@timqi/pier 0.0.16 → 0.0.19

package/dist/web/auth.js

@@ -10,19 +10,29 @@
 // password exists before the listener does — and no env var for an operator to
 // get wrong. Forgot it? Delete the row and restart; a new one is printed.
 //
-// The cookie is a signed expiry, not a stored session id: an HMAC keyed by the
-// stored hash. No session table, no pruning — and changing the password
-// changes the key, so every cookie already out there dies with it. That is the
-// whole revocation story a single-user system needs. A cookie (not a bearer
-// header) because the workbench lives on SSE, and EventSource sends no headers.
-import { createHash, createHmac, randomBytes, randomInt, scryptSync, timingSafeEqual, } from "node:crypto";
+// The cookie is "<id>.<token>", and the database keeps the token's SHA-256 —
+// one row per signed-in browser. Two things follow, and both are why this is
+// not the signed expiry it used to be: a copy of pier.db cannot be turned into
+// a session (there is no signing key in it to forge with), and a single
+// browser can be signed out without changing the password everyone shares. A
+// cookie (not a bearer header) because the workbench lives on SSE, and
+// EventSource sends no headers.
+import { createHash, randomBytes, randomInt, scryptSync, timingSafeEqual } from "node:crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
-import { pierDb } from "../db.js";
+import { pierDb, statements, transact } from "../db.js";
 import { logger } from "../log.js";
 const log = logger("auth");
 const COOKIE = "pier_session";
-const TTL_MS = 90 * 24 * 60 * 60_000;
+/** How long an idle browser stays signed in. Sliding: a session in daily use
+ *  never expires, and a stolen cookie is dead a week after its last use. */
+const TTL_MS = 7 * 24 * 60 * 60_000;
+/** How stale `seen_at` may get before a request writes. Renewal rides on it,
+ *  so this is also how coarse "last seen" is — one write per browser per five
+ *  minutes instead of one per request. */
+const TOUCH_MS = 5 * 60_000;
+/** `revoke(ALL)` — not an id any row can have, so it cannot collide with one. */
+export const ALL = "*";
 /** Failed attempts one client may make before it has to wait out the window. */
 const MAX_FAILURES = 10;
 const WINDOW_MS = 15 * 60_000;
@@ -57,63 +67,159 @@ function generatePassword() {
  */
 export class AuthStore {
     #db;
-    /** HMAC key for cookies: the hash, so rotating the password expires them. */
-    #key;
-    #rotationListeners = new Set();
+    /** Compiled once each: `check()` runs two of these on every request that
+     *  carries a cookie, which is every request the workbench makes. */
+    #sql;
+    #revokeListeners = new Set();
     constructor(db = pierDb(), print = (m) => log.info(m)) {
         this.#db = db;
+        this.#sql = statements(db);
         let row = this.#row();
         if (!row) {
             const password = generatePassword();
             const salt = randomBytes(16).toString("hex");
             row = { salt, hash: hash(password, salt), createdAt: Date.now() };
-            this.#db
-                .prepare("INSERT INTO auth(id, salt, hash, created_at) VALUES (1, ?, ?, ?)")
-                .run(row.salt, row.hash, row.createdAt);
+            // Recovery is "DELETE FROM auth and restart", so this branch is also how
+            // a forgotten password is replaced — and the browsers signed in under the
+            // old one must not walk through it. Their rows go with the credential,
+            // in one transaction: half of this leaves a new password and live old
+            // cookies, which is the state recovery exists to end.
+            transact(this.#db, () => {
+                this.#sql("INSERT INTO auth(id, salt, hash, created_at) VALUES (1, ?, ?, ?)")
+                    .run(salt, hash(password, salt), Date.now());
+                this.#dropSessions();
+            });
             print(`\nthis instance had no password, so one was generated:\n\n    ${password}\n\n` +
                 `only its hash is stored — it is not printed again. ` +
                 `Lost it? "DELETE FROM auth" in the database, then restart.\n`);
         }
-        this.#key = row.hash;
+        // Boot is the one moment that comes around on its own. Without it, a
+        // session that expired while Pier was down would sit there notifying a
+        // phone until somebody happened to sign in.
