say so rather than do nothing.
  */
 export class OpenNotificationTargetAction extends Action {
-  static deps = ['api', 'context', 'contributions', 'engine', 'explorer', 'notifications', 'plugins', 'settings', 'workbench'];
+  // Five of these used to exist only to feed a hand-call of `OpenFileAction.execute(r)` —
+  // the one `.execute(` in the package — and one of them, `explorer`, fed nothing at all.
+  // The coupling was invisible: a dep added to OpenFileAction broke THIS action at runtime
+  // with an `undefined`, the same failure mode as the missing `overlay` above. Dispatching
+  // instead also puts the open on the feed, which it never was: opening from a notification
+  // and opening from a row click are the same intent and the engine should see both.
+  static deps = ['api', 'engine', 'notifications', 'workbench'];
   constructor(nodeId) { super(); this.nodeId = nodeId; }
-  async execute(r) {
+  async execute({ api, engine, notifications, workbench }) {
     let node;
     try {
-      ({ node } = await r.api.stat(this.nodeId));
+      ({ node } = await api.stat(this.nodeId));
     } catch (err) {
-      r.notifications.warn(err?.status === 403 || err?.code === 'forbidden'
+      notifications.warn(err?.status === 403 || err?.code === 'forbidden'
         ? 'You no longer have access to that item.'
         : 'That item no longer exists.');
       return;
     }
-    await new OpenFileAction(node).execute(r);
-    r.workbench.set({ infoPanel: true });
+    // `.next([...])`, because `dispatch` returns a feed and the panel must open AFTER the
+    // file does — see platform/commands.js, which names this trap.
+    await runAction(engine, new OpenFileAction(node));
+    workbench.set({ infoPanel: true });
   }
 }
@@ -1321,7 +1353,42 @@ export class RenamePromptAction extends PromptAction {
   static deps = ['engine', 'overlay', 'viewState'];
   constructor(node) { super(); this.node = node; }
   async withValue(name, { engine }) {
-    if (name !== this.node.name) await engine.dispatch(new RenameAction(this.node.id, name));
+    if (name !== this.node.name) engine.dispatch(new RenameAction(this.node.id, name));
+  }
+}
+/**
+ * Install the package the review dialog is about, with the capabilities that were ticked.
+ *
+ * The dialog used to carry an `onInstall` closure that did all of this, which put an effect
+ * inside engine state — and ran it after the dispatching action's lease had been released,
+ * with nothing of it on the feed. Two docblocks assert that a dialog spec holds no
+ * functions; this is what makes that true.
+ *
+ * `pkg` and `trust` ride on the instance because they are what the review WAS; the grants
+ * are read from viewState, because they are what the user did to it while it was open.
+ */
+export class InstallReviewedPluginAction extends Action {
+  static deps = ['notifications', 'overlay', 'plugins', 'viewState', 'workbench'];
+  constructor(pkg, trust, label) { super(); this.pkg = pkg; this.trust = trust; this.label = label; }
+  async execute({ notifications, overlay, plugins, viewState, workbench }) {
+    const grants = [...(viewState.get()[PLUGIN_REVIEW]?.grants || [])];
+    overlay.set({ dialog: null });
+    // Account installs upload the package and run a handshake that can take a while —
+    // switch to the plugins view (which shows the plugin's loading state) and hold a sticky
+    // "Installing…" toast so the user isn't left staring at nothing.
+    workbench.set({ activity: 'plugins', sidebarVisible: true });
+    const pending = notifications.info(`Installing “${this.label}”…`, { sticky: true });
+    try {
+      await plugins.install(this.pkg, { grants, trust: this.trust });
+      notifications.dismiss(pending);
+      notifications.success(`Installed “${this.label}”`);
+    } catch (err) {
+      notifications.dismiss(pending);
+      notifications.error(`Install failed: ${err.message}`);
+    }
   }
 }
@@ -1344,7 +1411,7 @@ export class CreateCollectionFromFormAction extends Action {
   constructor(record) { super(); this.record = record; }
   async execute({ engine, overlay }) {
     overlay.set({ dialog: null });
-    if (this.record) await engine.dispatch(new CreateCollectionAction(this.record));
+    if (this.record) engine.dispatch(new CreateCollectionAction(this.record));
   }
 }
@@ -1431,8 +1498,8 @@ export class SetActivityAction extends ShellAction {
  * once, here, rather than distributed over whoever owns each overlay.
  */
 export class CloseOverlaysAction extends Action {
-  static deps = ['activity', 'navigation', 'overlay', 'workbench'];
-  async execute({ activity, navigation, overlay, workbench }) {
+  static deps = ['navigation', 'overlay', 'workbench'];
+  async execute({ navigation, overlay, workbench }) {
     const o = overlay.get();
     const wb = workbench.get();
     if (o.contextMenu) return overlay.set({ contextMenu: null });
@@ -1446,9 +1513,9 @@ export class CloseOverlaysAction extends Action {
     // plugin panel deliberately: it opens BY ITSELF when a storage check finishes, and
     // Escape should not close what you opened on purpose in order to dismiss what
     // appeared on its own.
