@magland/mochi 0.3.1 → 0.4.1

package/dist/browse.js

@@ -35,11 +35,11 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IMAGE_TYPES = void 0;
 exports.registerBrowse = registerBrowse;
-const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const git_1 = require("./git");
 const languages_1 = require("./languages");
 const markdown_1 = require("./markdown");
+const agefile_1 = require("./agefile");
 const pointer_1 = require("./pointer");
 const profile_1 = require("./profile");
 const render_1 = require("./render");
@@ -49,7 +49,9 @@ const diff_1 = require("./diff");
 const layout_1 = require("./layout");
 const perms_1 = require("./perms");
 const scan_1 = require("./scan");
+const topics_1 = require("./topics");
 const session_1 = require("./session");
+const sitesettings_1 = require("./sitesettings");
 const site_1 = require("./site");
 const vault_1 = require("./vault");
 const views = __importStar(require("./views"));
@@ -57,6 +59,50 @@ const views_1 = require("./views");
 const web_1 = require("./web");
 const COMMITS_PER_PAGE = 35;
 const MAX_RENDER_SIZE = 1024 * 1024;
+/**
+ * Raw files over this size are streamed from git rather than read into
+ * memory first. Below it the bytes are read whole, which is what lets the
+ * route tell a pointer from a file and text from binary; above it nothing
+ * needs the bytes but the socket.
+ */
+const STREAM_ABOVE = 8 * 1024 * 1024;
+/**
+ * The caching headers a raw file carries, and whether the request was
+ * answered with a 304 and needs nothing more.
+ *
+ * Reading a public repository is anonymous, so its raw files may be cached
+ * publicly; the question is only for how long. A full commit id can never
+ * come to name different bytes, so under one the answer is forever. Under a
+ * branch or tag it is "until it changes", which HTTP spells as revalidate
+ * every time: the ETag is the blob's own object id, which is a hash of the
+ * bytes, so an unchanged file costs a 304 and no body whichever commit now
+ * holds it. A private repository's bytes were served to one reader and must
+ * never come out of a shared cache for another.
+ */
+function rawCacheHeaders(req, res, ref, blobSha, isPrivate) {
+    const cacheScope = isPrivate ? 'private' : 'public';
+    if (/^[0-9a-f]{40}$/.test(ref)) {
+        res.setHeader('Cache-Control', `${cacheScope}, max-age=31536000, immutable`);
+        return false;
+    }
+    res.setHeader('Cache-Control', `${cacheScope}, no-cache`);
+    return notModified(req, res, `"${blobSha}"`);
+}
+/**
+ * Set the validator and answer 304 if the request already holds it, saying
+ * so. Compared here rather than through req.fresh, which answered false to a
+ * matching If-None-Match on these routes for as long as they have set an
+ * ETag; the comparison is three lines, and this way it is known to run.
+ */
+function notModified(req, res, etag) {
+    res.setHeader('ETag', etag);
+    const presented = req.headers['if-none-match'];
+    if (presented && presented.split(',').some((t) => t.trim() === etag || t.trim() === '*')) {
+        res.status(304).end();
+        return true;
+    }
+    return false;
+}
 const MAX_LISTED_COMMITS = 250;
 const ARCHIVE_FORMATS = {
     'tar.gz': { format: 'tar.gz', type: 'application/gzip' },
@@ -91,14 +137,16 @@ function registerBrowse(app, root, gates, lfs = null) {
             // A repository with a site is linked straight to it from the listing,
             // at its own origin where it has one, so a visitor scanning a
             // collection reaches the published page without stopping at the
-            // repository first.
-            const hasSite = (0, scan_1.siteDir)(root, collection, name) !== null;
+            // repository first. Only when the site is enabled: files on disk with
+            // the switch off are not a site.
