@dylanpiercey/work 0.0.223 → 0.1.1

package/dist/{_CpANOzpd.js → _Dzz52ZtI.js}

@@ -1,41 +1,15 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "./_BMI-E3GI.js";
 import { r as require_inherits, t as require_src$1 } from "./_xlrdOUsL.js";
 import { t as require_safe_buffer } from "./_BmSjjJ2E.js";
+import { createRequire } from "node:module";
 import fs from "node:fs";
 import path from "node:path";
-import { execFile, execFileSync } from "node:child_process";
+import { execFile, execFileSync, spawnSync } from "node:child_process";
 import fs$1 from "node:fs/promises";
 import os from "node:os";
 import { promisify } from "node:util";
 import { DatabaseSync } from "node:sqlite";
 import { createHash } from "node:crypto";
-//#region src/server/http.ts
-/** Who may frame the app's own responses: the app alone (the review's PDF
-* preview). A page elsewhere that frames it can dress a click on it as a
-* click on something of its own. A route that sends a
-* Content-Security-Policy of its own replaces this one, so it names
-* `FRAME_ANCESTORS` too. */
-var FRAME_ANCESTORS = "frame-ancestors 'self'";
-var FRAME_HEADERS = {
-	"content-security-policy": FRAME_ANCESTORS,
-	"x-frame-options": "SAMEORIGIN"
-};
-/** Error whose `status` the API error-boundary middleware uses for the response. */
-function httpError(status, message) {
-	return Object.assign(new Error(message), { status });
-}
-/** The value of a Standard Schema `[value, issues]` pair, or a thrown 400
-* built from the issues. */
-function checked(result, what = "request") {
-	const [value, issues] = result;
-	if (issues) throw httpError(400, `invalid ${what}: ${issues.map((issue) => issue.message).join("; ")}`);
-	return value;
-}
-/** Validated request body, or a thrown 400 built from the valibot issues. */
-async function readBody(ctx) {
-	return checked(await ctx.body, "request body");
-}
-//#endregion
 //#region src/server/cache.ts
 /** Keyed stale-while-revalidate cache: a cached value is served immediately
 * (revalidating in the background when older than `ttlMs`); loads are deduped
@@ -312,11 +286,291 @@ function utf8Locale(env) {
 	for (const [key, value] of Object.entries(env)) if (value !== void 0) out[key] = value;
 	return forceUtf8Locale(out);
 }
+/** The release that brings a database to the baseline. WORK_BRIDGE_SPEC
+* names another (an `npm pack` tarball of it) to try the bridge before it
+* is published. */
+function bridgeSpec() {
+	return process.env.WORK_BRIDGE_SPEC || "@dylanpiercey/work@0.0.223";
+}
+/** What to run by hand for the database in `dataDir`: its data dir named
+* outright, since the shell running it may not have the service's. */
+function bridgeCommands(dataDir) {
+	return [`WORK_DATA_DIR=${/^[\w@%+=:,./-]+$/.test(dataDir) ? dataDir : `'${dataDir.replace(/'/g, `'\\''`)}'`} npx -y -p ${bridgeSpec()} work migrate`, "work setup"];
+}
+/** Whether the database at `file` predates the baseline: it has tables and
+* no version. A missing or empty one is simply new. node:sqlite is loaded
+* here, not at the top: it warns on load under older node, and every other
+* CLI command would say so. */
+function needsBridge(file) {
+	if (!fs.existsSync(file)) return false;
+	const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+	const db = new DatabaseSync(file, { readOnly: true });
+	try {
+		const { user_version } = db.prepare("PRAGMA user_version").get();
+		const tables = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table'").get();
+		return user_version < 1 && !!tables;
+	} finally {
+		db.close();
+	}
+}
+/** Bring the database in `dataDir` to the baseline when it predates it,
+* with `env` (the service's) so the sweeps see the same data dir and
+* workspaces root the server does. True when it is there (or never needed
+* to be). The package's install scripts are skipped: `migrate` needs none,
+* and a native build that fails would fail the bridge with it. */
+function bridgeIfNeeded(dataDir, env, log = () => {}) {
+	const file = path.join(dataDir, "work.db");
+	if (!needsBridge(file)) return true;
+	log(`${file} predates 0.1: bringing it forward once with ${bridgeSpec()} (a one-time download)`);
