@dylanpiercey/work 0.0.222 → 0.1.0

package/dist/{_DNhDGBkH.js → _Bq7to522.js}

@@ -1,28 +1,103 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "./_BMI-E3GI.js";
 import { r as require_inherits, t as require_src$1 } from "./_xlrdOUsL.js";
 import { t as require_safe_buffer } from "./_BmSjjJ2E.js";
+import { createRequire } from "node:module";
 import fs from "node:fs";
 import path from "node:path";
-import { execFile, execFileSync } from "node:child_process";
+import { execFile, execFileSync, spawnSync } from "node:child_process";
+import fs$1 from "node:fs/promises";
 import os from "node:os";
 import { promisify } from "node:util";
 import { DatabaseSync } from "node:sqlite";
 import { createHash } from "node:crypto";
-//#region src/server/http.ts
-/** Error whose `status` the API error-boundary middleware uses for the response. */
-function httpError(status, message) {
-	return Object.assign(new Error(message), { status });
+//#region src/server/cache.ts
+/** Keyed stale-while-revalidate cache: a cached value is served immediately
+* (revalidating in the background when older than `ttlMs`); loads are deduped
+* per key, and `refresh` bypasses both the cache and any in-flight load. */
+function swr(ttlMs, load, seed) {
+	const cache = /* @__PURE__ */ new Map();
+	const inflight = /* @__PURE__ */ new Map();
+	function start(key, refresh) {
+		const startedAt = Date.now();
+		const promise = load(key, refresh).then((value) => {
+			const existing = cache.get(key);
+			if (!existing || existing.at <= startedAt) cache.set(key, {
+				at: Date.now(),
+				value
+			});
+			return value;
+		}).finally(() => {
+			if (inflight.get(key)?.promise === promise) inflight.delete(key);
+		});
+		inflight.set(key, {
+			promise,
+			refresh
+		});
+		return promise;
+	}
+	const read = (key, refresh = false) => {
+		if (refresh) {
+			const current = inflight.get(key);
+			return current?.refresh ? current.promise : start(key, true);
+		}
+		let cached = cache.get(key);
+		if (!cached && seed) {
+			cached = seed(key);
+			if (cached) cache.set(key, cached);
+		}
+		if (cached) {
+			if (Date.now() - cached.at >= ttlMs && !inflight.has(key)) start(key, false).catch(() => {});
+			return Promise.resolve(cached.value);
+		}
+		return inflight.get(key)?.promise ?? start(key, false);
+	};
+	/** Inject an externally fetched value (e.g. from a batched load). */
+	read.set = (key, value) => {
+		cache.set(key, {
+			at: Date.now(),
+			value
+		});
+	};
+	/** Current cached value, if any — used when a batch update must merge
+	* with a richer per-key load rather than replace it. */
+	read.get = (key) => cache.get(key)?.value;
+	return read;
 }
-/** The value of a Standard Schema `[value, issues]` pair, or a thrown 400
-* built from the issues. */
-function checked(result, what = "request") {
-	const [value, issues] = result;
-	if (issues) throw httpError(400, `invalid ${what}: ${issues.map((issue) => issue.message).join("; ")}`);
-	return value;
+/** Serialize async work per key: calls for one key run in submission order,
+* each starting only after the previous settled. The stored tail is the
+* all-settled form, so a rejection neither blocks the next caller nor leaves
+* the entry behind — the map holds only keys with work still in flight. */
+var locks = /* @__PURE__ */ new Map();
+function withLock(key, fn) {
+	const run = (locks.get(key) ?? Promise.resolve()).then(fn);
+	const tail = run.then(() => {}, () => {});
+	locks.set(key, tail);
+	tail.then(() => {
+		if (locks.get(key) === tail) locks.delete(key);
+	});
+	return run;
 }
-/** Validated request body, or a thrown 400 built from the valibot issues. */
-async function readBody(ctx) {
-	return checked(await ctx.body, "request body");
+/** One load at a time, and a short reuse window: callers join the in-flight
+* load, and a result younger than `ttlMs` is served without one. For an
+* expensive process sweep (lsof, ps, list-panes) whose answer does not
+* change within the window — `ttlMs` of 0 still collapses concurrent
+* callers onto a single spawn. */
+function shared(fn, ttlMs) {
+	let inflight = null;
+	let last = null;
+	return () => {
+		if (last && Date.now() - last.at < ttlMs) return Promise.resolve(last.value);
+		if (!inflight) inflight = fn().then((value) => {
+			last = {
+				at: Date.now(),
+				value
+			};
+			return value;
+		}).finally(() => {
+			inflight = null;
+		});
+		return inflight;
+	};
 }
 //#endregion
 //#region lib/setup/listen.mjs
@@ -66,8 +141,9 @@ var config = {
 	appPort: Number(process.env.WORK_APP_PORT || 7171),
 	/** How a workspace port is named in a hostname the app proxies
 	* (server/port-proxy.ts): `sub` is `3000.work.example.com`, `dash` is
-	* `3000-work.example.com`. The server accepts both; this only picks
-	* which one the port chips link to. `dash` stays one label under the
+	* `3000-work.example.com`. The port chips link to this one; the server
+	* takes `sub` either way, and `dash` only when it is picked
+	* (server/access.ts `dashPortName`). `dash` stays one label under the
 	* zone, which is what a free Cloudflare certificate covers. */
 	portHosts: process.env.WORK_PORT_HOSTS === "dash" ? "dash" : "sub",
