@kky42/pievo-server 2.4.1 → 2.4.2

package/.output/server/_ssr/{loopApi-Dy8ztANM.mjs → loopApi-BKyFB4KM.mjs}

@@ -1,9 +1,9 @@
-import { A as ensureServer, Bt as startLoop$1, Gt as tryDeleteLoop, Ht as stopLoop$1, J as getTeam, Kt as updateLoop, N as forceDeleteLoop$1, Nt as requestDeleteLoop, Pt as requestRunCancel, Tt as pauseLoop$1, U as getLoop, W as getMachine, Xt as validateLoopEdit, Y as getTeamMember, Z as hasRunningRun, gt as listTeamsForUser, lt as listLoops$1, mt as listRunsBefore, q as getRun, xt as machinePresence } from "./boot-BbWxaF-z.mjs";
-import { i as toRunSummaries, n as toLoopDetail, r as toLoopSummary } from "./loopProjection-BZ1_IYCr.mjs";
-import { canAccessLoop, requestScope } from "./auth-CPCDf6Wr.mjs";
+import { $t as validateLoopEdit, Et as pauseLoop$1, Ft as requestRunCancel, G as getMachine, J as getRun, Kt as tryDeleteLoop, P as forceDeleteLoop, Pt as requestDeleteLoop, Q as hasRunningRun, St as machinePresence, Ut as stopLoop$1, Vt as startLoop$1, W as getLoop, X as getTeamMember, Y as getTeam, _t as listTeamsForUser, ht as listRunsBefore, j as ensureServer, qt as updateLoop, ut as listLoops$1 } from "./boot-sNlIkoLe.mjs";
+import { i as toRunSummaries, n as toLoopDetail, r as toLoopSummary } from "./loopProjection-B8a829ij.mjs";
+import { canAccessLoop, requestScope } from "./auth-C0zoZCGe.mjs";
 import { n as createServerFn } from "./ssr.mjs";
 import { t as createServerRpc } from "./createServerRpc-BD8Xn_0_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/loopApi-Dy8ztANM.js
+//#region node_modules/.nitro/vite/services/ssr/assets/loopApi-BKyFB4KM.js
 /**
 * Server functions backing the dashboard. They run server-side (createServerFn
 * → RPC) and call the IN-PROCESS scheduler + store directly — the scheduler
@@ -40,7 +40,7 @@ var getAuthState_createServerFn_handler = createServerRpc({
 	filename: "src/server/loopApi.ts"
 }, (opts) => getAuthState.__executeServer(opts));
 var getAuthState = createServerFn({ method: "GET" }).handler(getAuthState_createServerFn_handler, async () => {
-	const { authEnabled } = await import("./auth-CPCDf6Wr.mjs");
+	const { authEnabled } = await import("./auth-C0zoZCGe.mjs");
 	return { enabled: authEnabled };
 });
 var getConfig_createServerFn_handler = createServerRpc({
@@ -150,7 +150,7 @@ var getArtifacts_createServerFn_handler = createServerRpc({
 var getArtifacts = createServerFn({ method: "GET" }).validator((d) => d).handler(getArtifacts_createServerFn_handler, async ({ data }) => {
 	await backend();
 	if (!await ownedLoop(data.loopId)) return [];
-	const { listLoopArtifacts } = await import("./artifactFiles-CV3OXxRD.mjs");
+	const { listLoopArtifacts } = await import("./artifactFiles-DtpRidFZ.mjs");
 	return listLoopArtifacts(data.loopId);
 });
 var getArtifact_createServerFn_handler = createServerRpc({
@@ -161,7 +161,7 @@ var getArtifact_createServerFn_handler = createServerRpc({
 var getArtifact = createServerFn({ method: "GET" }).validator((d) => d).handler(getArtifact_createServerFn_handler, async ({ data }) => {
 	await backend();
 	if (!await ownedLoop(data.loopId)) return { error: "file not found" };
-	const { readLoopArtifact } = await import("./artifactFiles-CV3OXxRD.mjs");
+	const { readLoopArtifact } = await import("./artifactFiles-DtpRidFZ.mjs");
 	return readLoopArtifact(data.loopId, data.path);
 });
 var getRunDiff_createServerFn_handler = createServerRpc({
@@ -180,7 +180,7 @@ var getRunDiff = createServerFn({ method: "GET" }).validator((d) => d).handler(g
 		hasSnapshot: false,
 		files: []
 	};
-	const { computeRunDiff } = await import("./runDiff-CrZzjokj.mjs");
+	const { computeRunDiff } = await import("./runDiff-Ba8Lg1vg.mjs");
 	return computeRunDiff(data.runId);
 });
 var patchLoop_createServerFn_handler = createServerRpc({
@@ -267,8 +267,8 @@ var deleteLoop = createServerFn({ method: "POST" }).validator((id) => id).handle
 	scheduler.removeLoop(id);
 	if (!await requestDeleteLoop(id)) return { error: "not found" };
 	if (unreachable && mayRetireAuthority) {
-		if (!await forceDeleteLoop$1(id)) return { error: "delete failed; server data was not deleted" };
-		const { logger } = await import("./logger-DdUWuMdh.mjs");
+		if (!await forceDeleteLoop(id)) return { error: "delete failed; server data was not deleted" };
+		const { logger } = await import("./logger-B8m8F1Qu.mjs");
 		logger.child({ mod: "loop-lifecycle" }).warn({
 			action: "unreachable-delete",
 			loopId: id,
@@ -287,39 +287,6 @@ var deleteLoop = createServerFn({ method: "POST" }).validator((id) => id).handle
 		waiting: !deleted
 	};
 });
-var FORCE_DELETE_CONFIRMATION = "delete-server-data-anyway";