+	const sibling = path.join(path.dirname(process.execPath), "npx");
+	const npx = fs.existsSync(sibling) ? sibling : "npx";
+	spawnSync(npx, [
+		"-y",
+		"-p",
+		bridgeSpec(),
+		"work",
+		"migrate"
+	], {
+		stdio: "inherit",
+		env: {
+			...env,
+			WORK_DATA_DIR: dataDir,
+			npm_config_ignore_scripts: "true"
+		}
+	});
+	return !needsBridge(file);
+}
+/** The server's bridge, for db.ts to hand the migrations: with the server's
+* own environment, before the database is opened, once per start. */
+function bridgeForServer(dataDir) {
+	return bridgeIfNeeded(dataDir, process.env, (line) => console.log(`[work] ${line}`));
+}
+//#endregion
+//#region src/server/migrations.ts
+var STEPS = [
+	{
+		version: 1,
+		name: "baseline",
+		up(db) {
+			db.exec(`
+        CREATE TABLE workspaces (
+          id TEXT PRIMARY KEY,
+          name TEXT NOT NULL,
+          path TEXT NOT NULL UNIQUE,
+          branch TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'archived')),
+          created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+          materialized INTEGER NOT NULL DEFAULT 1,
+          origin_branch TEXT,
+          imported_at TEXT
+        );
+
+        CREATE TABLE repos (
+          workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+          full_name TEXT NOT NULL,
+          worktree TEXT NOT NULL,
+          base_branch TEXT NOT NULL,
+          default_branch TEXT NOT NULL,
+          PRIMARY KEY (workspace_id, full_name)
+        );
+
+        CREATE TABLE sessions (
+          id TEXT PRIMARY KEY,
+          workspace_id TEXT REFERENCES workspaces(id) ON DELETE SET NULL,
+          agent TEXT NOT NULL,
+          title TEXT,
+          created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+        );
+
+        CREATE TABLE settings (
+          key TEXT PRIMARY KEY,
+          value TEXT NOT NULL
+        );
+
+        CREATE TABLE review_comments (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+          worktree TEXT NOT NULL,
+          path TEXT NOT NULL,
+          side TEXT NOT NULL DEFAULT 'additions',
+          line_start INTEGER NOT NULL,
+          line_end INTEGER NOT NULL,
+          text TEXT NOT NULL,
+          created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+          head TEXT,
+          snippet TEXT
+        );
+
+        CREATE TABLE push_subscriptions (
+          endpoint TEXT PRIMARY KEY,
+          data TEXT NOT NULL
+        );
+
+        CREATE TABLE dismissed_prs (
+          workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+          full_name TEXT NOT NULL,
+          number INTEGER NOT NULL,
+          PRIMARY KEY (workspace_id, full_name, number)
+        );
+
+        CREATE TABLE review_marks (
+          workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+          worktree TEXT NOT NULL,
+          branch TEXT NOT NULL,
+          path TEXT NOT NULL,
+          fingerprint TEXT NOT NULL,
+          PRIMARY KEY (workspace_id, worktree, branch, path)
+        );
+      `);
+		}
+	},
+	{
+		version: 2,
+		name: "drop what 0.0.x kept for its upgrades",
+		up(db) {
+			db.exec(`
+        DELETE FROM review_marks WHERE path = '';
+        DELETE FROM settings
+          WHERE key IN ('review-cleared-diff-v2', 'ui.diff-uncommitted', 'diff-uncommitted')
+             OR key GLOB 'review.seen:*';
+      `);
+			for (const name of [
+				"tab",
+				"diff-filter",
+				"diff-folded",
+				"diff-collapsed",
+				"diff-focus",
+				"diff-pos",
+				"files-recent"
+			]) {
+				const prefix = `ui.${name}:`;
+				db.prepare("DELETE FROM settings WHERE key GLOB ? AND substr(key, ?) NOT IN (SELECT id FROM workspaces)").run(`${prefix}*`, prefix.length + 1);
+			}
+			const pref = (key) => db.prepare("SELECT value FROM settings WHERE key = ?").get(key)?.value;
+			const parse = (text) => {
+				try {
+					return text === void 0 ? void 0 : JSON.parse(text);
+				} catch {
+					return;
+				}
+			};
+			const font = parse(pref("ui.term-font"));
+			if (font && typeof font === "object") {