+        this.sweep();
     }
     #row() {
-        return this.#db
-            .prepare("SELECT salt, hash, created_at AS createdAt FROM auth WHERE id = 1")
+        return this.#sql("SELECT salt, hash, created_at AS createdAt FROM auth WHERE id = 1")
             .get();
     }
+    /** Every signed-in browser at once. Private: the callers that mean it also
+     *  have to tell the listeners, and `revoke(ALL)` is that pair in public. */
+    #dropSessions() {
+        this.#sql("DELETE FROM web_sessions").run();
+    }
+    /** Sessions nobody may use any more, deleted rather than merely refused: a
+     *  row is what a push subscription hangs off, so "expired" has to become
+     *  "gone" without waiting for the browser to come back and be told. Run at
+     *  boot and whenever somebody signs in — the two moments the process has a
+     *  reason to look at this table at all. */
+    sweep() {
+        const swept = this.#sql("DELETE FROM web_sessions WHERE seen_at <= ? RETURNING id")
+            .all(Date.now() - TTL_MS);
+        for (const row of swept)
+            this.#revoked(row.id);
+        if (swept.length)
+            log.info(`swept ${String(swept.length)} expired session(s)`);
+    }
     /** Whether this is the password, compared in constant time. */
     verify(password) {
         const row = this.#row();
         return row ? sameSecret(hash(password, row.salt), row.hash) : false;
     }
     /**
-     * Replace the password, salt and all.
-     *
-     * The new hash becomes the cookie key, so every cookie signed with the old
-     * one — every other browser, and the caller's own — stops verifying. That is
-     * the point: a password is changed because the old one may be known.
+     * Replace the password, salt and all — and with it every session, the
+     * caller's own included. That is the point: a password is changed because the
+     * old one may be known, so nothing that was signed in under it stays signed
+     * in. Listeners hear it after the commit, never before.
      */
     setPassword(password) {
         const salt = randomBytes(16).toString("hex");
-        const next = hash(password, salt);
-        this.#db
-            .prepare("UPDATE auth SET salt = ?, hash = ?, created_at = ? WHERE id = 1")
-            .run(salt, next, Date.now());
-        this.#key = next;
-        for (const listener of this.#rotationListeners)
-            listener();
+        // Credential and sessions change together or not at all — a crash between
+        // the two writes is exactly the state "everyone signs in again" denies.
+        transact(this.#db, () => {
+            this.#sql("UPDATE auth SET salt = ?, hash = ?, created_at = ? WHERE id = 1")
+                .run(salt, hash(password, salt), Date.now());
+            this.#dropSessions();
+        });
+        this.#revoked(ALL);
+    }
+    /** Sign a browser in: one row, and the cookie value that opens it. */
+    open(ip, agent) {
+        const now = Date.now();
+        this.sweep();
+        // The id names the row and the token proves it: 72 bits is plenty for a
+        // name, and the 256-bit token is the only part that has to resist guessing.
+        const id = randomBytes(9).toString("base64url");
+        const token = randomBytes(32).toString("base64url");
+        this.#sql("INSERT INTO web_sessions(id, token_hash, created_at, seen_at, ip, agent)" +
+            " VALUES (?, ?, ?, ?, ?, ?)").run(id, digest(token), now, now, ip, agent.slice(0, 200));
+        return `${id}.${token}`;
+    }
+    /**
+     * The row this cookie names, if the token matches and the row is live.
+     * `renewed` says the deadline just moved, which is the caller's cue to send
+     * the browser a cookie with the new Max-Age — the sliding window has to slide
+     * on both sides or the browser drops a cookie the database still honours.
+     */
+    check(cookie) {
+        const [id, token] = (cookie ?? "").split(".");
+        if (!id || !token)
+            return undefined;
+        const row = this.#sql("SELECT token_hash AS tokenHash, seen_at AS seenAt FROM web_sessions WHERE id = ?").get(id);
+        const now = Date.now();
+        // One clock: last use is the deadline, so there is no second column that
+        // can disagree with it about when this session ends. An expired row is
+        // deleted here rather than left for the next login to sweep — a session
+        // nobody may use must stop being a device Pier notifies at the same moment.