 	/** The address the server listens on: this machine only, unless set
@@ -92,6 +168,11 @@ function list(value) {
 	return (value || "").split(",").map((s) => s.trim()).filter(Boolean);
 }
 fs.mkdirSync(config.dataDir, { recursive: true });
+try {
+	fs.chmodSync(config.dataDir, 448);
+} catch (err) {
+	console.warn(`[work] could not make ${config.dataDir} private: ${err.message}`);
+}
 //#endregion
 //#region src/server/exec.ts
 /** Dedicated tmux server so we never touch another multiplexer's or the
@@ -131,21 +212,25 @@ var GIT_NETWORK_MS = {
 	push: 3e5,
 	"ls-remote": 6e4
 };
-/** Never let git wait on a terminal it doesn't have — a missing credential
-* fails with a message instead of hanging the clone forever. Optional
-* locks are off because most of what runs here is a background probe (the
-* review's stamp poll, Files, the language servers' change feed): a
-* `git status` refreshing the index holds `index.lock`, and an agent's
-* `git commit` or rebase step landing in that moment fails on it. */
+/** What every git process work starts runs with, `extra` on top: `git`
+* below, and the diff's streaming reads, which spawn their own. Never let
+* git wait on a terminal it doesn't have — a missing credential fails with
+* a message instead of hanging the clone forever. Optional locks are off
+* because most of what runs here is a background probe (the review's
+* stamp poll, Files, the language servers' change feed): a `git status`
+* refreshing the index holds `index.lock`, and an agent's `git commit` or
+* rebase step landing in that moment fails on it. */
+var gitEnv = (extra) => ({
+	...process.env,
+	GIT_TERMINAL_PROMPT: "0",
+	GIT_OPTIONAL_LOCKS: "0",
+	...extra
+});
 var git = async (args, cwd) => {
 	const verb = args.find((a) => !a.startsWith("-")) ?? "";
 	const timeoutMs = GIT_NETWORK_MS[verb];
 	try {
-		return await run$1("git", args, cwd, {
-			...process.env,
-			GIT_TERMINAL_PROMPT: "0",
-			GIT_OPTIONAL_LOCKS: "0"
-		}, timeoutMs ? { timeoutMs } : void 0);
+		return await run$1("git", args, cwd, gitEnv(), timeoutMs ? { timeoutMs } : void 0);
 	} catch (err) {
 		if (timeoutMs && err.killed) throw new Error(`git ${verb} timed out after ${Math.round(timeoutMs / 1e3)}s`);
 		throw err;
@@ -201,11 +286,281 @@ function utf8Locale(env) {
 	for (const [key, value] of Object.entries(env)) if (value !== void 0) out[key] = value;
 	return forceUtf8Locale(out);
 }
+/** The release that brings a database to the baseline. WORK_BRIDGE_SPEC
+* names another (an `npm pack` tarball of it) to try the bridge before it
+* is published. */
+function bridgeSpec() {
+	return process.env.WORK_BRIDGE_SPEC || "@dylanpiercey/work@0.0.223";
+}
+/** What to run by hand for the database in `dataDir`: its data dir named
+* outright, since the shell running it may not have the service's. */
+function bridgeCommands(dataDir) {
+	return [`WORK_DATA_DIR=${/^[\w@%+=:,./-]+$/.test(dataDir) ? dataDir : `'${dataDir.replace(/'/g, `'\\''`)}'`} npx -y -p ${bridgeSpec()} work migrate`, "work setup"];
+}
+/** Whether the database at `file` predates the baseline: it has tables and
+* no version. A missing or empty one is simply new. node:sqlite is loaded
+* here, not at the top: it warns on load under older node, and every other
+* CLI command would say so. */
+function needsBridge(file) {
+	if (!fs.existsSync(file)) return false;
+	const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+	const db = new DatabaseSync(file, { readOnly: true });
+	try {
+		const { user_version } = db.prepare("PRAGMA user_version").get();
+		const tables = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table'").get();
+		return user_version < 1 && !!tables;
+	} finally {
+		db.close();
+	}
+}
+/** Bring the database in `dataDir` to the baseline when it predates it,
+* with `env` (the service's) so the sweeps see the same data dir and
+* workspaces root the server does. True when it is there (or never needed
+* to be). The package's install scripts are skipped: `migrate` needs none,
+* and a native build that fails would fail the bridge with it. */
+function bridgeIfNeeded(dataDir, env, log = () => {}) {
+	const file = path.join(dataDir, "work.db");
+	if (!needsBridge(file)) return true;
+	log(`${file} predates 0.1: bringing it forward once with ${bridgeSpec()} (a one-time download)`);
+	const sibling = path.join(path.dirname(process.execPath), "npx");
+	const npx = fs.existsSync(sibling) ? sibling : "npx";
+	spawnSync(npx, [
+		"-y",
+		"-p",
+		bridgeSpec(),
+		"work",
+		"migrate"
+	], {
+		stdio: "inherit",
+		env: {
+			...env,
+			WORK_DATA_DIR: dataDir,
+			npm_config_ignore_scripts: "true"
+		}
+	});
+	return !needsBridge(file);
+}
+/** The server's bridge, for db.ts to hand the migrations: with the server's
+* own environment, before the database is opened, once per start. */
+function bridgeForServer(dataDir) {
+	return bridgeIfNeeded(dataDir, process.env, (line) => console.log(`[work] ${line}`));
+}
+//#endregion
+//#region src/server/migrations.ts
+var STEPS = [{
+	version: 1,
+	name: "baseline",
+	up(db) {
+		db.exec(`
+        CREATE TABLE workspaces (
+          id TEXT PRIMARY KEY,