+				for (const device of ["desktop", "touch"]) if (Number.isInteger(font[device])) db.prepare("INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)").run(`ui.term-font-${device}`, String(font[device]));
+			}
+			db.exec("DELETE FROM settings WHERE key = 'ui.term-font'");
+			const keys = parse(pref("ui.phone-keys"));
+			if (Array.isArray(keys)) db.prepare("UPDATE settings SET value = ? WHERE key = 'ui.phone-keys'").run(JSON.stringify({
+				base: [],
+				extra: keys
+			}));
+		}
+	},
+	{
+		version: 3,
+		name: "drop the typing-prediction pref",
+		up(db) {
+			db.exec("DELETE FROM settings WHERE key = 'ui.term-predict'");
+		}
+	}
+];
+var LATEST = STEPS.at(-1).version;
+/** The database at `file`, at the latest version: an empty one is built by
+* every step, an existing one gets those it lacks — each in a transaction
+* of its own with its version stamp inside it, after a copy of the whole
+* file (`work.db.v<from>.bak` beside it, the newest two kept). One from
+* before the baseline is handed to `bridge` first, when given (the
+* server's: lib/setup/bridge.mjs). Throws, with what to do in its message,
+* for a database this code cannot open: one still from before the
+* baseline, one from a newer release, or one a step failed on (rolled back
+* to the step before). */
+function openDatabase(file, { bridge } = {}) {
+	if (bridge && needsBridge(file)) bridge(path.dirname(file));
+	const db = new DatabaseSync(file);
+	try {
+		db.exec("PRAGMA busy_timeout = 5000");
+		db.exec("PRAGMA journal_mode = WAL");
+		migrate(db, file);
+		db.exec("PRAGMA foreign_keys = ON");
+		return db;
+	} catch (err) {
+		db.close();
+		throw err;
+	}
+}
+function versionOf(db) {
+	return db.prepare("PRAGMA user_version").get().user_version;
+}
+function migrate(db, file) {
+	const from = versionOf(db);
+	const empty = !db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table'").get();
+	if (from < 1 && !empty) throw new Error(`${file} predates 0.1 and has not been brought forward (once, with the network: \`work setup\`, or this server on its next start). By hand:\n  ${bridgeCommands(path.dirname(file)).join("\n  ")}`);
+	if (from > LATEST) {
+		const backup = newestBackup(file, LATEST);
+		throw new Error(`${file} is at schema version ${from}, and this work knows up to ${LATEST}: a newer release upgraded it. Update work (\`work update\`)${backup ? `, or restore ${backup}, the copy taken before it did` : ""}.`);
+	}
+	const pending = STEPS.filter((s) => s.version > from);
+	if (!pending.length) return;
+	const backup = empty ? null : snapshot(db, file, from);
+	for (const step of pending) {
+		db.exec("BEGIN IMMEDIATE");
+		try {
+			if (versionOf(db) >= step.version) {
+				db.exec("ROLLBACK");
+				continue;
+			}
+			step.up(db);
+			db.exec(`PRAGMA user_version = ${step.version}`);
+			db.exec("COMMIT");
+		} catch (err) {
+			try {
+				db.exec("ROLLBACK");
+			} catch {}
+			throw new Error(`${file}: step ${step.version} (${step.name}) failed and was rolled back, leaving the database at version ${versionOf(db)}: ${err.message}${backup ? `. The copy from before this upgrade is ${backup}` : ""}`);
+		}
+	}
+}
+var backupName = (file, version) => `${path.basename(file)}.v${version}.bak`;
+/** The file's backups, newest version first. */
+function backups(file) {
+	const dir = path.dirname(file);
+	const re = new RegExp(`^${path.basename(file).replace(/\./g, "\\.")}\\.v(\\d+)\\.bak$`);
+	let names = [];
+	try {
+		names = fs.readdirSync(dir);
+	} catch {}
+	return names.map((name) => re.exec(name)).filter((m) => !!m).map((m) => ({
+		file: path.join(dir, m[0]),
+		version: Number(m[1])
+	})).sort((a, b) => b.version - a.version);
+}
+function newestBackup(file, atMost) {
+	return backups(file).find((b) => b.version <= atMost)?.file ?? null;
+}
+/** A copy of the whole database as it is before an upgrade from `version`,
+* which a release that knows `version` can open. */
+function snapshot(db, file, version) {
+	const dest = path.join(path.dirname(file), backupName(file, version));
+	fs.rmSync(dest, { force: true });
+	db.prepare("VACUUM INTO ?").run(dest);