+            const hasSite = (0, sitesettings_1.siteSettings)(repo.dir).enabled && (0, scan_1.siteDir)(root, collection, name) !== null;
             const origin = hasSite ? (0, site_1.siteHostUrl)(root, req, collection, name) : null;
             const run = (0, runs_1.latestRun)(root, collection, name);
             return {
                 collection,
                 name,
                 description: (0, scan_1.repoDescription)(repo.dir),
+                topics: (0, topics_1.repoTopics)(repo.dir),
                 isPrivate: (0, perms_1.repoIsPrivate)(repo.dir),
                 updated: await repo.lastUpdated(),
                 siteUrl: !hasSite
@@ -121,13 +169,47 @@ function registerBrowse(app, root, gates, lfs = null) {
     function sortParam(req) {
         return req.query.sort === 'name' ? 'name' : 'recent';
     }
+    // The topic a listing is narrowed to. A value that is not a topic reads as
+    // no narrowing rather than an error, the way an unknown sort does.
+    function topicParam(req) {
+        const t = typeof req.query.topic === 'string' ? req.query.topic : '';
+        return (0, topics_1.isValidTopic)(t) ? t : '';
+    }
+    /** The filter a listing page hands its view: what was chosen, and what there is to choose. */
+    function topicFilter(cards, topic) {
+        return {
+            filtered: topic === '' ? cards : cards.filter((c) => (c.topics ?? []).includes(topic)),
+            filter: { current: topic, inUse: (0, topics_1.countTopics)(cards.map((c) => c.topics ?? [])) },
+        };
+    }
     app.get('/', (0, web_1.ah)(async (req, res) => {
         const viewer = (0, session_1.getViewer)(req, root);
         const cardsPer = await Promise.all((0, scan_1.listCollections)(root).map((c) => repoCards(req, c.name, viewer)));
         // The counts beside collection names count what this viewer can see,
         // for the same reason the cards do.
         const collections = (0, scan_1.listCollections)(root).map((c, i) => ({ name: c.name, repoCount: cardsPer[i].length }));
-        res.type('html').send(views.homePage(root, collections, cardsPer.flat(), sortParam(req), viewer));
+        const { filtered, filter } = topicFilter(cardsPer.flat(), topicParam(req));
+        res.type('html').send(views.homePage(root, collections, filtered, sortParam(req), viewer, filter));
+    }));
+    // The vault's topics, and one topic's repositories. Registered before the
+    // generic /:collection routes, and `topics` is a reserved name (see
+    // src/scan.ts), so no collection can sit where these answer.
+    app.get('/topics', (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, session_1.getViewer)(req, root);
+        const cardsPer = await Promise.all((0, scan_1.listCollections)(root).map((c) => repoCards(req, c.name, viewer)));
+        const counts = (0, topics_1.countTopics)(cardsPer.flat().map((c) => c.topics ?? []));
+        res.type('html').send(views.topicsIndexPage(counts, viewer));
+    }));
+    app.get('/topics/:topic', (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, session_1.getViewer)(req, root);
+        const topic = req.params.topic;
+        if (!(0, topics_1.isValidTopic)(topic)) {
+            (0, web_1.send404)(res, 'Not found', viewer);
+            return;
+        }
+        const cardsPer = await Promise.all((0, scan_1.listCollections)(root).map((c) => repoCards(req, c.name, viewer)));
+        const repos = cardsPer.flat().filter((c) => (c.topics ?? []).includes(topic));
+        res.type('html').send(views.topicPage(topic, repos, sortParam(req), viewer));
     }));
     app.get('/about', (req, res) => {
         res.type('html').send(views.aboutPage((0, web_1.baseUrlOf)(req), (0, session_1.getViewer)(req, root)));
@@ -142,7 +224,12 @@ function registerBrowse(app, root, gates, lfs = null) {
         catch {
             collectionIsDir = false;
         }
-        if (!(0, scan_1.isValidName)(collection) || !collectionIsDir) {
+        // A vault user's namespace page exists as soon as the user does: the
+        // collection directory only appears with their first repository, and a
+        // profile that 404s until then would say the user does not exist.