+          name TEXT NOT NULL,
+          path TEXT NOT NULL UNIQUE,
+          branch TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'archived')),
+          created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+          materialized INTEGER NOT NULL DEFAULT 1,
+          origin_branch TEXT,
+          imported_at TEXT
+        );
+
+        CREATE TABLE repos (
+          workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+          full_name TEXT NOT NULL,
+          worktree TEXT NOT NULL,
+          base_branch TEXT NOT NULL,
+          default_branch TEXT NOT NULL,
+          PRIMARY KEY (workspace_id, full_name)
+        );
+
+        CREATE TABLE sessions (
+          id TEXT PRIMARY KEY,
+          workspace_id TEXT REFERENCES workspaces(id) ON DELETE SET NULL,
+          agent TEXT NOT NULL,
+          title TEXT,
+          created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+        );
+
+        CREATE TABLE settings (
+          key TEXT PRIMARY KEY,
+          value TEXT NOT NULL
+        );
+
+        CREATE TABLE review_comments (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+          worktree TEXT NOT NULL,
+          path TEXT NOT NULL,
+          side TEXT NOT NULL DEFAULT 'additions',
+          line_start INTEGER NOT NULL,
+          line_end INTEGER NOT NULL,
+          text TEXT NOT NULL,
+          created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+          head TEXT,
+          snippet TEXT
+        );
+
+        CREATE TABLE push_subscriptions (
+          endpoint TEXT PRIMARY KEY,
+          data TEXT NOT NULL
+        );
+
+        CREATE TABLE dismissed_prs (
+          workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+          full_name TEXT NOT NULL,
+          number INTEGER NOT NULL,
+          PRIMARY KEY (workspace_id, full_name, number)
+        );
+
+        CREATE TABLE review_marks (
+          workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+          worktree TEXT NOT NULL,
+          branch TEXT NOT NULL,
+          path TEXT NOT NULL,
+          fingerprint TEXT NOT NULL,
+          PRIMARY KEY (workspace_id, worktree, branch, path)
+        );
+      `);
+	}
+}, {
+	version: 2,
+	name: "drop what 0.0.x kept for its upgrades",
+	up(db) {
+		db.exec(`
+        DELETE FROM review_marks WHERE path = '';
+        DELETE FROM settings
+          WHERE key IN ('review-cleared-diff-v2', 'ui.diff-uncommitted', 'diff-uncommitted')
+             OR key GLOB 'review.seen:*';
+      `);
+		for (const name of [
+			"tab",
+			"diff-filter",
+			"diff-folded",
+			"diff-collapsed",
+			"diff-focus",
+			"diff-pos",
+			"files-recent"
+		]) {
+			const prefix = `ui.${name}:`;
+			db.prepare("DELETE FROM settings WHERE key GLOB ? AND substr(key, ?) NOT IN (SELECT id FROM workspaces)").run(`${prefix}*`, prefix.length + 1);
+		}
+		const pref = (key) => db.prepare("SELECT value FROM settings WHERE key = ?").get(key)?.value;
+		const parse = (text) => {
+			try {
+				return text === void 0 ? void 0 : JSON.parse(text);
+			} catch {
+				return;
+			}
+		};
+		const font = parse(pref("ui.term-font"));
+		if (font && typeof font === "object") {
+			for (const device of ["desktop", "touch"]) if (Number.isInteger(font[device])) db.prepare("INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)").run(`ui.term-font-${device}`, String(font[device]));
+		}
+		db.exec("DELETE FROM settings WHERE key = 'ui.term-font'");
+		const keys = parse(pref("ui.phone-keys"));
+		if (Array.isArray(keys)) db.prepare("UPDATE settings SET value = ? WHERE key = 'ui.phone-keys'").run(JSON.stringify({
+			base: [],
+			extra: keys
+		}));
+	}
+}];
+var LATEST = STEPS.at(-1).version;
+/** The database at `file`, at the latest version: an empty one is built by
+* every step, an existing one gets those it lacks — each in a transaction
+* of its own with its version stamp inside it, after a copy of the whole
+* file (`work.db.v<from>.bak` beside it, the newest two kept). One from
+* before the baseline is handed to `bridge` first, when given (the
+* server's: lib/setup/bridge.mjs). Throws, with what to do in its message,
+* for a database this code cannot open: one still from before the
+* baseline, one from a newer release, or one a step failed on (rolled back
+* to the step before). */
+function openDatabase(file, { bridge } = {}) {
+	if (bridge && needsBridge(file)) bridge(path.dirname(file));
+	const db = new DatabaseSync(file);
+	try {
+		db.exec("PRAGMA busy_timeout = 5000");
+		db.exec("PRAGMA journal_mode = WAL");
+		migrate(db, file);
+		db.exec("PRAGMA foreign_keys = ON");
+		return db;
+	} catch (err) {
+		db.close();
+		throw err;
+	}
+}
+function versionOf(db) {
+	return db.prepare("PRAGMA user_version").get().user_version;
+}
+function migrate(db, file) {
+	const from = versionOf(db);
+	const empty = !db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table'").get();
+	if (from < 1 && !empty) throw new Error(`${file} predates 0.1 and has not been brought forward (once, with the network: \`work setup\`, or this server on its next start). By hand:\n  ${bridgeCommands(path.dirname(file)).join("\n  ")}`);
+	if (from > LATEST) {