+	for (const old of backups(file).slice(2)) fs.rmSync(old.file, { force: true });
+	return dest;
+}
 //#endregion
 //#region src/server/db.ts
 if (!path.isAbsolute(config.dataDir)) throw new Error(`data dir must be absolute, got "${config.dataDir}" — check WORK_DATA_DIR and $HOME`);
-var db = new DatabaseSync(path.join(config.dataDir, "work.db"));
-db.exec("PRAGMA busy_timeout = 5000");
+/** The app's database, at the latest schema version before anything reads
+* it (server/migrations.ts), one from before 0.1 bridged first. One this
+* release cannot open stops the server here, saying what to do: a stack
+* trace would bury that under itself. */
+var db = (() => {
+	try {
+		return openDatabase(path.join(config.dataDir, "work.db"), { bridge: bridgeForServer });
+	} catch (err) {
+		console.error(`[work] ${err.message}`);
+		process.exit(1);
+	}
+})();
 /** Prepared statements, kept by their SQL: preparing is most of a small
 * query's cost (10 µs against 4), and a status build runs hundreds. The
 * texts are the call sites' own, so the set is small; the cap covers any
@@ -340,91 +594,33 @@ function get(sql, ...params) {
 function workspacePath(id) {
 	return get("SELECT path FROM workspaces WHERE id = ?", id)?.path;
 }
-var fresh = !db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table'").get();
-var freshReview = !db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'review_comments'").get();
-db.exec(`
-  PRAGMA journal_mode = WAL;
-  PRAGMA foreign_keys = ON;
-
-  CREATE TABLE IF NOT EXISTS workspaces (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    path TEXT NOT NULL UNIQUE,
-    branch TEXT NOT NULL,
-    status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'archived')),
-    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
-  );
-
-  CREATE TABLE IF NOT EXISTS repos (
-    workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
-    full_name TEXT NOT NULL,
-    worktree TEXT NOT NULL,
-    base_branch TEXT NOT NULL,
-    default_branch TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, full_name)
-  );
-
-  CREATE TABLE IF NOT EXISTS sessions (
-    id TEXT PRIMARY KEY,
-    workspace_id TEXT REFERENCES workspaces(id) ON DELETE SET NULL,
-    agent TEXT NOT NULL,
-    title TEXT,
-    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
-  );
-
-  CREATE TABLE IF NOT EXISTS settings (
-    key TEXT PRIMARY KEY,
-    value TEXT NOT NULL
-  );
-
-  CREATE TABLE IF NOT EXISTS review_comments (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
-    worktree TEXT NOT NULL,
-    path TEXT NOT NULL,
-    side TEXT NOT NULL DEFAULT 'additions',
-    line_start INTEGER NOT NULL,
-    line_end INTEGER NOT NULL,
-    text TEXT NOT NULL,
-    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
-  );
-
-  CREATE TABLE IF NOT EXISTS push_subscriptions (
-    endpoint TEXT PRIMARY KEY,
-    data TEXT NOT NULL
-  );
-
-  CREATE TABLE IF NOT EXISTS dismissed_prs (
-    workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
-    full_name TEXT NOT NULL,
-    number INTEGER NOT NULL,
-    PRIMARY KEY (workspace_id, full_name, number)
-  );
-
-  -- Viewed marks (server/viewed.ts): a file of a branch, and its change
-  -- as it was when marked.
-  CREATE TABLE IF NOT EXISTS review_marks (
-    workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
-    worktree TEXT NOT NULL,
-    branch TEXT NOT NULL,
-    path TEXT NOT NULL,
-    fingerprint TEXT NOT NULL,
-    PRIMARY KEY (workspace_id, worktree, branch, path)
-  );
-`);
-if (freshReview) db.prepare("INSERT OR IGNORE INTO settings (key, value) VALUES ('review-cleared-diff-v2', '1')").run();
-/** Additive schema changes: `CREATE TABLE IF NOT EXISTS` never revisits a
-* table that already exists, so a column added after a release has to be
-* bolted on here for databases created before it. */
-function ensureColumn(table, column, decl) {
-	if (!db.prepare(`PRAGMA table_info(${table})`).all().some((c) => c.name === column)) db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${decl}`);
-}
-ensureColumn("review_comments", "head", "TEXT");
-ensureColumn("review_comments", "snippet", "TEXT");