-    if (activity.state?.open) return activity.togglePanel(false);
+    if (o.activityPanel) return overlay.set({ activityPanel: false });
     // Nothing floating: Escape pops the top viewer panel instead.
-    if (navigation.state.stack.length > 1) navigation.back();
+    if (navigation.get().stack.length > 1) navigation.back();
   }
 }
@@ -1479,8 +1546,20 @@ export class VoiceSearchAction extends Action {
 /** Reindex the whole drive. Reports as a task rather than blocking — it takes minutes. */
 export class RebuildIndexAction extends Action {
-  static deps = ['activity'];
-  async execute({ activity }) { return activity.rebuildIndex().catch(() => {}); }
+  static deps = ['activity', 'api', 'engine', 'notifications'];
+  async execute({ activity, api, engine, notifications }) {
+    try {
+      const res = await api.reindex();
+      await activity.refreshTasks();
+      // "…and show the user" belongs to the action that decided to do the work, not to
+      // the service that holds the list. Three network verbs used to open the panel as a
+      // side effect of a fetch, from inside a resource.
+      engine.dispatch(new ToggleActivityPanelAction(true));
+      if (res.alreadyRunning) notifications.info('A rebuild is already running');
+    } catch (err) {
+      notifications.error(`Couldn't rebuild the index: ${err.message}`);
+    }
+  }
 }
 /**
@@ -1491,11 +1570,19 @@ export class RebuildIndexAction extends Action {
  * a scan error.
  */
 export class ScanCollectionAction extends Action {
-  static deps = ['activity', 'explorer', 'notifications'];
-  async execute({ activity, explorer, notifications }) {
+  static deps = ['activity', 'api', 'engine', 'explorer', 'notifications'];
+  async execute({ activity, api, engine, explorer, notifications }) {
     const id = explorer.get().collectionId;
     if (!id) return notifications.info('Open a collection first — a scan is per collection.');
-    return activity.scanCollection(id).catch(() => {});
+    try {
+      const res = await api.scanCollection(id);
+      await activity.refreshTasks();
+      engine.dispatch(new ToggleActivityPanelAction(true));
+      if (res.alreadyRunning) notifications.info('A scan of this collection is already running');
+      activity.followUp();
+    } catch (err) {
+      notifications.error(`Couldn't scan “${id}”: ${err.message}`);
+    }
   }
 }
@@ -1506,8 +1593,28 @@ export class ScanCollectionAction extends Action {
  * from here — the failure that makes every file open to a spinner.
  */
 export class CheckStorageAction extends Action {
-  static deps = ['activity'];
-  async execute({ activity }) { return activity.checkStorage().catch(() => {}); }
+  static deps = ['activity', 'api', 'engine', 'notifications'];
+  async execute({ activity, api, engine, notifications }) {
+    try {
+      const res = await api.checkStorage();
+      await activity.refresh();
+      engine.dispatch(new ToggleActivityPanelAction(true));
+      const problems = (res.results || []).reduce((n, r) => n + (r.findings?.length || 0), 0);
+      if (problems) {
+        notifications.warn(`Found ${problems} storage problem${problems === 1 ? '' : 's'} — see Activity`);
+      } else if (!res.checked) {
+        notifications.info('There are no collections to check yet');
+      } else if (!res.corsChecked) {
+        // Honest about what was not checked. Reporting "all good" having skipped the check
+        // that matters is how a diagnostic stops being believed.
+        notifications.info('Stores are reachable. Browser access was not checked — this drive has no public URL configured.');
+      } else {
+        notifications.success('Stores are reachable and allow browser access');
+      }
+    } catch (err) {
+      notifications.error(`Couldn't check the stores: ${err.message}`);
+    }
+  }
 }
 /** Ask for files, then upload them into the open collection. */
@@ -1515,7 +1622,10 @@ export class PickAndUploadAction extends Action {
   static deps = ['engine', 'explorer'];
   async execute({ engine, explorer }) {
     const collection = explorer.get().collectionId;
-    pickFiles((files) => files.length && engine.dispatch(new UploadFilesAction(files, collection)));
+    // Awaited, so the feed's `complete` means the upload started rather than the dialog
+    // opened — and so the leases below it are still held when the upload uses them.