+        if (!row)
+            return undefined;
+        if (now - row.seenAt >= TTL_MS) {
+            this.revoke(id);
+            return undefined;
+        }
+        if (!sameSecret(digest(token), row.tokenHash))
+            return undefined;
+        if (now - row.seenAt < TOUCH_MS)
+            return { id, renewed: false };
+        this.#sql("UPDATE web_sessions SET seen_at = ? WHERE id = ?").run(now, id);
+        return { id, renewed: true };
+    }
+    /** Sign out one browser, or every one of them (`ALL`). Listeners hear the
+     *  same id: a revoked cookie must also close what it opened. */
+    revoke(id) {
+        if (id === ALL)
+            this.#dropSessions();
+        else
+            this.#sql("DELETE FROM web_sessions WHERE id = ?").run(id);
+        this.#revoked(id);
+    }
+    /** Signed-in browsers, most recently seen first. Never the token — the list
+     *  is shown to whoever is signed in, and it is not a set of credentials. */
+    list() {
+        return this.#sql("SELECT id, created_at AS createdAt, seen_at AS seenAt, ip, agent" +
+            " FROM web_sessions WHERE seen_at > ? ORDER BY seen_at DESC").all(Date.now() - TTL_MS);
     }
-    /** A long-lived authenticated surface closes itself when every cookie is
+    /** A long-lived authenticated surface closes itself when a cookie is
      *  revoked. The store and listeners share the process lifetime. */
-    onRotation(listener) {
-        this.#rotationListeners.add(listener);
+    onRevoke(listener) {
+        this.#revokeListeners.add(listener);
     }
-    /** Cookie signing key. Never the password: that is not stored anywhere. */
-    get cookieKey() {
-        return this.#key;
+    /** One listener throwing must not cost the next one its notification: the
+     *  row is already gone, so a surface that never hears about it stays open on
+     *  a session that no longer exists. */
+    #revoked(id) {
+        for (const listener of this.#revokeListeners) {
+            try {
+                listener(id);
+            }
+            catch (err) {
+                log.error(`a revocation listener failed for session ${id}`, err);
+            }
+        }
     }
 }
 const hash = (password, salt) => scryptSync(password, salt, KEY_BYTES).toString("hex");
+/** What the database keeps instead of the cookie's token. */
+const digest = (token) => createHash("sha256").update(token).digest("hex");
 /**
  * What a logged-out visitor must still reach: the login form, published
  * boards, and the stylesheet those boards link — a published board rendering
@@ -130,18 +236,10 @@ function isPublic(method, path) {
         return false;
     return path.startsWith("/p/");
 }
-const sign = (secret, expiresAt) => createHmac("sha256", secret).update(String(expiresAt)).digest("base64url");
 /** Constant-time equality that also hides length: both sides are digested. */
 function sameSecret(a, b) {
-    const digest = (s) => createHash("sha256").update(s).digest();
-    return timingSafeEqual(digest(a), digest(b));
-}
-function valid(secret, cookie) {
-    const [exp, sig] = (cookie ?? "").split(".");
-    const expiresAt = Number(exp);
-    if (!sig || !Number.isSafeInteger(expiresAt) || expiresAt <= Date.now())
-        return false;
-    return sameSecret(sig, sign(secret, expiresAt));
+    const bytes = (s) => createHash("sha256").update(s).digest();
+    return timingSafeEqual(bytes(a), bytes(b));
 }
 /**
  * Only a same-origin path may be returned to after login. `//evil.example` is a
@@ -213,22 +311,30 @@ function sameOrigin(c) {
         : undefined;
     return originMatches(c.req.header("origin"), forwarded || c.req.header("host") || new URL(c.req.url).host);
 }
+/** Which row this request's cookie names. The boundary already verified the
+ *  token; this reads the id back off the value it accepted. Exported so a
+ *  surface that belongs to one browser (its push subscription) names it the
+ *  same way, rather than parsing the cookie a second way. */
+export const sessionIdOf = (c) => (getCookie(c, COOKIE) ?? "").split(".")[0] ?? "";
 /** The same cookie + Origin boundary for a WebSocket upgrade, where no Hono
- *  context exists before the handshake completes. */
+ *  context exists before the handshake completes. The session id comes back
+ *  with the verdict: a socket outlives the request that opened it, so it has
+ *  to know which row signing out would close it. */
 export function upgradeAuthorized(store, req) {
     const raw = req.headers.cookie
         ?.split(";")
         .map((part) => part.trim())
         .find((part) => part.startsWith(`${COOKIE}=`))
         ?.slice(COOKIE.length + 1);
-    if (!valid(store.cookieKey, raw))
-        return false;
+    const session = store.check(raw);
+    if (!session)
+        return undefined;
     const remote = req.socket.remoteAddress ?? "";
     const forwardedHeader = req.headers["x-forwarded-host"];
     const forwarded = loopback(remote) && typeof forwardedHeader === "string"
         ? forwardedHeader.split(",").at(-1)?.trim()
         : undefined;
-    return originMatches(req.headers.origin, forwarded || req.headers.host);
+    return originMatches(req.headers.origin, forwarded || req.headers.host) ? session.id : undefined;
 }
 /** Every route, in one place — no per-route opt-in to forget on the next one. */
 export function requireAuth(store) {
@@ -238,13 +344,18 @@ export function requireAuth(store) {
         c.header("x-frame-options", "DENY");
         if (isPublic(c.req.method, c.req.path))
             return next();
-        const authenticated = valid(store.cookieKey, getCookie(c, COOKIE));
+        const cookie = getCookie(c, COOKIE);
+        const session = store.check(cookie);
         const unsafe = c.req.method !== "GET" && c.req.method !== "HEAD";
-        if (authenticated && unsafe && !sameOrigin(c)) {
+        if (session && unsafe && !sameOrigin(c)) {
             log.warn(`blocked ${c.req.method} ${c.req.path} from origin ${c.req.header("origin")}`);
             return c.json({ error: "forbidden origin" }, 403);
         }
-        if (authenticated) {
+        if (session) {
+            // The database just moved the deadline; the browser is told the same, or
+            // it would drop a cookie that is still good.