+        const state = (0, vault_1.loadVault)(root);
+        const userRecord = (0, scan_1.isValidUserName)(collection) && state.status === 'ok' ? (state.vault.users[collection] ?? null) : null;
+        if (!(0, scan_1.isValidName)(collection) || (!collectionIsDir && !userRecord)) {
             (0, web_1.send404)(res, `Collection ${collection} not found`, viewer);
             return;
         }
@@ -150,16 +237,29 @@ function registerBrowse(app, root, gates, lfs = null) {
         // introduces the collection only to viewers who could read it.
         const profileRepo = (0, scan_1.findRepo)(root, collection, '.mochi');
         const profileVisible = profileRepo === null || (0, perms_1.repoRole)(root, viewer?.auth ?? null, profileRepo) !== null;
-        const [cards, profile] = await Promise.all([
-            repoCards(req, collection, viewer),
+        const [allCards, profile] = await Promise.all([
+            collectionIsDir ? repoCards(req, collection, viewer) : Promise.resolve([]),
             profileVisible
                 ? (0, profile_1.collectionProfile)(root, collection)
                 : Promise.resolve({ readme: null, addUrl: `/new?collection=${encodeURIComponent(collection)}` }),
         ]);
-        const canSettings = viewer !== null && (0, perms_1.canAdminCollection)(root, viewer.auth, collection);
+        const canSettings = collectionIsDir && viewer !== null && (0, perms_1.canAdminCollection)(root, viewer.auth, collection);
+        // What the page shows of the user behind the name. The links were held
+        // to http(s) where the profile was saved; the filter here keeps a
+        // hand-edited vault.json from linking the page anywhere else.
+        const owner = userRecord
+            ? {
+                displayName: userRecord.profile?.name ?? null,
+                bio: userRecord.profile?.bio ?? null,
+                links: (userRecord.profile?.links ?? []).filter((l) => /^https?:\/\//i.test(l)),
+                siteAdmin: userRecord.siteAdmin === true,
+                isViewer: viewer !== null && viewer.auth.username === collection,
+            }
+            : null;
+        const { filtered, filter } = topicFilter(allCards, topicParam(req));
         res
             .type('html')
-            .send(views.collectionPage(collection, cards, sortParam(req), viewer, canSettings, profile));
+            .send(views.collectionPage(collection, filtered, sortParam(req), viewer, canSettings, profile, owner, filter));
     }));
     async function renderTree(req, res, loaded, ref, treePath) {
         const viewer = (0, session_1.getViewer)(req, root);
@@ -212,6 +312,7 @@ function registerBrowse(app, root, gates, lfs = null) {
                         blobBase: `${base}/blob/${(0, views_1.encPath)(ref)}${dirSuffix}`,
                         issueBase: `${base}/issues`,
                         commitBase: `${base}/commit`,
+                        mentions: (name) => (0, vault_1.userExists)(root, name),
                     });
                 }
                 else {
@@ -226,10 +327,12 @@ function registerBrowse(app, root, gates, lfs = null) {
             latest,
             commitCount,
             description: (0, scan_1.repoDescription)(loaded.repo.dir),
+            topics: (0, topics_1.repoTopics)(loaded.repo.dir),
             contributors,
             readmeHtml,
             readmeName,
             languages,
+            msg: typeof req.query.msg === 'string' ? req.query.msg : undefined,
         }));
     }
     app.get('/:collection/:repo', (0, web_1.ah)(async (req, res) => {
@@ -282,9 +385,20 @@ function registerBrowse(app, root, gates, lfs = null) {
             (0, web_1.send404)(res, `File ${filePath} not found at ${ref}`, viewer);
             return;
         }
-        const buf = await loaded.repo.catBlob(ref, filePath);
         const ext = (filePath.split('.').pop() ?? '').toLowerCase();
         const rawUrl = `${(0, views_1.repoUrl)(ctx)}/raw/${(0, views_1.encPath)(ref)}/${(0, views_1.encPath)(filePath)}`;
+        // The size first, and the bytes only if they will be shown. A file over
+        // the render limit gets its card from the size alone: nothing below
+        // would render it, and reading it whole to learn that held a file the
+        // size of the machine in memory. An LFS pointer is a few hundred bytes
+        // and never reaches this branch.