-/** Destructive uncertainty escape hatch. Team owners only; the explicit marker
-* is the server-side half of the Dashboard's second confirmation. */
-var forceDeleteLoop_createServerFn_handler = createServerRpc({
-	id: "199e1c98d1946048b76a18a86c6d252d87776e70fefa62e4af66089244acb9de",
-	name: "forceDeleteLoop",
-	filename: "src/server/loopApi.ts"
-}, (opts) => forceDeleteLoop.__executeServer(opts));
-var forceDeleteLoop = createServerFn({ method: "POST" }).validator((d) => d).handler(forceDeleteLoop_createServerFn_handler, async ({ data }) => {
-	const { scheduler } = await backend();
-	const owned = await ownedLoop(data.id);
-	if (!owned) return { error: "not found" };
-	if (!owned.loop.deleteRequestedAt) return { error: "delete must be requested first" };
-	if (data.confirmation !== FORCE_DELETE_CONFIRMATION) return { error: "force delete confirmation required" };
-	if (owned.enforce) {
-		if (!owned.loop.teamId) return { error: "only a team owner can force delete this loop" };
-		const actor = (await requestScope()).userId;
-		if (!actor || (await getTeamMember(owned.loop.teamId, actor))?.role !== "owner") return { error: "only a team owner can force delete this loop" };
-	}
-	scheduler.removeLoop(data.id);
-	if (!await forceDeleteLoop$1(data.id)) return { error: "force delete failed; server data was not deleted" };
-	const { logger } = await import("./logger-DdUWuMdh.mjs");
-	logger.child({ mod: "loop-lifecycle" }).warn({
-		action: "force-delete",
-		loopId: data.id,
-		actorUserId: (await requestScope()).userId,
-		machineId: owned.loop.machineId
-	}, "force-delete: destructive server authority removal");
-	return {
-		ok: true,
-		deleted: true
-	};
-});
 var runLoop_createServerFn_handler = createServerRpc({
 	id: "08565e35f6a3dd06ef25401de0343976c47f7ae319d3baed6320b56dd3718311",
 	name: "runLoop",
@@ -361,7 +328,7 @@ var mintClaim_createServerFn_handler = createServerRpc({
 }, (opts) => mintClaim.__executeServer(opts));
 var mintClaim = createServerFn({ method: "POST" }).validator((teamId) => teamId).handler(mintClaim_createServerFn_handler, async ({ data: teamId }) => {
 	await backend();
-	const { mintDeviceToken, rememberConnectKey } = await import("./tokens-XngoyCU8.mjs");
+	const { mintDeviceToken, rememberConnectKey } = await import("./tokens-DgG_Syq3.mjs");
 	const { userId, teamId: active } = await requestScope(teamId);
 	const owner = userId ?? "shared";
 	const token = mintDeviceToken();
@@ -371,19 +338,5 @@ var mintClaim = createServerFn({ method: "POST" }).validator((teamId) => teamId)
 	});
 	return { token };
 });
-var claimStatus_createServerFn_handler = createServerRpc({
-	id: "4b0db7d6c8f25383a3526598cb0c1881db6cf413e451e9478687c05666461347",
-	name: "claimStatus",
-	filename: "src/server/loopApi.ts"
-}, (opts) => claimStatus.__executeServer(opts));
-var claimStatus = createServerFn({ method: "GET" }).validator((token) => token).handler(claimStatus_createServerFn_handler, async ({ data: token }) => {
-	const r = (await backend()).gateway.claimStatus(token);
-	return r ? {
-		done: true,
-		id: r.loopId,
-		name: r.name,
-		agent: r.agent
-	} : { done: false };
-});
 //#endregion
-export { canViewTeam_createServerFn_handler, claimStatus_createServerFn_handler, deleteLoop_createServerFn_handler, forceDeleteLoop_createServerFn_handler, getArtifact_createServerFn_handler, getArtifacts_createServerFn_handler, getAuthState_createServerFn_handler, getConfig_createServerFn_handler, getDefaultTeam_createServerFn_handler, getLoopDetail_createServerFn_handler, getRunDiff_createServerFn_handler, listLoops_createServerFn_handler, listMyTeams_createServerFn_handler, loadOlderRuns_createServerFn_handler, mintClaim_createServerFn_handler, patchLoop_createServerFn_handler, pauseLoop_createServerFn_handler, runLoop_createServerFn_handler, startLoop_createServerFn_handler, stopLoop_createServerFn_handler, stopRun_createServerFn_handler };
+export { canViewTeam_createServerFn_handler, deleteLoop_createServerFn_handler, getArtifact_createServerFn_handler, getArtifacts_createServerFn_handler, getAuthState_createServerFn_handler, getConfig_createServerFn_handler, getDefaultTeam_createServerFn_handler, getLoopDetail_createServerFn_handler, getRunDiff_createServerFn_handler, listLoops_createServerFn_handler, listMyTeams_createServerFn_handler, loadOlderRuns_createServerFn_handler, mintClaim_createServerFn_handler, patchLoop_createServerFn_handler, pauseLoop_createServerFn_handler, runLoop_createServerFn_handler, startLoop_createServerFn_handler, stopLoop_createServerFn_handler, stopRun_createServerFn_handler };