+            if (session.renewed && cookie)
+                setSessionCookie(c, cookie);
             await next();
             // Cookie-authenticated content must not become public in a shared proxy.
             if (!c.res.headers.has("cache-control")) {
@@ -279,7 +390,15 @@ export function registerAuthRoutes(app, store) {
         }
         failures.delete(client);
         log.info(`login from ${client}`);
-        issueCookie(c, store);
+        // Signing in again replaces this browser's session rather than adding one:
+        // the cookie it is about to drop would otherwise stay valid for a week, as
+        // a row nobody can recognize in the device list. Verified first — the id in
+        // an unverified cookie is a string the caller chose, and `ALL` is one of
+        // the strings they could choose.
+        const previous = store.check(getCookie(c, COOKIE));
+        if (previous)
+            store.revoke(previous.id);
+        setSessionCookie(c, store.open(client, c.req.header("user-agent") ?? ""));
         return c.redirect(next);
     });
     // Re-authenticate before rotating the credential. The global boundary also
@@ -300,33 +419,58 @@ export function registerAuthRoutes(app, store) {
         }
         failures.delete(client);
         store.setPassword(next);
-        // The rotation just killed every cookie out there, this caller's included —
-        // a password is changed because the old one may be known, and "everyone
-        // signs in again" is the whole point. Clear the dead cookie; the client
-        // sends the person to the login form with the password they just chose.
+        // The rotation drops every session row, this caller's included — a password
+        // is changed because the old one may be known, and "everyone signs in
+        // again" is the whole point. Clear the dead cookie; the client sends the
+        // person to the login form with the password they just chose.
         deleteCookie(c, COOKIE, { path: "/" });
         return c.json({ ok: true });
     });
-    // Signs out this browser by clearing its cookie. The value itself stays
-    // verifiable until it expires — it is a signature, not a stored id — so the
-    // full revocation story remains the password change above. Behind the
-    // boundary like every write: only a signed-in browser has anything to end.
+    // Signed-in browsers, so "sign out that one" is something an operator can
+    // see before doing. Not /api/sessions: that is the agent's sessions, and one
+    // vocabulary for two unrelated things is how the wrong one gets ended.
+    app.get("/api/devices", (c) => {
+        const current = sessionIdOf(c);
+        return c.json(store.list().map((d) => ({ ...d, current: d.id === current })));
+    });
+    // Real revocation: the row goes, and the cookie holding its token opens
+    // nothing on the next request. Ending this browser's own session is the same
+    // call, so the client clears the cookie it is about to stop being able to use.
+    app.post("/api/devices/:id/signout", (c) => {
+        const id = c.req.param("id");
+        // One row per call. Signing everyone out is the password change above,
+        // which is the only thing that also invalidates the password they know.
+        if (id === ALL)
+            return c.json({ error: "not a session id" }, 400);
+        store.revoke(id);
+        log.info(`signed out session ${id}`);
+        if (id === sessionIdOf(c))
+            deleteCookie(c, COOKIE, { path: "/" });
+        return c.json({ ok: true });
+    });
+    // Signs out this browser: the row is deleted, not just the cookie cleared,
+    // so a copy of that cookie taken beforehand is dead too. Behind the boundary
+    // like every write — only a signed-in browser has anything to end.
     app.post("/logout", (c) => {
+        store.revoke(sessionIdOf(c));
         deleteCookie(c, COOKIE, { path: "/" });
         return c.json({ ok: true });
     });
 }
-/** The signed-in cookie, set the same way by login and by a password change. */
-function issueCookie(c, store) {
-    const expiresAt = Date.now() + TTL_MS;
-    setCookie(c, COOKIE, `${expiresAt}.${sign(store.cookieKey, expiresAt)}`, {
+/** The signed-in cookie — set at login, and again whenever the sliding window
+ *  moved, which is why it takes the value rather than making one. */
+function setSessionCookie(c, value) {
+    setCookie(c, COOKIE, value, {
         path: "/",
         httpOnly: true,
         sameSite: "Lax",
         // Set only over TLS: a Secure cookie on plain http is dropped, which
-        // would lock out the loopback and SSH-tunnel setups.