+        const info = await loaded.repo.blobInfo(ref, filePath);
+        if (info && info.size > MAX_RENDER_SIZE) {
+            const kind = exports.IMAGE_TYPES[ext] ? 'image' : 'too-large';
+            res.type('html').send(views.blobPage(ctx, filePath, { kind, rawUrl, size: info.size }));
+            return;
+        }
+        const buf = await loaded.repo.catBlob(ref, filePath);
         // LFS pointer detection precedes every content branch: an LFS-tracked
         // .md or .png must render as a download card, not as its pointer text.
         // ?plain=1 falls through to the source view, as on GitHub, keeping the
@@ -311,6 +425,20 @@ function registerBrowse(app, root, gates, lfs = null) {
             }, true));
             return;
         }
+        // An age ciphertext renders as a decrypt-in-the-browser card, whatever
+        // its framing: armored files are text and binary ones are not, and the
+        // card treats both alike. ?plain=1 falls through, so the armored source
+        // is inspectable the way a markdown file's is.
+        if ((0, agefile_1.isAgeFile)(filePath) && req.query.plain !== '1') {
+            res.type('html').send(views.blobPage(ctx, filePath, {
+                kind: 'age',
+                rawUrl,
+                size: buf.length,
+                editable: ctx.canPush && ctx.refIsBranch,
+                markdownInner: (0, markdown_1.isMarkdownFile)((0, agefile_1.ageInnerName)(filePath)),
+            }));
+            return;
+        }
         if (exports.IMAGE_TYPES[ext]) {
             res.type('html').send(views.blobPage(ctx, filePath, { kind: 'image', rawUrl, size: buf.length }));
             return;
@@ -334,6 +462,7 @@ function registerBrowse(app, root, gates, lfs = null) {
                 blobBase: `${(0, views_1.repoUrl)(ctx)}/blob/${(0, views_1.encPath)(ref)}${dir}`,
                 issueBase: `${(0, views_1.repoUrl)(ctx)}/issues`,
                 commitBase: `${(0, views_1.repoUrl)(ctx)}/commit`,
+                mentions: ctx.hasUser,
             });
             res
                 .type('html')
@@ -361,12 +490,17 @@ function registerBrowse(app, root, gates, lfs = null) {
         }
         const ctx = await (0, web_1.makeCtx)(root, req, loaded, ref, viewer);
         const blobUrl = `${(0, views_1.repoUrl)(ctx)}/blob/${(0, views_1.encPath)(ref)}/${(0, views_1.encPath)(filePath)}`;
-        if ((await loaded.repo.entryType(ref, filePath)) !== 'blob') {
+        const info = await loaded.repo.blobInfo(ref, filePath);
+        if (!info) {
             (0, web_1.send404)(res, `File ${filePath} not found at ${ref}`, viewer);
             return;
         }
+        if (info.size > MAX_RENDER_SIZE) {
+            res.redirect(blobUrl);
+            return;
+        }
         const buf = await loaded.repo.catBlob(ref, filePath);
-        if ((0, render_1.isBinary)(buf) || buf.length > MAX_RENDER_SIZE) {
+        if ((0, render_1.isBinary)(buf)) {
             res.redirect(blobUrl);
             return;
         }
@@ -383,11 +517,28 @@ function registerBrowse(app, root, gates, lfs = null) {
             (0, web_1.send404)(res);
             return;
         }
-        const type = await loaded.repo.entryType(ref, filePath);
-        if (type !== 'blob') {
+        const info = await loaded.repo.blobInfo(ref, filePath);
+        if (!info) {
             res.status(404).type('text/plain').send('not found');
             return;
         }
+        // A large file is streamed from git to the socket and never held here;
+        // see rawCacheHeaders for what the two paths share. What the streamed
+        // path gives up is the sniff: without the bytes in hand it cannot tell
+        // text from binary, so anything that is not an image by extension is
+        // served as a download. Small files, which are the ones a browser can
+        // usefully show inline, keep the buffered path below.