package/.output/server/_ssr/{loopProjection-BZ1_IYCr.mjs → loopProjection-B8a829ij.mjs}

@@ -1,5 +1,5 @@
-import { Lt as scheduleFromLoop, Ot as reconciliationStatesForRuns, Vt as statusDefinitionsFromLoop, W as getMachine, X as hasPendingRun, Z as hasRunningRun, pt as listRuns, u as MIN_DAEMON_VERSION, v as countRuns, w as daemonNeedsUpdate, xt as machinePresence } from "./boot-BbWxaF-z.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/loopProjection-BZ1_IYCr.js
+import { G as getMachine, Ht as statusDefinitionsFromLoop, Q as hasRunningRun, Rt as scheduleFromLoop, St as machinePresence, T as daemonNeedsUpdate, Z as hasPendingRun, kt as reconciliationStatesForRuns, mt as listRuns, u as MIN_DAEMON_VERSION, y as countRuns } from "./boot-sNlIkoLe.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/loopProjection-B8a829ij.js
 /** Canonical client projections for persisted loops and runs. */
 var SUMMARY_RUNS = 18;
 function nextRun(loop) {

package/.output/server/_ssr/{loops._loopId-CKsAnxMl.mjs → loops._loopId-DS16Phmq.mjs}

@@ -1,29 +1,27 @@
 import { o as __toESM } from "../_runtime.mjs";
-import { s as CODING_AGENTS } from "./boot-BbWxaF-z.mjs";
+import { s as CODING_AGENTS } from "./boot-sNlIkoLe.mjs";
 import { g as require_react, h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
-import { D as tsShort, E as selectCls, O as until, S as rel, T as sectionHeadCls, a as btn, b as labelCls, f as dotColor, g as fmt, h as dur, l as btnQuiet, n as Loading, o as btnDanger, p as dotLabel, r as Pill, s as btnPrimary, t as ErrorBanner, v as humanBytes, w as runPulseStyle, y as inputCls } from "./ui-DmFKW2H_.mjs";
-import { i as useFlash, n as FlashLine, r as LoadErrorCard, t as ConfirmBar } from "./actionUi-D15R8L7R.mjs";
+import { C as runPulseStyle, D as until, E as tsShort, T as selectCls, _ as humanBytes, a as btn, c as btnQuiet, d as dotColor, f as dotLabel, h as fmt, m as dur, n as Loading, o as btnDanger, r as Pill, s as btnPrimary, t as ErrorBanner, v as inputCls, w as sectionHeadCls, x as rel, y as labelCls } from "./ui-D5KWstlb.mjs";
+import { i as useFlash, n as FlashLine, r as LoadErrorCard, t as ConfirmBar } from "./actionUi-DJBWuNwr.mjs";
 import { d as useNavigate, u as Link } from "../_libs/@tanstack/react-router+[...].mjs";
-import { D as useSession, S as runLoop, T as stopLoop, b as patchLoop, c as deleteLoop, l as getArtifact, m as getLoopDetail, u as getArtifacts, v as loadOlderRuns, w as startLoop, x as pauseLoop } from "./SocialLinks-BTjsnVOm.mjs";
+import { C as startLoop, E as useSession, _ as loadOlderRuns, b as pauseLoop, c as getArtifact, l as getArtifacts, p as getLoopDetail, s as deleteLoop, w as stopLoop, x as runLoop, y as patchLoop } from "./SocialLinks-Cm4H8pUJ.mjs";
 import { t as setActiveTeamCookie } from "./teamCookie-B7hLOIie.mjs";
-import { t as SignIn } from "./SignIn-DjSrg0nO.mjs";
+import { t as SignIn } from "./SignIn-DEGrvJvb.mjs";
 import { i as lifecycleDisplay, n as daemonStopSupport, r as deriveLoopLifecycle, t as DAEMON_UPGRADE_REQUIRED } from "./lifecycleUi-Dad3hvhm.mjs";
-import { a as Timeline, s as mergeRuns, t as MachinesModal } from "./MachinesModal-DZ_9ErAU.mjs";