-ensureColumn("workspaces", "materialized", "INTEGER NOT NULL DEFAULT 1");
-ensureColumn("workspaces", "origin_branch", "TEXT");
-ensureColumn("workspaces", "imported_at", "TEXT");
-if (fresh) db.exec("PRAGMA user_version = 1");
+//#endregion
+//#region src/server/http.ts
+/** Who may frame the app's own responses: the app alone (the review's PDF
+* preview). A page elsewhere that frames it can dress a click on it as a
+* click on something of its own. A route that sends a
+* Content-Security-Policy of its own replaces this one, so it names
+* `FRAME_ANCESTORS` too. */
+var FRAME_ANCESTORS = "frame-ancestors 'self'";
+var FRAME_HEADERS = {
+	"content-security-policy": FRAME_ANCESTORS,
+	"x-frame-options": "SAMEORIGIN"
+};
+/** Error whose `status` the API error-boundary middleware uses for the response. */
+function httpError(status, message) {
+	return Object.assign(new Error(message), { status });
+}
+/** The value of a Standard Schema `[value, issues]` pair, or a thrown 400
+* built from the issues. */
+function checked(result, what = "request") {
+	const [value, issues] = result;
+	if (issues) throw httpError(400, `invalid ${what}: ${issues.map((issue) => issue.message).join("; ")}`);
+	return value;
+}
+/** Validated request body, or a thrown 400 built from the valibot issues. */
+async function readBody(ctx) {
+	return checked(await ctx.body, "request body");
+}
 //#endregion
 //#region src/client/pref-change.ts
 /** The stored text after `change`, or null when nothing is left. A value
@@ -793,6 +989,94 @@ function agentLabel$1(id) {
 	const parsed = parseAgentId(id);
 	return parsed ? `${parsed.family.label}${parsed.suffix ? ` ${parsed.suffix}` : ""}` : id;
 }
+/** `tailscale version` prints the short version first (`1.76.1`, or
+* `1.77.30` on an unstable track), then commit lines. */
+function parseVersion(text) {
+	return /\b(\d+)\.(\d+)\.(\d+)\b/.exec(text || "")?.[0] ?? null;
+}
+function atLeast(version, min) {
+	const a = version.split(".").map(Number);
+	const b = min.split(".").map(Number);
+	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+	return true;
+}
+/** The target the CLI writes (`http://127.0.0.1:7171`) or one a hand-made
+* or older config holds (`localhost:7171`, `http://[::1]:7171`, `7171`),
+* when it is work's port on this machine. */
+function targetsPort(proxy, port) {
+	if (/^\d+$/.test(proxy)) return proxy === String(port);
+	let url;
+	try {
+		url = new URL(proxy.includes("://") ? proxy : `http://${proxy}`);
+	} catch {
+		return false;
+	}
+	return url.protocol === "http:" && [
+		"127.0.0.1",
+		"localhost",
+		"[::1]"
+	].includes(url.hostname) && url.port === String(port);
+}
+/** The URL a `Web` entry (`<name>:<port>`) is opened at: https unless its
+* port is served as plain HTTP (`--http=<port>`). */
+function webUrl(config, hostPort) {
+	const i = hostPort.lastIndexOf(":");
+	const host = hostPort.slice(0, i);
+	const port = hostPort.slice(i + 1);
+	const tls = !config.TCP?.[port]?.HTTP;
+	return `${tls ? "https" : "http"}://${host}${port === (tls ? "443" : "80") ? "" : `:${port}`}/`;
+}
+/** Where `tailscale serve status --json` (an ipn.ServeConfig; `{}` or
+* `null` when empty) serves work's port, and whether Funnel publishes that
+* to the internet — or null. Only a handler at `/` counts: work serves
+* every page, asset and websocket from the root. */
+function serveOf(config, port) {
+	for (const [hostPort, web] of Object.entries(config?.Web || {})) {
+		const proxy = web?.Handlers?.["/"]?.Proxy;
+		if (!proxy || !targetsPort(proxy, port)) continue;
+		const url = webUrl(config, hostPort);
+		return {
+			url,
+			host: new URL(url).hostname,
+			funnel: !!config.AllowFunnel?.[hostPort]
+		};
+	}
+	return null;
+}
+function hosts(value) {
+	return (value || "").split(",").map((s) => s.trim()).filter(Boolean);
+}
+/**
+* The probe `work doctor` and `work setup` read, from the CLI's output:
+* `version` (`tailscale version`), `status` (`tailscale status --json`,
+* null when tailscaled did not answer) and `serve` (`tailscale serve
+* status --json`). `allowedHosts` is the WORK_ALLOWED_HOSTS the service
+* runs with.