+        if (info.size > STREAM_ABOVE) {
+            const ext = (filePath.split('.').pop() ?? '').toLowerCase();
+            if (rawCacheHeaders(req, res, ref, info.sha, (0, perms_1.repoIsPrivate)(loaded.repo.dir)))
+                return;
+            res.setHeader('Content-Security-Policy', 'sandbox');
+            res.setHeader('X-Content-Type-Options', 'nosniff');
+            res.setHeader('Content-Length', String(info.size));
+            res.type(exports.IMAGE_TYPES[ext] ?? 'application/octet-stream');
+            await loaded.repo.streamBlob(ref, filePath, res);
+            return;
+        }
         const buf = await loaded.repo.catBlob(ref, filePath);
         // A pointer blob redirects to the stored object; the filename gives the
         // browser something better to save than a 64-character object id.
@@ -417,18 +568,8 @@ function registerBrowse(app, root, gates, lfs = null) {
         // on purpose: a redirect to a presigned URL expires and must not be
         // cached. A private repository's bytes were served to one reader and
         // must never come out of a shared cache for another.
-        const cacheScope = (0, perms_1.repoIsPrivate)(loaded.repo.dir) ? 'private' : 'public';
-        if (/^[0-9a-f]{40}$/.test(ref)) {
-            res.setHeader('Cache-Control', `${cacheScope}, max-age=31536000, immutable`);
-        }
-        else {
-            res.setHeader('Cache-Control', `${cacheScope}, no-cache`);
-            res.setHeader('ETag', `"${crypto.createHash('sha256').update(buf).digest('hex').slice(0, 32)}"`);
-            if (req.fresh) {
-                res.status(304).end();
-                return;
-            }
-        }
+        if (rawCacheHeaders(req, res, ref, info.sha, (0, perms_1.repoIsPrivate)(loaded.repo.dir)))
+            return;
         const ext = (filePath.split('.').pop() ?? '').toLowerCase();
         // Repository content must never be able to inject HTML into this
         // origin: non-image types are served as text/plain in a sandbox.
@@ -477,11 +618,8 @@ function registerBrowse(app, root, gates, lfs = null) {
         }
         else {
             res.setHeader('Cache-Control', `${cacheScope}, no-cache`);
-            res.setHeader('ETag', `"${sha}"`);
-            if (req.fresh) {
-                res.status(304).end();
+            if (notModified(req, res, `"${sha}"`))
                 return;
-            }
         }
         // The slot is held until the stream ends, which is what the gate is for: an
         // archive holds a subprocess and a socket for as long as the client cares
@@ -609,18 +747,18 @@ function registerBrowse(app, root, gates, lfs = null) {
     // not 301: a permanent redirect would be cached hard, and removing
     // sites.host from config.json must take effect on the next request.
     app.get('/:collection/:repo/site/*', (req, res) => {
-        const origin = (0, site_1.siteHostUrl)(root, req, req.params.collection, (0, scan_1.displayName)(req.params.repo));
+        const origin = (0, site_1.siteRedirectUrl)(root, req, req.params.collection, (0, scan_1.displayName)(req.params.repo));
         if (origin) {
             const query = req.originalUrl.includes('?') ? req.originalUrl.slice(req.originalUrl.indexOf('?')) : '';
             res.redirect(302, `${origin}/${(0, web_1.wildcard)(req)}${query}`);
             return;
         }
-        (0, site_1.serveSite)(root, req.params.collection, req.params.repo, req, res, 'sandbox');
+        (0, site_1.serveSite)(root, req.params.collection, req.params.repo, req, res, 'sandbox', (0, session_1.getViewer)(req, root)?.auth ?? null);
     });
     // The missing-slash redirect lands on the site origin in one hop rather than
     // two when there is one.