+    const files = await pickFiles();
+    if (files?.length) await runAction(engine, new UploadFilesAction(files, collection));
   }
 }
@@ -1637,18 +1747,14 @@ export class PinAction extends Action {
 // --- API keys (admin) ------------------------------------------------------------
-class ApiKeyDraftAction extends Action {
-  static deps = ['apiKeys'];
-  async execute({ apiKeys }) { this.apply(apiKeys); }
-}
-export class StartApiKeyDraftAction extends ApiKeyDraftAction {
+export class StartApiKeyDraftAction extends ApiKeysAction {
   apply(s) { s.set({ draft: { name: '', expiresInDays: '', caps: {} }, error: null }); }
 }
-export class CancelApiKeyDraftAction extends ApiKeyDraftAction {
+export class CancelApiKeyDraftAction extends ApiKeysAction {
   apply(s) { s.set({ draft: null }); }
 }
 /** Forget the freshly minted secret. On dismiss, and after a copy. */
-export class ClearMintedApiKeyAction extends ApiKeyDraftAction {
+export class ClearMintedApiKeyAction extends ApiKeysAction {
   apply(s) { if (s.get().minted) s.set({ minted: null }); }
 }
@@ -1696,8 +1802,10 @@ export class SwitchCollectionAction extends Action {
       (id) => new ExecCommandAction('collections.switch', id),
       () => new ExecCommandAction('collections.create'));
     if (!items.length) return notifications.info('This drive has one collection.');
-    const w = typeof window === 'undefined' ? 800 : window.innerWidth;
-    engine.dispatch(new ShowContextMenuAction(Math.max(12, Math.round(w / 2) - 110), 120, items));
+    // No geometry: this comes from a command, not from a click, so the overlay centres it.
+    // The arithmetic that used to be here needed `window` and carried a `typeof window`
+    // guard precisely because layout has no business in the bl layer.
+    engine.dispatch(new ShowContextMenuAction(items));
   }
 }
@@ -1722,9 +1830,10 @@ export class ToggleDetailsAction extends Action {
 /** Ask for a .zip and take it through the install review. */
 export class PickAndInstallPluginAction extends Action {
-  static deps = ['notifications', 'plugins', 'social', 'workbench'];
+  static deps = ['notifications', 'overlay', 'plugins', 'social', 'workbench'];
   async execute(r) {
-    pickZip((file) => file && beginInstallFromFile(r, file));
+    const file = await pickZip();
+    if (file) await beginInstallFromFile(r, file);
   }
 }
@@ -1760,7 +1869,7 @@ export class ClearSidecarAction extends Action {
   static deps = ['social'];
   constructor(nodeId) { super(); this.nodeId = nodeId; }
   async execute({ social }) {
-    if (social.state.sidecar?.nodeId === this.nodeId) social.loadSidecar(null);
+    if (social.get().sidecar?.nodeId === this.nodeId) social.loadSidecar(null);
   }
 }
@@ -1826,17 +1935,30 @@ export class SetGrantAction extends Action {
       notifications.error?.(err?.message || 'Could not change access');
     } finally {
       acl.set({ busy: false });
-      await engine.dispatch(new LoadGrantsAction(this.collectionId)).next(['complete', 'error', 'abort']);
+      await runAction(engine, new LoadGrantsAction(this.collectionId));
     }
   }
 }
 export class LoadRotationAction extends Action {
   static deps = ['api', 'explorer', 'notifications', 'rotation'];
+  /** @param {string} [collectionId] which collection; defaults to the open one */
+  constructor(collectionId = null) { super(); this.collectionId = collectionId; }
   async execute({ api, explorer, notifications, rotation }) {
-    const collectionId = explorer.get().collectionId;
+    const collectionId = this.collectionId || explorer.get().collectionId;
     if (!collectionId) return;
-    rotation.set({ collectionId, loading: true, error: null });
+    // CLEARED when the collection changes, not merely re-stamped. `rotation` is one slice
+    // for whichever collection the settings screen is looking at, and stamping the new id
+    // while leaving the previous collection's `rotation` and `estimate` in place meant a
+    // failed load — which sets only `{loading, error}` — left collection A's running
+    // progress on screen under B's fingerprint, indefinitely, with a Start/Stop button
+    // beside it.
+    const switching = rotation.get().collectionId !== collectionId;
+    rotation.set(switching
+      ? { collectionId, rotation: null, estimate: null, loading: true, error: null }
+      : { collectionId, loading: true, error: null });
     try {
       // Both together: the estimate is meaningless without knowing whether one is already
       // running, and a screen showing one without the other invites starting a second.
@@ -1868,7 +1990,7 @@ export class BeginRotationAction extends Action {
       // fingerprint on screen is already out of date. Reload the collections or it keeps
       // showing the key the collection is moving OFF, which is the one thing this field
       // exists to get right.
-      await engine.dispatch(new LoadCollectionsAction());
+      engine.dispatch(new LoadCollectionsAction());
       notifications.info('Key rotation started. It runs in the background and survives a reload.');
     } catch (err) {
       rotation.set({ busy: false });