+*/
+function readTailscale({ path, version: versionText, status, serve }, { port, allowedHosts }) {
+	const version = parseVersion(versionText);
+	const name = String(status?.Self?.DNSName || "").replace(/\.$/, "").toLowerCase() || null;
+	const certs = status?.CertDomains;
+	const https = Array.isArray(certs) ? certs.some((d) => d.toLowerCase() === name) : status && "CertDomains" in status ? false : null;
+	const served = serveOf(serve, port);
+	const root = name ? serve?.Web?.[`${name}:443`]?.Handlers?.["/"] : null;
+	return {
+		installed: true,
+		path,
+		version,
+		serveCli: !!version && atLeast(version, "1.52.0"),
+		state: status?.BackendState ?? null,
+		running: status?.BackendState === "Running" && !!name,
+		name,
+		https,
+		port: String(port),
+		serve: served && {
+			...served,
+			allowed: hosts(allowedHosts).some((h) => h.toLowerCase() === served.host)
+		},
+		rootTaken: !served && root ? root.Proxy || root.Path || root.Redirect || "text" : null
+	};
+}
 //#endregion
 //#region lib/setup/doctor.mjs
 var home = os.homedir();
@@ -904,6 +1188,40 @@ async function readMiseInstalls() {
 	} catch {}
 	return out;
 }
+/** A path owned by one release of a version manager — mise/asdf
+* `installs`, homebrew's `Cellar`, nvm's `versions` — which that tool
+* deletes on its next update. */
+var VERSIONED_PATH = /\/(installs|Cellar|versions|toolchains)\//;
+/** The gh for git to run as a credential helper: the launcher on PATH
+* (mise's shim, /usr/bin/gh), when it is not itself one release's. Still an
+* absolute path, so it works for GUI clients and cron jobs that never
+* sourced a shell profile, but one that follows upgrades. */
+function stableGh() {
+	const gh = which("gh");
+	return gh && !VERSIONED_PATH.test(gh) ? gh : null;
+}
+/** Credential helpers in ~/.gitconfig that run a gh which is gone, by
+* config key. `gh auth setup-git` writes the absolute path of the gh that
+* ran it, and git runs that string literally: once a version manager's
+* upgrade deletes it, every https push fails with "could not read
+* Username" while `gh` itself still works. Listed only when there is a
+* stable gh to point them at, which `work setup` does. */
+async function staleGhHelpers() {
+	if (!stableGh()) return [];
+	const { stdout } = await run("git", [
+		"config",
+		"--global",
+		"--get-regexp",
+		String.raw`^credential\..*\.helper$`
+	]);
+	const keys = /* @__PURE__ */ new Set();
+	for (const line of stdout.split("\n")) {
+		const sp = line.indexOf(" ");
+		const bin = /^!(\S+) auth git-credential$/.exec(line.slice(sp + 1))?.[1];
+		if (sp > 0 && bin && !fs.existsSync(bin)) keys.add(line.slice(0, sp));
+	}
+	return [...keys];
+}
 /** Hosts `gh` knows about (~/.config/gh/hosts.yml top-level keys) — the
 * source of truth for "which GitHub hosts has this machine signed in to",
 * merged with whatever the caller has configured. */
@@ -1062,11 +1380,50 @@ async function ghExtensions() {
 	}
 	return out;
 }
+function parseJson(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return null;
+	}
+}
+/** Tailscale here and what its serve config does with work's port
+* (lib/setup/tailscale.mjs), from read-only commands. `port` and
+* `allowedHosts` default to this process's own, which are the server's
+* when the server asks. */
+async function tailscaleProbe({ port, allowedHosts } = {}) {
+	const bin = which("tailscale");
+	if (!bin) return { installed: false };
+	const [version, status, serve] = await Promise.all([
+		run(bin, ["version"], { timeout: 5e3 }),
+		run(bin, [
+			"status",
+			"--json",
+			"--peers=false"
+		], { timeout: 5e3 }),
+		run(bin, [
+			"serve",
+			"status",
+			"--json"
+		], { timeout: 5e3 })
+	]);
+	return readTailscale({
+		path: tilde(bin),
+		version: version.stdout,
+		status: status.ok ? parseJson(status.stdout) : null,
+		serve: serve.ok ? parseJson(serve.stdout) : null
+	}, {
+		port: port || process.env.PORT || process.env.WORK_APP_PORT || "7171",
+		allowedHosts: allowedHosts ?? process.env.WORK_ALLOWED_HOSTS
+	});
+}
 /**
 * Full readiness snapshot.
 *
-* @param {{ hosts?: string[] }} [opts] configured GitHub hosts (settings);
-*   github.com and any host gh is already signed in to are always included.
+* @param {{ hosts?: string[], port?: string, allowedHosts?: string }} [opts]
+*   configured GitHub hosts (settings); github.com and any host gh is
+*   already signed in to are always included. `port` and `allowedHosts`
+*   are the service's, for the Tailscale probe.