     app.get('/:collection/:repo/site', (req, res) => {
-        const origin = (0, site_1.siteHostUrl)(root, req, req.params.collection, (0, scan_1.displayName)(req.params.repo));
+        const origin = (0, site_1.siteRedirectUrl)(root, req, req.params.collection, (0, scan_1.displayName)(req.params.repo));
         if (origin) {
             res.redirect(302, `${origin}/`);
             return;

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "7b95ca5-dirty",
-  "builtAt": "2026-08-21T14:34:24.115Z"
+  "commit": "0e4047e",
+  "builtAt": "2026-09-29T02:15:46.393Z"
 }

package/dist/ci/api.js

@@ -41,6 +41,8 @@ const express_1 = __importDefault(require("express"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const scan_1 = require("../scan");
+const sitesettings_1 = require("../sitesettings");
+const sitepublish_1 = require("../sitepublish");
 const site_1 = require("../site");
 const perms_1 = require("../perms");
 const vault_1 = require("../vault");
@@ -171,6 +173,11 @@ function registerCiApi(app, root, engine, authLimiter) {
                 allow: r.allow,
                 createdBy: r.createdBy,
                 createdAt: r.createdAt,
+                // What was set and what is in force, the two differing for a runner
+                // left on the default: a caller wanting to know how long a job may run
+                // there should not have to know what the default is.
+                jobTimeoutMinutes: r.jobTimeoutMinutes ?? null,
+                jobTimeout: (0, runners_1.runnerJobTimeout)(r),
                 // Registration says what a runner may do; these two say whether it is
                 // there at all and what it is doing, which is what a caller looking at
                 // a run that has not started actually wants to know.
@@ -192,6 +199,13 @@ function registerCiApi(app, root, engine, authLimiter) {
      * far as this can go: where it points is the administrator's business, and
      * they are already trusted with a runner that executes repository code.
      */
+    // A wake address is somewhere the vault will send requests to, on a timer
+    // and on demand, and report back whether it answered. Every user owns a
+    // collection and so may register a runner for it, which would have made
+    // this a way for any user to have the vault probe an address of their
+    // choosing, an internal one included. So the address alone takes a site
+    // admin, as it does in the web interface; the runner itself does not.
+    const WAKE_ADMIN_ONLY = 'only a site admin may give a runner a wake address or send its wake request: the vault sends requests to whatever the address names';
     function wakeFrom(body) {
         const url = body.wakeUrl;
         const secret = body.wakeSecret;
@@ -262,13 +276,30 @@ function registerCiApi(app, root, engine, authLimiter) {
             apiError(res, 400, wake.error);
             return;
         }
+        if (wake.wake && !(0, perms_1.isSiteAdmin)(auth)) {
+            apiError(res, 403, WAKE_ADMIN_ONLY);
+            return;
+        }
+        const timeout = jobTimeoutFrom(body);
+        if ('error' in timeout) {
+            apiError(res, 400, timeout.error);
+            return;
+        }
         const { token, runner } = (0, runners_1.registerRunner)(root, name, {
             labels: labels.length ? labels : ['ubuntu-latest'],
             allow,
             createdBy: auth.username,
+            jobTimeoutMinutes: timeout.minutes,
             wake: wake.wake,
         });
-        res.json({ name, token, labels: runner.labels, allow: runner.allow, wakeUrl: runner.wakeUrl ?? null });
+        res.json({
+            name,
+            token,
+            labels: runner.labels,
+            allow: runner.allow,
+            jobTimeout: (0, runners_1.runnerJobTimeout)(runner),
+            wakeUrl: runner.wakeUrl ?? null,
+        });
     });
     /**
      * Issue a new token for a runner, invalidating the one it had.