+		const backup = newestBackup(file, LATEST);
+		throw new Error(`${file} is at schema version ${from}, and this work knows up to ${LATEST}: a newer release upgraded it. Update work (\`work update\`)${backup ? `, or restore ${backup}, the copy taken before it did` : ""}.`);
+	}
+	const pending = STEPS.filter((s) => s.version > from);
+	if (!pending.length) return;
+	const backup = empty ? null : snapshot(db, file, from);
+	for (const step of pending) {
+		db.exec("BEGIN IMMEDIATE");
+		try {
+			if (versionOf(db) >= step.version) {
+				db.exec("ROLLBACK");
+				continue;
+			}
+			step.up(db);
+			db.exec(`PRAGMA user_version = ${step.version}`);
+			db.exec("COMMIT");
+		} catch (err) {
+			try {
+				db.exec("ROLLBACK");
+			} catch {}
+			throw new Error(`${file}: step ${step.version} (${step.name}) failed and was rolled back, leaving the database at version ${versionOf(db)}: ${err.message}${backup ? `. The copy from before this upgrade is ${backup}` : ""}`);
+		}
+	}
+}
+var backupName = (file, version) => `${path.basename(file)}.v${version}.bak`;
+/** The file's backups, newest version first. */
+function backups(file) {
+	const dir = path.dirname(file);
+	const re = new RegExp(`^${path.basename(file).replace(/\./g, "\\.")}\\.v(\\d+)\\.bak$`);
+	let names = [];
+	try {
+		names = fs.readdirSync(dir);
+	} catch {}
+	return names.map((name) => re.exec(name)).filter((m) => !!m).map((m) => ({
+		file: path.join(dir, m[0]),
+		version: Number(m[1])
+	})).sort((a, b) => b.version - a.version);
+}
+function newestBackup(file, atMost) {
+	return backups(file).find((b) => b.version <= atMost)?.file ?? null;
+}
+/** A copy of the whole database as it is before an upgrade from `version`,
+* which a release that knows `version` can open. */
+function snapshot(db, file, version) {
+	const dest = path.join(path.dirname(file), backupName(file, version));
+	fs.rmSync(dest, { force: true });
+	db.prepare("VACUUM INTO ?").run(dest);
+	for (const old of backups(file).slice(2)) fs.rmSync(old.file, { force: true });
+	return dest;
+}
 //#endregion
 //#region src/server/db.ts
 if (!path.isAbsolute(config.dataDir)) throw new Error(`data dir must be absolute, got "${config.dataDir}" — check WORK_DATA_DIR and $HOME`);
-var db = new DatabaseSync(path.join(config.dataDir, "work.db"));
-db.exec("PRAGMA busy_timeout = 5000");
+/** The app's database, at the latest schema version before anything reads
+* it (server/migrations.ts), one from before 0.1 bridged first. One this
+* release cannot open stops the server here, saying what to do: a stack
+* trace would bury that under itself. */
+var db = (() => {
+	try {
+		return openDatabase(path.join(config.dataDir, "work.db"), { bridge: bridgeForServer });
+	} catch (err) {
+		console.error(`[work] ${err.message}`);
+		process.exit(1);
+	}
+})();
 /** Prepared statements, kept by their SQL: preparing is most of a small
 * query's cost (10 µs against 4), and a status build runs hundreds. The
 * texts are the call sites' own, so the set is small; the cap covers any
@@ -229,90 +584,33 @@ function get(sql, ...params) {
 function workspacePath(id) {
 	return get("SELECT path FROM workspaces WHERE id = ?", id)?.path;
 }
-var freshReview = !db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'review_comments'").get();
-db.exec(`
-  PRAGMA journal_mode = WAL;
-  PRAGMA foreign_keys = ON;
-
-  CREATE TABLE IF NOT EXISTS workspaces (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    path TEXT NOT NULL UNIQUE,
-    branch TEXT NOT NULL,
-    status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'archived')),
-    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
-  );
-
-  CREATE TABLE IF NOT EXISTS repos (
-    workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
-    full_name TEXT NOT NULL,
-    worktree TEXT NOT NULL,
-    base_branch TEXT NOT NULL,
-    default_branch TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, full_name)
-  );
-
-  CREATE TABLE IF NOT EXISTS sessions (
-    id TEXT PRIMARY KEY,
-    workspace_id TEXT REFERENCES workspaces(id) ON DELETE SET NULL,
-    agent TEXT NOT NULL,
-    title TEXT,
-    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
-  );
-
-  CREATE TABLE IF NOT EXISTS settings (
-    key TEXT PRIMARY KEY,
-    value TEXT NOT NULL
-  );
-
-  CREATE TABLE IF NOT EXISTS review_comments (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
-    worktree TEXT NOT NULL,
-    path TEXT NOT NULL,
-    side TEXT NOT NULL DEFAULT 'additions',
-    line_start INTEGER NOT NULL,
-    line_end INTEGER NOT NULL,
-    text TEXT NOT NULL,
-    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
-  );
-
-  CREATE TABLE IF NOT EXISTS push_subscriptions (
-    endpoint TEXT PRIMARY KEY,
-    data TEXT NOT NULL
-  );
-
-  CREATE TABLE IF NOT EXISTS dismissed_prs (
-    workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
-    full_name TEXT NOT NULL,
-    number INTEGER NOT NULL,
-    PRIMARY KEY (workspace_id, full_name, number)
-  );
-
-  -- Viewed marks (server/viewed.ts): a file of a branch, and its change
-  -- as it was when marked. Keep in sync with scripts/migrate.mjs, which
-  -- creates it too.