-import { n as artifactKind, t as Route } from "./artifactKind-ByzVa7fg.mjs";
+import { a as Timeline, c as mergeRuns, t as MachinesModal } from "./MachinesModal-BjkcVjjx.mjs";
+import { n as artifactKind, t as Route } from "./artifactKind-FBYbgSuf.mjs";
 import { t as purify } from "../_libs/dompurify.mjs";
 import { t as g } from "../_libs/marked.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId-CKsAnxMl.js
+//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId-DS16Phmq.js
 var import_react = /* @__PURE__ */ __toESM(require_react());
 var import_jsx_runtime = require_jsx_runtime();
-/** Download URL for one artifact - the path is segment-encoded so a nested path
-*  (`data/raw.json`) round-trips and can't be mistaken for extra route segments. */
+/** Download URL for one artifact. Each path segment is encoded independently so
+* nested artifact paths continue to match the catch-all route. */
 function downloadHref(loopId, path) {
-	const enc = path.split("/").map(encodeURIComponent).join("/");
-	return `/api/artifact/${encodeURIComponent(loopId)}/${enc}`;
+	const encodedPath = path.split("/").map(encodeURIComponent).join("/");
+	return `/api/artifact/${encodeURIComponent(loopId)}/${encodedPath}`;
 }
-/** Inline render URL for an image artifact - the same bytes as `downloadHref`
-*  but served with the real image content-type + `inline` disposition (see the
-*  route). Used as an <img> src; never for a document the browser navigates to. */
+/** Hardened inline image URL for the same artifact bytes. */
 function inlineHref(loopId, path) {
 	return `${downloadHref(loopId, path)}?view=inline`;
 }
@@ -90,6 +88,24 @@ function MarkdownView({ content }) {
 		dangerouslySetInnerHTML: { __html: (0, import_react.useMemo)(() => renderMarkdown(content), [content]) }
 	});
 }
+/**
+* Shared pieces of the artifact content viewer. The Files panel uses this one
+* dispatch so binary/oversize copy and type-appropriate rendering cannot drift.
+*
+* Display types (see `lib/artifactKind`):
+*  - HTML   → a STRICT sandboxed iframe (`sandbox="allow-scripts"`, deliberately
+*             NO `allow-same-origin`): user-machine-synced markup renders richly
+*             but in an opaque origin, so its scripts can't read the app's
+*             cookies/session or reach `parent` - stored-XSS is contained by
+*             design. A Preview/Source toggle exposes the raw markup too.
+*  - image  → an <img> pointed at the hardened inline route (`inlineHref`); the
+*             bytes are NEVER inlined into the app DOM (SVG is scriptable, so it
+*             rides as an image, which does not execute embedded scripts).
+*  - markdown → the shared markdown pipeline (Preview) with a raw Source toggle.
+*  - text   → monospace source.
+* Everything keeps a Download fallback; an oversize (metadata-only) artifact has
+* no synced bytes to render, so it says so rather than showing an empty pane.
+*/
 /** A small monospace caption strip above a file's content (path · meta [· action]). */
 function ViewerHead({ path, meta, action }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {

package/.output/server/_ssr/{loops._loopId_.runs._runId-DG405pQs.mjs → loops._loopId_.runs._runId-BEJI6iK5.mjs}

@@ -1,12 +1,12 @@
 import { o as __toESM } from "../_runtime.mjs";
 import { g as require_react, h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
-import { T as sectionHeadCls, _ as fnum, a as btn, g as fmt, h as dur, i as StatusPill, n as Loading, o as btnDanger, r as Pill, v as humanBytes, w as runPulseStyle } from "./ui-DmFKW2H_.mjs";
-import { r as LoadErrorCard } from "./actionUi-D15R8L7R.mjs";
+import { C as runPulseStyle, _ as humanBytes, a as btn, g as fnum, h as fmt, i as StatusPill, m as dur, n as Loading, o as btnDanger, r as Pill, w as sectionHeadCls } from "./ui-D5KWstlb.mjs";
+import { r as LoadErrorCard } from "./actionUi-DJBWuNwr.mjs";
 import { u as Link } from "../_libs/@tanstack/react-router+[...].mjs";
-import { D as useSession, E as stopRun, h as getRunDiff, m as getLoopDetail, v as loadOlderRuns } from "./SocialLinks-BTjsnVOm.mjs";
-import { t as SignIn } from "./SignIn-DjSrg0nO.mjs";
-import { t as Route } from "./loops._loopId_.runs._runId-a_SyY8rX.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId_.runs._runId-DG405pQs.js
+import { E as useSession, T as stopRun, _ as loadOlderRuns, m as getRunDiff, p as getLoopDetail } from "./SocialLinks-Cm4H8pUJ.mjs";
+import { t as SignIn } from "./SignIn-DEGrvJvb.mjs";
+import { t as Route } from "./loops._loopId_.runs._runId-CduETLqH.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId_.runs._runId-BEJI6iK5.js
 var import_react = /* @__PURE__ */ __toESM(require_react());
 var import_jsx_runtime = require_jsx_runtime();
 /**

package/.output/server/_ssr/{loops._loopId_.runs._runId-a_SyY8rX.mjs → loops._loopId_.runs._runId-CduETLqH.mjs}