@@ -300,6 +331,73 @@ function registerCiApi(app, root, engine, authLimiter) {
         }
         res.json({ name, token: issued.token, labels: issued.runner.labels, allow: issued.runner.allow });
     });
+    /**
+     * The job timeout in a request body, or a message saying what is wrong.
+     *
+     * Absent and null both read as the default, which is what registration
+     * wants; the PATCH route below tells the two apart itself, because there an
+     * absent field is a caller who asked for nothing. A value that is not a
+     * usable number of minutes is refused rather than rounded: an operator who
+     * typed 0 meant something, and it was not "no limit".
+     */
+    function jobTimeoutFrom(body) {
+        const v = body.jobTimeoutMinutes;
+        if (v === undefined)
+            return { minutes: null };
+        if (v === null)
+            return { minutes: null };
+        if (typeof v !== 'number' || !(0, runners_1.isUsableJobTimeout)(v)) {
+            return {
+                error: `"jobTimeoutMinutes" must be a whole number of minutes from 1 to ${runners_1.MAX_JOB_TIMEOUT_MINUTES}, or null for the default of ${runners_1.DEFAULT_JOB_TIMEOUT_MINUTES}`,
+            };
+        }
+        return { minutes: v };
+    }
+    /**
+     * The longest a job may run on this runner. A ceiling rather than a default:
+     * a job's own `timeout-minutes` applies when it asks for less, and is cut
+     * down to this when it asks for more or asks for nothing.
+     *
+     * A change applies to the next job the runner takes, not to one already
+     * running: the runner enforces the timeout it was handed with the job, and
+     * reaching into a job in flight to shorten it would be a cancellation
+     * wearing a setting's clothes.
+     */
+    app.patch('/api/runners/:name', json, (req, res) => {
+        const auth = requireAdmin(req, res);
+        if (!auth)
+            return;
+        const name = req.params.name;
+        const existing = (0, runners_1.loadRunners)(root).runners[name];
+        if (!existing) {
+            apiError(res, 404, `no runner named ${name}`);
+            return;
+        }
+        if (!(0, perms_1.canAdminRunnerGlobs)(root, auth, existing.allow)) {
+            apiError(res, 403, 'you must own every collection this runner serves; a site admin may manage any runner');
+            return;
+        }
+        const body = (req.body ?? {});
+        if (body.jobTimeoutMinutes === undefined) {
+            apiError(res, 400, 'nothing to change; provide "jobTimeoutMinutes"');
+            return;
+        }
+        const timeout = jobTimeoutFrom(body);
+        if ('error' in timeout) {
+            apiError(res, 400, timeout.error);
+            return;
+        }
+        const runner = (0, runners_1.setRunnerJobTimeout)(root, name, timeout.minutes);
+        if (!runner) {
+            apiError(res, 404, `no runner named ${name}`);
+            return;
+        }
+        res.json({
+            name,
+            jobTimeoutMinutes: runner.jobTimeoutMinutes ?? null,
+            jobTimeout: (0, runners_1.runnerJobTimeout)(runner),
+        });
+    });
     /**
      * Point a runner's wake address somewhere, or clear it with an empty body.