 */
 async function doctor(opts = {}) {
 	const hostSet = /* @__PURE__ */ new Set([
@@ -1074,11 +1431,13 @@ async function doctor(opts = {}) {
 		...opts.hosts || [],
 		...ghKnownHosts()
 	]);
-	const [versions, github, awake, extensions] = await Promise.all([
+	const [versions, github, awake, extensions, helpers, tailscale] = await Promise.all([
 		miseVersions(),
 		Promise.all([...hostSet].map(githubHostStatus)),
 		canStayAwake(),
-		ghExtensions()
+		ghExtensions(),
+		staleGhHelpers(),
+		tailscaleProbe(opts)
 	]);
 	const tools = TOOLS.map((t) => {
 		if (t.ghExtension) {
@@ -1119,7 +1478,9 @@ async function doctor(opts = {}) {
 		tools,
 		agents,
 		github,
-		awake
+		awake,
+		staleGhHelpers: helpers,
+		tailscale
 	};
 }
 //#endregion
@@ -1142,8 +1503,7 @@ var PREF_MAX = 4096;
 /** The prefs kept per workspace, keyed `<name>:<workspace id>`. They ride
 * every page's HTML, so they go with the workspace (`deleteWorkspacePrefs`)
 * and /api/prefs refuses them for one that is gone; one missing here
-* outlives its workspace for good. `scripts/migrate.mjs` prunes orphans of
-* the same list. */
+* outlives its workspace for good. */
 var WORKSPACE_PREFS = [
 	"tab",
 	"diff-filter",
@@ -5641,7 +6001,7 @@ var require_vapid_helper = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var crypto$3 = __require("crypto");
 	var asn1 = require_asn1();
 	var jws = require_jws();
-	var { URL } = __require("url");
+	var { URL: URL$1 } = __require("url");
 	var WebPushConstants = require_web_push_constants();
 	var urlBase64Helper = require_urlsafe_base64_helper();
 	/**
@@ -5692,7 +6052,7 @@ var require_vapid_helper = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		if (typeof subject !== "string" || subject.length === 0) throw new Error("The subject value must be a string containing an https: URL or mailto: address. " + subject);
 		let subjectParseResult = null;
 		try {
-			subjectParseResult = new URL(subject);
+			subjectParseResult = new URL$1(subject);
 		} catch (err) {
 			throw new Error("Vapid subject is not a valid URL. " + subject);
 		}
@@ -5754,7 +6114,7 @@ var require_vapid_helper = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		if (!audience) throw new Error("No audience could be generated for VAPID.");
 		if (typeof audience !== "string" || audience.length === 0) throw new Error("The audience value must be a string containing the origin of a push service. " + audience);
 		try {
-			new URL(audience);
+			new URL$1(audience);
 		} catch (err) {
 			throw new Error("VAPID audience is not a url. " + audience);
 		}
@@ -7385,7 +7745,7 @@ function publishChange(sessionId) {
 	const row = get("SELECT workspace_id FROM sessions WHERE id = ?", sessionId);
 	if (row?.workspace_id) {
 		const workspaceId = row.workspace_id;
-		import("./_LF2Fo5WE.js").then((m) => m.notifySessionsChanged(workspaceId));
+		import("./_HbAW5Cbt.js").then((m) => m.notifySessionsChanged(workspaceId));
 		return;
 	}
 	publish("sessions.changed");
@@ -9616,28 +9976,12 @@ async function listPanesNow() {
 	};
 	return panes;
 }
-/** Cleared once per process — boot already runs this, and a server we
-* create below never has PORT set, so re-running on every attach only
-* unsets something already unset. */
-var portCleared = false;
 /** Start the tmux server in its own systemd user unit so it escapes this
 * service's cgroup — otherwise `systemctl restart work` kills every
 * session with it. A hidden "work-keeper" session pins the server alive
 * (tmux exits when its last session closes). */
 async function ensureTmuxServer() {
-	if (await tmux(["has-session"]).then(() => true, () => false)) {
-		if (!portCleared) {
-			await tmux([
-				"set-environment",
-				"-g",
-				"-u",
-				"PORT"
-			]).catch(() => {});
-			portCleared = true;
-		}
-		return;
-	}
-	portCleared = true;
+	if (await tmux(["has-session"]).then(() => true, () => false)) return;
 	await run$1("systemd-run", [
 		"--user",
 		`--unit=${TMUX_SOCKET === "work" ? "work-tmux" : `work-tmux-${TMUX_SOCKET.replace(/[^\w.:-]/g, "_")}`}`,