-  CREATE TABLE IF NOT EXISTS review_marks (
-    workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
-    worktree TEXT NOT NULL,
-    branch TEXT NOT NULL,
-    path TEXT NOT NULL,
-    fingerprint TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, worktree, branch, path)
-  );
-`);
-if (freshReview) db.prepare("INSERT OR IGNORE INTO settings (key, value) VALUES ('review-cleared-diff-v2', '1')").run();
-/** Additive schema changes: `CREATE TABLE IF NOT EXISTS` never revisits a
-* table that already exists, so a column added after a release has to be
-* bolted on here for databases created before it. */
-function ensureColumn(table, column, decl) {
-	if (!db.prepare(`PRAGMA table_info(${table})`).all().some((c) => c.name === column)) db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${decl}`);
-}
-ensureColumn("review_comments", "head", "TEXT");
-ensureColumn("review_comments", "snippet", "TEXT");
-ensureColumn("workspaces", "materialized", "INTEGER NOT NULL DEFAULT 1");
-ensureColumn("workspaces", "origin_branch", "TEXT");
-ensureColumn("workspaces", "imported_at", "TEXT");
+//#endregion
+//#region src/server/http.ts
+/** Who may frame the app's own responses: the app alone (the review's PDF
+* preview). A page elsewhere that frames it can dress a click on it as a
+* click on something of its own. A route that sends a
+* Content-Security-Policy of its own replaces this one, so it names
+* `FRAME_ANCESTORS` too. */
+var FRAME_ANCESTORS = "frame-ancestors 'self'";
+var FRAME_HEADERS = {
+	"content-security-policy": FRAME_ANCESTORS,
+	"x-frame-options": "SAMEORIGIN"
+};
+/** Error whose `status` the API error-boundary middleware uses for the response. */
+function httpError(status, message) {
+	return Object.assign(new Error(message), { status });
+}
+/** The value of a Standard Schema `[value, issues]` pair, or a thrown 400
+* built from the issues. */
+function checked(result, what = "request") {
+	const [value, issues] = result;
+	if (issues) throw httpError(400, `invalid ${what}: ${issues.map((issue) => issue.message).join("; ")}`);
+	return value;
+}
+/** Validated request body, or a thrown 400 built from the valibot issues. */
+async function readBody(ctx) {
+	return checked(await ctx.body, "request body");
+}
 //#endregion
 //#region src/client/pref-change.ts
 /** The stored text after `change`, or null when nothing is left. A value
@@ -642,6 +940,18 @@ var DEFAULT_GITHUB_HOST = "github.com";
 function toolById(id) {
 	return TOOLS.find((t) => t.id === id) || PROJECT_TOOLS.find((t) => t.id === id) || null;
 }
+/** A version that is only a version (`latest`, `lts`, `22`, `1.2.3-rc.1`),
+* not one of mise's forms that build from a git ref or point at a path
+* (`ref:`, `path:`, `prefix:`). */
+var PLAIN_VERSION = /^(?!-)[\w.+-]+$/;
+/** Whether a mise pin is one of the tools above, as they install, at a
+* plain version: what a restore takes without asking. Any other name —
+* a registry tool the catalog does not list, a backend (`npm:`, `ubi:`,
+* `github:`, `cargo:`, `go:`, `pipx:` …), a URL — installs and runs
+* whatever it names, so a restore takes it only when it is named. */
+function catalogPin(name, version) {
+	return [...TOOLS, ...PROJECT_TOOLS].some((t) => t.mise === name) && PLAIN_VERSION.test(version);
+}
 function agentById(id) {
 	return AGENTS$1.find((a) => a.id === id) || null;
 }
@@ -711,8 +1021,9 @@ function setupDirs() {
 	};
 	return dirsFor.dirs;
 }
-/** `~/…` for anything under the home directory — every path here is for
-* display (Settings rows, `work doctor`), never re-used to exec. */
+/** `~/…` for anything under the home directory — every path given it is
+* for display (Settings rows, `work doctor`, a language server's
+* definition outside every checkout), never re-used to exec. */
 function tilde(p) {
 	if (!p) return p;
 	return p === home ? "~" : p.startsWith(home + path.sep) ? "~" + p.slice(home.length) : p;
@@ -779,6 +1090,40 @@ async function readMiseInstalls() {
 	} catch {}
 	return out;
 }
+/** A path owned by one release of a version manager — mise/asdf
+* `installs`, homebrew's `Cellar`, nvm's `versions` — which that tool
+* deletes on its next update. */
+var VERSIONED_PATH = /\/(installs|Cellar|versions|toolchains)\//;
+/** The gh for git to run as a credential helper: the launcher on PATH
+* (mise's shim, /usr/bin/gh), when it is not itself one release's. Still an
+* absolute path, so it works for GUI clients and cron jobs that never
+* sourced a shell profile, but one that follows upgrades. */
+function stableGh() {
+	const gh = which("gh");
+	return gh && !VERSIONED_PATH.test(gh) ? gh : null;
+}
+/** Credential helpers in ~/.gitconfig that run a gh which is gone, by
+* config key. `gh auth setup-git` writes the absolute path of the gh that
+* ran it, and git runs that string literally: once a version manager's
+* upgrade deletes it, every https push fails with "could not read
+* Username" while `gh` itself still works. Listed only when there is a
+* stable gh to point them at, which `work setup` does. */
+async function staleGhHelpers() {
+	if (!stableGh()) return [];
+	const { stdout } = await run("git", [
+		"config",
+		"--global",
+		"--get-regexp",
+		String.raw`^credential\..*\.helper$`
+	]);
+	const keys = /* @__PURE__ */ new Set();
+	for (const line of stdout.split("\n")) {
+		const sp = line.indexOf(" ");
+		const bin = /^!(\S+) auth git-credential$/.exec(line.slice(sp + 1))?.[1];
+		if (sp > 0 && bin && !fs.existsSync(bin)) keys.add(line.slice(0, sp));
+	}
+	return [...keys];
+}
 /** Hosts `gh` knows about (~/.config/gh/hosts.yml top-level keys) — the
 * source of truth for "which GitHub hosts has this machine signed in to",
 * merged with whatever the caller has configured. */
@@ -949,11 +1294,12 @@ async function doctor(opts = {}) {
 		...opts.hosts || [],
 		...ghKnownHosts()
 	]);
-	const [versions, github, awake, extensions] = await Promise.all([