@@ -1,7 +1,7 @@
 import { c as createFileRoute, s as lazyRouteComponent } from "../_libs/@tanstack/react-router+[...].mjs";
-import { d as getAuthState, i as authClient } from "./SocialLinks-BTjsnVOm.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId_.runs._runId-a_SyY8rX.js
-var $$splitComponentImporter = () => import("./loops._loopId_.runs._runId-DG405pQs.mjs");
+import { i as authClient, u as getAuthState } from "./SocialLinks-Cm4H8pUJ.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId_.runs._runId-CduETLqH.js
+var $$splitComponentImporter = () => import("./loops._loopId_.runs._runId-BEJI6iK5.mjs");
 /**
 * Run detail PAGE — `/loops/$loopId/runs/$runId`. A standalone page (the trailing
 * `_` on the `$loopId` segment opts it out of the loop page's component so the run

package/.output/server/_ssr/{machineFns-BSaE7K88.mjs → machineFns-ByMsgG12.mjs}

@@ -1,8 +1,8 @@
-import { A as ensureServer, At as rememberConnectKey, O as deleteMachine$1, S as createMachine$1, St as mintDeviceToken, W as getMachine, bt as machineIdFromToken, dt as listMachinesForTeam, qt as updateMachine, u as MIN_DAEMON_VERSION, ut as listMachines$1, w as daemonNeedsUpdate, yt as loopsForMachine, zt as sha256 } from "./boot-BbWxaF-z.mjs";
-import { requestScope } from "./auth-CPCDf6Wr.mjs";
+import { Bt as sha256, C as createMachine$1, Ct as mintDeviceToken, G as getMachine, Jt as updateMachine, T as daemonNeedsUpdate, bt as loopsForMachine, dt as listMachines$1, ft as listMachinesForTeam, j as ensureServer, jt as rememberConnectKey, k as deleteMachine$1, u as MIN_DAEMON_VERSION, xt as machineIdFromToken } from "./boot-sNlIkoLe.mjs";
+import { requestScope } from "./auth-C0zoZCGe.mjs";
 import { n as createServerFn } from "./ssr.mjs";
 import { t as createServerRpc } from "./createServerRpc-BD8Xn_0_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/machineFns-BSaE7K88.js
+//#region node_modules/.nitro/vite/services/ssr/assets/machineFns-ByMsgG12.js
 /**
 * Whether a machine is visible/actionable in the request scope. Mirrors
 * listMachines: open mode sees everything; otherwise the requester must own the

package/.output/server/_ssr/{node-sqlite-dialect-rWwVyt2J.mjs → node-sqlite-dialect-CjNineno.mjs}

@@ -1,6 +1,6 @@
-import { n as DefaultQueryCompiler, o as CompiledQuery, s as sql$1 } from "./auth-CPCDf6Wr.mjs";
+import { n as DefaultQueryCompiler, o as CompiledQuery, s as sql$1 } from "./auth-C0zoZCGe.mjs";
 import { n as DEFAULT_MIGRATION_TABLE, t as DEFAULT_MIGRATION_LOCK_TABLE } from "./kysely-migration-tables-JkVUjPF_-bPAX9LR_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/node-sqlite-dialect-rWwVyt2J.js
+//#region node_modules/.nitro/vite/services/ssr/assets/node-sqlite-dialect-CjNineno.js
 var NodeSqliteAdapter = class {
 	get supportsCreateIfNotExists() {
 		return true;