@@ -9910,4 +10254,4 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
-export { saveSubscription as $, readBody as $t, clearAgentPhase as A, agentById as At, agentBadge as B, gh as Bt, readHookPayload as C, miseVersions as Ct, realInsideSync as D, DEFAULT_GITHUB_HOST as Dt, realInside as E, which as Et, onPhaseChange as F, all as Ft, ACCENT_RE as G, config as Gt, agentFromCommand as H, gitEnv as Ht, setAgentPhase as I, db as It, manifest as J, withLock as Jt, getInstance as K, shared as Kt, setScrapedPhase as L, get as Lt, hookReportedAt as M, catalogPin as Mt, noteBackground as N, toolById as Nt, blankRow as O, PROJECT_TOOLS as Ot, noteUserAnswered as P, applyPrefChange as Pt, pushPublicKey as Q, httpError as Qt, setSessionViewers as R, workspacePath as Rt, AGENTS as S, miseInstalls as St, inside as T, tilde as Tt, agentLabel as U, run$1 as Ut, agentFamily as V, git as Vt, agentMeta as W, tmux as Wt, setInstance as X, FRAME_HEADERS as Xt, normalizeAccent as Y, FRAME_ANCESTORS as Yt, deleteSubscription as Z, checked as Zt, renameSession as _, setPref as _t, ensureTmuxServer as a, subscriberCount as at, tmuxName as b, doctor as bt, killSession as c, agentChoices as ct, listPanesWithin as d, deleteWorkspacePrefs as dt, sendPush as et, listSessions as f, disabledAgents as ft, panePids as g, setDisabledAgents as gt, notifySessionsChanged as h, preferredAgent as ht, disposeSessions as i, subscribe as it, hookPhase as j, agentLabel$1 as jt, agentPhase as k, TOOLS as kt, killWorkspaceSessions as l, allPrefs as lt, newSessionArgs as m, getSetting as mt, clearTmuxStarted as n, publish as nt, forgetPanes as o, PREF_MAX as ot, markTmuxStarted as p, enabledAgents as pt, iconSvg as q, swr as qt, createSession as r, publishJson as rt, getSession as s, WORKSPACE_PREFS as st, cleanEnv as t, validSubscription as tt, listPanes as u, changePref as ut, sendToSession as v, setSetting as vt, reportsWorking as w, setupPath as wt, tmuxWasStarted as x, ghKnownHosts as xt, sessionStates as y, discoverAgents as yt, settleQuietWorking as z, TMUX_SOCKET as zt };
+export { saveSubscription as $, swr as $t, clearAgentPhase as A, TOOLS as At, agentBadge as B, readBody as Bt, readHookPayload as C, miseVersions as Ct, realInsideSync as D, which as Dt, realInside as E, tilde as Et, onPhaseChange as F, applyPrefChange as Ft, ACCENT_RE as G, TMUX_SOCKET as Gt, agentFromCommand as H, db as Ht, setAgentPhase as I, FRAME_ANCESTORS as It, manifest as J, gitEnv as Jt, getInstance as K, gh as Kt, setScrapedPhase as L, FRAME_HEADERS as Lt, hookReportedAt as M, agentLabel$1 as Mt, noteBackground as N, catalogPin as Nt, blankRow as O, DEFAULT_GITHUB_HOST as Ot, noteUserAnswered as P, toolById as Pt, pushPublicKey as Q, shared as Qt, setSessionViewers as R, checked as Rt, AGENTS as S, miseInstalls as St, inside as T, stableGh as Tt, agentLabel as U, get as Ut, agentFamily as V, all as Vt, agentMeta as W, workspacePath as Wt, setInstance as X, tmux as Xt, normalizeAccent as Y, run$1 as Yt, deleteSubscription as Z, config as Zt, renameSession as _, setPref as _t, ensureTmuxServer as a, subscriberCount as at, tmuxName as b, doctor as bt, killSession as c, agentChoices as ct, listPanesWithin as d, deleteWorkspacePrefs as dt, withLock as en, sendPush as et, listSessions as f, disabledAgents as ft, panePids as g, setDisabledAgents as gt, notifySessionsChanged as h, preferredAgent as ht, disposeSessions as i, subscribe as it, hookPhase as j, agentById as jt, agentPhase as k, PROJECT_TOOLS as kt, killWorkspaceSessions as l, allPrefs as lt, newSessionArgs as m, getSetting as mt, clearTmuxStarted as n, publish as nt, forgetPanes as o, PREF_MAX as ot, markTmuxStarted as p, enabledAgents as pt, iconSvg as q, git as qt, createSession as r, publishJson as rt, getSession as s, WORKSPACE_PREFS as st, cleanEnv as t, validSubscription as tt, listPanes as u, changePref as ut, sendToSession as v, setSetting as vt, reportsWorking as w, setupPath as wt, tmuxWasStarted as x, ghKnownHosts as xt, sessionStates as y, discoverAgents as yt, settleQuietWorking as z, httpError as zt };