+	const [versions, github, awake, extensions, helpers] = await Promise.all([
 		miseVersions(),
 		Promise.all([...hostSet].map(githubHostStatus)),
 		canStayAwake(),
-		ghExtensions()
+		ghExtensions(),
+		staleGhHelpers()
 	]);
 	const tools = TOOLS.map((t) => {
 		if (t.ghExtension) {
@@ -994,7 +1340,8 @@ async function doctor(opts = {}) {
 		tools,
 		agents,
 		github,
-		awake
+		awake,
+		staleGhHelpers: helpers
 	};
 }
 //#endregion
@@ -1017,8 +1364,7 @@ var PREF_MAX = 4096;
 /** The prefs kept per workspace, keyed `<name>:<workspace id>`. They ride
 * every page's HTML, so they go with the workspace (`deleteWorkspacePrefs`)
 * and /api/prefs refuses them for one that is gone; one missing here
-* outlives its workspace for good. `scripts/migrate.mjs` prunes orphans of
-* the same list. */
+* outlives its workspace for good. */
 var WORKSPACE_PREFS = [
 	"tab",
 	"diff-filter",
@@ -1106,96 +1452,6 @@ function preferredAgent(enabled = enabledAgents()) {
 	return enabled[0] || "shell";
 }
 //#endregion
-//#region src/server/cache.ts
-/** Keyed stale-while-revalidate cache: a cached value is served immediately
-* (revalidating in the background when older than `ttlMs`); loads are deduped
-* per key, and `refresh` bypasses both the cache and any in-flight load. */
-function swr(ttlMs, load, seed) {
-	const cache = /* @__PURE__ */ new Map();
-	const inflight = /* @__PURE__ */ new Map();
-	function start(key, refresh) {
-		const startedAt = Date.now();
-		const promise = load(key, refresh).then((value) => {
-			const existing = cache.get(key);
-			if (!existing || existing.at <= startedAt) cache.set(key, {
-				at: Date.now(),
-				value
-			});
-			return value;
-		}).finally(() => {
-			if (inflight.get(key)?.promise === promise) inflight.delete(key);
-		});
-		inflight.set(key, {
-			promise,
-			refresh
-		});
-		return promise;
-	}
-	const read = (key, refresh = false) => {
-		if (refresh) {
-			const current = inflight.get(key);
-			return current?.refresh ? current.promise : start(key, true);
-		}
-		let cached = cache.get(key);
-		if (!cached && seed) {
-			cached = seed(key);
-			if (cached) cache.set(key, cached);
-		}
-		if (cached) {
-			if (Date.now() - cached.at >= ttlMs && !inflight.has(key)) start(key, false).catch(() => {});
-			return Promise.resolve(cached.value);
-		}
-		return inflight.get(key)?.promise ?? start(key, false);
-	};
-	/** Inject an externally fetched value (e.g. from a batched load). */
-	read.set = (key, value) => {
-		cache.set(key, {
-			at: Date.now(),
-			value
-		});
-	};
-	/** Current cached value, if any — used when a batch update must merge
-	* with a richer per-key load rather than replace it. */
-	read.get = (key) => cache.get(key)?.value;
-	return read;
-}
-/** Serialize async work per key: calls for one key run in submission order,
-* each starting only after the previous settled. The stored tail is the
-* all-settled form, so a rejection neither blocks the next caller nor leaves
-* the entry behind — the map holds only keys with work still in flight. */
-var locks = /* @__PURE__ */ new Map();
-function withLock(key, fn) {
-	const run = (locks.get(key) ?? Promise.resolve()).then(fn);
-	const tail = run.then(() => {}, () => {});
-	locks.set(key, tail);
-	tail.then(() => {
-		if (locks.get(key) === tail) locks.delete(key);
-	});
-	return run;
-}
-/** One load at a time, and a short reuse window: callers join the in-flight
-* load, and a result younger than `ttlMs` is served without one. For an
-* expensive process sweep (lsof, ps, list-panes) whose answer does not
-* change within the window — `ttlMs` of 0 still collapses concurrent
-* callers onto a single spawn. */
-function shared(fn, ttlMs) {
-	let inflight = null;
-	let last = null;
-	return () => {
-		if (last && Date.now() - last.at < ttlMs) return Promise.resolve(last.value);
-		if (!inflight) inflight = fn().then((value) => {
-			last = {
-				at: Date.now(),
-				value
-			};
-			return value;
-		}).finally(() => {
-			inflight = null;
-		});
-		return inflight;
-	};
-}
-//#endregion
 //#region src/server/events.ts
 var listeners$1 = /* @__PURE__ */ new Set();
 function publish(type, data) {
@@ -1219,7 +1475,7 @@ function subscribe(listener) {
 	listeners$1.add(listener);
 	return () => listeners$1.delete(listener);
 }
-/** Connected SSE clients — lets background watchers idle when no one
+/** Connected events-bus clients — lets background watchers idle when no one
 * is listening. */
 function subscriberCount() {
 	return listeners$1.size;
@@ -7177,7 +7433,7 @@ var background = /* @__PURE__ */ new Map();
 /** A turn's end is pushed once it has stayed ended this long. Stop fires
 * again each time something sends the agent back to work (a stop hook
 * that continues it, a goal loop, background subagents reporting in), and
-* each of those ends was a "Finished" on the phone while it carried on. */
+* each of those ends would be a "Finished" on the phone while it carries on. */
 var DONE_SETTLE_MS = 3e3;
 var listeners = /* @__PURE__ */ new Set();
 /** Called on every phase transition (the status snapshot drops itself). */
@@ -7350,7 +7606,7 @@ function publishChange(sessionId) {
 	const row = get("SELECT workspace_id FROM sessions WHERE id = ?", sessionId);
 	if (row?.workspace_id) {
 		const workspaceId = row.workspace_id;
-		import("./_u9qRCTjI.js").then((m) => m.notifySessionsChanged(workspaceId));
+		import("./_CkwTsHKB.js").then((m) => m.notifySessionsChanged(workspaceId));
 		return;
 	}
 	publish("sessions.changed");
@@ -7760,10 +8016,10 @@ async function fetchUsage$3(account) {
 var PROFILE_TTL_MS = 36e5;
 var profiles = /* @__PURE__ */ new Map();
 /** The account's plan as Anthropic has it now. `.claude.json` holds what
-* Claude Code saw at sign-in, and it only asks again on a new login, so an
-* upgrade (Max 5x → 20x) kept reading as the old plan until then. Asked