      *
@@ -327,6 +425,10 @@ function registerCiApi(app, root, engine, authLimiter) {
             apiError(res, 400, wake.error);
             return;
         }
+        if (wake.wake && !(0, perms_1.isSiteAdmin)(auth)) {
+            apiError(res, 403, WAKE_ADMIN_ONLY);
+            return;
+        }
         const runner = (0, runners_1.setRunnerWake)(root, name, wake.wake);
         res.json({ name, wakeUrl: runner?.wakeUrl ?? null });
     });
@@ -348,8 +450,8 @@ function registerCiApi(app, root, engine, authLimiter) {
             apiError(res, 404, `no runner named ${name}`);
             return;
         }
-        if (!(0, perms_1.canAdminRunnerGlobs)(root, auth, existing.allow)) {
-            apiError(res, 403, 'you must own every collection this runner serves; a site admin may manage any runner');
+        if (!(0, perms_1.isSiteAdmin)(auth)) {
+            apiError(res, 403, WAKE_ADMIN_ONLY);
             return;
         }
         const wake = (0, wake_1.wakeOf)(existing);
@@ -412,7 +514,10 @@ function registerCiApi(app, root, engine, authLimiter) {
                 gone.abort();
             }
         });
-        const spec = await engine.waitForJob(auth.name, labels, auth.runner.allow, (0, web_1.baseUrlOf)(req), ACQUIRE_TIMEOUT_MS, gone.signal);
+        const spec = await engine.waitForJob(auth.name, labels, auth.runner.allow, (0, web_1.baseUrlOf)(req), 
+        // The registry decides how long a job may run on this machine, so the
+        // limit is read here rather than trusted from the runner's own request.
+        (0, runners_1.runnerJobTimeout)(auth.runner), ACQUIRE_TIMEOUT_MS, gone.signal);
         if (!spec) {
             if (!closed)
                 res.status(204).end();
@@ -684,6 +789,9 @@ function registerCiApi(app, root, engine, authLimiter) {
     });
     // ---- artifacts ----
     //
+    /** How many distinct artifacts one run may hold; see the upload route. */
+    const MAX_ARTIFACTS_PER_RUN = 100;
+    //
     // A job uploads under a name and a later job in the same run downloads by
     // that name. Authorization is the job's lease, so an artifact can only be
     // written by a job that is actually running, and only into its own run.
@@ -713,6 +821,18 @@ function registerCiApi(app, root, engine, authLimiter) {
         }
         const limit = engine.artifactLimitBytes();
         fs.mkdirSync(dir, { recursive: true });
+        // The per-upload limit reads as a limit on the run, and was not one: a
+        // job that uploaded under a new name each time could fill the disk a
+        // capped artifact at a time. Replacing an artifact is always allowed;
+        // adding one is, up to a count no honest workflow approaches.
+        if (!fs.existsSync(file)) {
+            const present = fs.readdirSync(dir).filter((n) => !/\.tmp-\d+$/.test(n)).length;
+            if (present >= MAX_ARTIFACTS_PER_RUN) {
+                req.resume();
+                apiError(res, 413, `this run already holds ${present} artifacts, the most a run may hold`);
+                return;
+            }
+        }
         const tmp = `${file}.tmp-${process.pid}`;
         const out = fs.createWriteStream(tmp);
         let written = 0;
@@ -800,6 +920,20 @@ function registerCiApi(app, root, engine, authLimiter) {
             apiError(res, 409, 'the lease on this job is no longer valid');
             return;
         }
+        // The repository's own settings gate the write, not the runner's standing:
+        // a site that is not enabled is not deployed to, and one published by
+        // copying files is not deployed to either, so a workflow cannot overwrite
+        // what somebody maintains by hand. The refusal names the setting to change.
+        const repo = (0, scan_1.findRepo)(root, a.collection, a.repo);
+        const settings = repo ? (0, sitesettings_1.siteSettings)(repo.dir) : null;
+        if (!settings || !settings.enabled) {
+            apiError(res, 403, `the site for ${a.collection}/${a.repo} is not enabled; a repository admin can enable it in the repository's settings`);
+            return;
+        }
+        if (settings.source !== 'actions') {
+            apiError(res, 403, `the site for ${a.collection}/${a.repo} is published by ${(0, sitepublish_1.describeSiteSource)(settings.source)}, not by workflow deploys; set its site source to workflow deploys first`);
+            return;
+        }
         const body = (req.body ?? {});
         const name = typeof body.artifact === 'string' ? body.artifact : 'github-pages';
         if (!(0, artifacts_1.isValidArtifactName)(name)) {