-* with the same token as the usage; the cached plan stands in when it
-* cannot be. */
+* Claude Code saw at sign-in, and it only asks again on a new login, so
+* from it alone an upgrade (Max 5x → 20x) reads as the old plan until
+* then. Asked with the same token as the usage; the cached plan stands in
+* when it cannot be. */
 async function livePlan(account) {
 	const hit = profiles.get(account.dir);
 	if (hit && Date.now() - hit.at < PROFILE_TTL_MS) return hit.plan;
@@ -8664,6 +8920,47 @@ var cursor = {
 	usage: () => cursorRow().then((row) => [row])
 };
 //#endregion
+//#region src/server/paths.ts
+/** Whether `target` is `root` or somewhere under it, by name alone. Both
+* are normalised first, so `..` and a trailing slash count as the
+* filesystem would count them, and the separator after `root` is the
+* whole point: a sibling `…/work-2` is not in `…/work`. A relative
+* `target` is in nothing — an empty one is a process cwd that could not
+* be read, not the root. A symlink under `root` can still lead out: what
+* is read through one wants `realInside`. */
+function inside(target, root) {
+	if (!path.isAbsolute(target)) return false;
+	const top = path.resolve(root);
+	const full = path.resolve(target);
+	return full === top || full.startsWith(top.endsWith(path.sep) ? top : top + path.sep);
+}
+/** Where `file` — named from `root`, as git and the pages name a
+* checkout's files, or absolute — really leads through every symlink,
+* when that is still `root` or under it; null when it leads out or is not
+* there. The check by name alone lets a symlink in a repo, which a branch
+* can add, point a read at any file on the machine. */
+async function realInside(file, root) {
+	const full = path.resolve(root, file);
+	if (!inside(full, root)) return null;
+	try {
+		const [top, real] = await Promise.all([fs$1.realpath(root), fs$1.realpath(full)]);
+		return inside(real, top) ? real : null;
+	} catch {
+		return null;
+	}
+}
+/** `realInside` for a caller that cannot wait. */
+function realInsideSync(file, root) {
+	const full = path.resolve(root, file);
+	if (!inside(full, root)) return null;
+	try {
+		const real = fs.realpathSync(full);
+		return inside(real, fs.realpathSync(root)) ? real : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/agents/grok/usage.ts
 var AUTH = path.join(HOME, ".grok", "auth.json");
 var LOG = path.join(HOME, ".grok", "logs", "unified.jsonl");
@@ -8836,7 +9133,7 @@ function scratch() {
 			return os.tmpdir();
 		}
 	})();
-	return hookFile().startsWith(tmp + path.sep);
+	return inside(hookFile(), tmp);
 }
 /** Whether Grok's hook registry names work's hook file — without it Grok
 * reports nothing and the screen has to speak for it. Read from disk, not
@@ -9364,10 +9661,10 @@ function tmuxWasStarted(id) {
 function clearTmuxStarted(id) {
 	tmuxStarted.delete(id);
 }
-/** SSE payload: session rows + live tmux/hook state so clients don't refetch.
-* Coalesced per workspace: a turn boundary lands as a burst of phase
-* transitions (hook, then scrape), and each one cost a list-panes spawn
-* and a broadcast for a list that came out the same. */
+/** Events-bus payload: session rows + live tmux/hook state so clients
+* don't refetch. Coalesced per workspace: a turn boundary lands as a burst
+* of phase transitions (hook, then scrape), and each one cost a list-panes
+* spawn and a broadcast for a list that came out the same. */
 var EMIT_DEBOUNCE_MS = 50;
 var pendingEmits = /* @__PURE__ */ new Map();
 function notifySessionsChanged(workspaceId) {
@@ -9394,8 +9691,14 @@ async function emitSessionsChanged(workspaceId) {
 async function killWorkspaceSessions(workspaceId) {
 	for (const session of listSessions(workspaceId)) await killSession(session.id);
 }
+/** Control characters a paste never means: C0 but tab and line breaks,
+* ESC, DEL and C1. The text can quote a reviewed file, which is repo
+* content, and an ESC in it can end the bracketed paste early on a tmux
+* that passes one through, typing the rest into the pane as keys. */
+var PASTE_UNSAFE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/g;
 /** Type text into a session's tmux (bracketed paste + Enter), creating it if needed. */
-async function sendToSession(id, text, size) {
+async function sendToSession(id, raw, size) {
+	const text = raw.replace(PASTE_UNSAFE, "");
 	const session = getSession(id);
 	if (!session) throw new Error("unknown session");
 	const wsPath = workspacePath(session.workspace_id);
@@ -9534,28 +9837,12 @@ async function listPanesNow() {
 	};
 	return panes;
 }
-/** Cleared once per process — boot already runs this, and a server we
-* create below never has PORT set, so re-running on every attach only
-* unsets something already unset. */
-var portCleared = false;
 /** Start the tmux server in its own systemd user unit so it escapes this
 * service's cgroup — otherwise `systemctl restart work` kills every
 * session with it. A hidden "work-keeper" session pins the server alive
 * (tmux exits when its last session closes). */
 async function ensureTmuxServer() {
-	if (await tmux(["has-session"]).then(() => true, () => false)) {
-		if (!portCleared) {
-			await tmux([
-				"set-environment",
-				"-g",
-				"-u",
-				"PORT"
-			]).catch(() => {});
-			portCleared = true;
-		}
-		return;
-	}
-	portCleared = true;
+	if (await tmux(["has-session"]).then(() => true, () => false)) return;
 	await run$1("systemd-run", [
 		"--user",
 		`--unit=${TMUX_SOCKET === "work" ? "work-tmux" : `work-tmux-${TMUX_SOCKET.replace(/[^\w.:-]/g, "_")}`}`,
@@ -9573,68 +9860,71 @@ async function ensureTmuxServer() {
 	], os.homedir()).catch(() => {});
 }
 /** Full tmux command (options + new-session) for creating/attaching a
-* session's tmux; `mode` is "-d" (create detached) or "-A" (attach-or-create). */
+* session's tmux; `mode` is "-d" (create detached) or "-A" (attach-or-create).
+* Every `set-option` is `-q`: one failed command drops the rest of a `;`
+* chain, new-session included, and a tmux older than an option
+* (`fill-character`, `extended-keys-format`) rejects its name. */
 function newSessionArgs(session, wsPath, mode, initialPrompt, size) {
 	return [
 		"start-server",
 		";",
 		"set-option",
-		"-g",
+		"-gq",
 		"status",
 		"off",
 		";",
 		"set-option",
-		"-g",
+		"-gq",
 		"mouse",
 		"on",
 		";",
 		"set-option",
-		"-g",
+		"-gq",
 		"history-limit",
 		"5000",
 		";",
 		"set-option",
-		"-g",
+		"-gq",
 		"fill-character",
 		" ",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"set-clipboard",
 		"on",
 		";",
 		"set-option",
-		"-g",
+		"-gq",
 		"focus-events",
 		"on",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"extended-keys",
 		"on",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"extended-keys-format",
 		"csi-u",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"terminal-features[100]",
 		"*:hyperlinks",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"terminal-features[101]",
 		"*:clipboard",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"terminal-features[102]",
 		"*:sync:RGB",
 		";",
 		"set-option",
-		"-s",
+		"-sq",
 		"terminal-features[103]",
 		"*:sixel",
 		";",
@@ -9825,4 +10115,4 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
-export { publish as $, noteBackground as A, agentLabel$1 as At, agentLabel as B, run$1 as Bt, readHookPayload as C, miseVersions as Ct, clearAgentPhase as D, PROJECT_TOOLS as Dt, agentPhase as E, DEFAULT_GITHUB_HOST as Et, setSessionViewers as F, get as Ft, manifest as G, readBody as Gt, ACCENT_RE as H, config as Ht, settleQuietWorking as I, workspacePath as It, deleteSubscription as J, normalizeAccent as K, agentBadge as L, TMUX_SOCKET as Lt, onPhaseChange as M, applyPrefChange as Mt, setAgentPhase as N, all as Nt, hookPhase as O, TOOLS as Ot, setScrapedPhase as P, db as Pt, validSubscription as Q, agentFamily as R, gh as Rt, AGENTS as S, miseInstalls as St, blankRow as T, which as Tt, getInstance as U, checked as Ut, agentMeta as V, tmux as Vt, iconSvg as W, httpError as Wt, saveSubscription as X, pushPublicKey as Y, sendPush as Z, renameSession as _, setPref as _t, ensureTmuxServer as a, withLock as at, tmuxName as b, doctor as bt, killSession as c, agentChoices as ct, listPanesWithin as d, deleteWorkspacePrefs as dt, publishJson as et, listSessions as f, disabledAgents as ft, panePids as g, setDisabledAgents as gt, notifySessionsChanged as h, preferredAgent as ht, disposeSessions as i, swr as it, noteUserAnswered as j, toolById as jt, hookReportedAt as k, agentById as kt, killWorkspaceSessions as l, allPrefs as lt, newSessionArgs as m, getSetting as mt, clearTmuxStarted as n, subscriberCount as nt, forgetPanes as o, PREF_MAX as ot, markTmuxStarted as p, enabledAgents as pt, setInstance as q, createSession as r, shared as rt, getSession as s, WORKSPACE_PREFS as st, cleanEnv as t, subscribe as tt, listPanes as u, changePref as ut, sendToSession as v, setSetting as vt, reportsWorking as w, setupPath as wt, tmuxWasStarted as x, ghKnownHosts as xt, sessionStates as y, discoverAgents as yt, agentFromCommand as z, git as zt };
+export { saveSubscription as $, swr as $t, clearAgentPhase as A, TOOLS as At, agentBadge as B, readBody as Bt, readHookPayload as C, miseVersions as Ct, realInsideSync as D, which as Dt, realInside as E, tilde as Et, onPhaseChange as F, applyPrefChange as Ft, ACCENT_RE as G, TMUX_SOCKET as Gt, agentFromCommand as H, db as Ht, setAgentPhase as I, FRAME_ANCESTORS as It, manifest as J, gitEnv as Jt, getInstance as K, gh as Kt, setScrapedPhase as L, FRAME_HEADERS as Lt, hookReportedAt as M, agentLabel$1 as Mt, noteBackground as N, catalogPin as Nt, blankRow as O, DEFAULT_GITHUB_HOST as Ot, noteUserAnswered as P, toolById as Pt, pushPublicKey as Q, shared as Qt, setSessionViewers as R, checked as Rt, AGENTS as S, miseInstalls as St, inside as T, stableGh as Tt, agentLabel as U, get as Ut, agentFamily as V, all as Vt, agentMeta as W, workspacePath as Wt, setInstance as X, tmux as Xt, normalizeAccent as Y, run$1 as Yt, deleteSubscription as Z, config as Zt, renameSession as _, setPref as _t, ensureTmuxServer as a, subscriberCount as at, tmuxName as b, doctor as bt, killSession as c, agentChoices as ct, listPanesWithin as d, deleteWorkspacePrefs as dt, withLock as en, sendPush as et, listSessions as f, disabledAgents as ft, panePids as g, setDisabledAgents as gt, notifySessionsChanged as h, preferredAgent as ht, disposeSessions as i, subscribe as it, hookPhase as j, agentById as jt, agentPhase as k, PROJECT_TOOLS as kt, killWorkspaceSessions as l, allPrefs as lt, newSessionArgs as m, getSetting as mt, clearTmuxStarted as n, publish as nt, forgetPanes as o, PREF_MAX as ot, markTmuxStarted as p, enabledAgents as pt, iconSvg as q, git as qt, createSession as r, publishJson as rt, getSession as s, WORKSPACE_PREFS as st, cleanEnv as t, validSubscription as tt, listPanes as u, changePref as ut, sendToSession as v, setSetting as vt, reportsWorking as w, setupPath as wt, tmuxWasStarted as x, ghKnownHosts as xt, sessionStates as y, discoverAgents as yt, settleQuietWorking as z, httpError as zt };