-        secure: c.req.header("x-forwarded-proto") === "https" ||
-            new URL(c.req.url).protocol === "https:",
+        // would lock out the loopback and SSH-tunnel setups. The forwarded scheme
+        // counts only from a local proxy — anywhere else it is a header the client
+        // wrote, and a stranger must not get to decide this flag.
+        secure: new URL(c.req.url).protocol === "https:" ||
+            (c.req.header("x-forwarded-proto")?.split(",").at(-1)?.trim() === "https" &&
+                loopback(remoteOf(c) ?? "")),
         maxAge: TTL_MS / 1000,
     });
 }

package/dist/web/config.js

@@ -0,0 +1,61 @@
+// The agent files a scope is configured by — Pi's own config, skills and
+// extensions — read and written through the ConfigStore, never as paths. A
+// scope is "global" or a project cwd Pi already knows, which is why this is
+// the one filesystem-shaped surface that does not go through web/fs.ts: it
+// never takes a path from the browser at all.
+import { guarded } from "./route.js";
+export function registerConfigRoutes(app, { factory, config, onConfigWritten }) {
+    // Scope comes from the client as "global" or a project cwd; only cwds Pi
+    // already knows (the session list) are accepted — never an arbitrary path.
+    const parseScope = async (raw) => {
+        if (!raw || raw === "global")
+            return { kind: "global" };
+        const known = await factory.list();
+        return known.some((s) => s.cwd === raw) ? { kind: "project", cwd: raw } : null;
+    };
+    app.get("/api/config", async (c) => {
+        c.header("cache-control", "no-store");
+        const scope = await parseScope(c.req.query("scope"));
+        if (!scope)
+            return c.json({ error: "unknown scope" }, 400);
+        return c.json({
+            // Where this scope's files live on disk — the UI labels "Global" with it.
+            dir: scope.kind === "global" ? config.globalDir : scope.cwd,
+            files: await config.listFiles(scope),
+            resources: await config.listResources(scope),
+        });
+    });
+    guarded(app, "GET", "/api/config/files/:name", 400, async (c) => {
+        c.header("cache-control", "no-store");
+        const scope = await parseScope(c.req.query("scope"));
+        if (!scope)
+            return c.json({ error: "unknown scope" }, 400);
+        return c.json({ content: await config.readFile(scope, c.req.param("name")) });
+    });
+    guarded(app, "PUT", "/api/config/files/:name", 400, async (c) => {
+        const scope = await parseScope(c.req.query("scope"));
+        if (!scope)
+            return c.json({ error: "unknown scope" }, 400);
+        const body = await c.req.json().catch(() => null);
+        if (typeof body?.content !== "string" || typeof body?.expected !== "string") {
+            return c.json({ error: "content and expected content required" }, 400);
+        }
+        const name = c.req.param("name");
+        await config.writeFile(scope, name, body.content, body.expected);
+        onConfigWritten?.();
+        return c.json({ ok: true, content: await config.readFile(scope, name) });
+    });
+    // Resource names may contain slashes — query params, not path params.
+    guarded(app, "GET", "/api/config/resource", 400, async (c) => {
+        c.header("cache-control", "no-store");
+        const scope = await parseScope(c.req.query("scope"));
+        if (!scope)
+            return c.json({ error: "unknown scope" }, 400);
+        const kind = c.req.query("kind");
+        const name = c.req.query("name");
+        if ((kind !== "extensions" && kind !== "skills") || !name) {
+            return c.json({ error: "kind and name required" }, 400);
+        }
+        return c.json({ content: await config.readResource(scope, kind, name) });
+    });
+}

package/dist/web/explorer.js

@@ -1,28 +1,12 @@
-// Files view backend: read-only directory listing, file bytes and git
-// ref/diff queries for the Console's Files view. `root` is any directory the
-// process can read — sessions work in worktrees and siblings of their cwd, and
-// an owner who is already past the Console password can reach those paths
-// anyway. `path` is still confined to the `root` it was asked under, so a
-// listing can never widen itself, and nothing here writes.
+// What git knows about a project directory, for the Console's Files view: the
+// refs, commits and worktrees its pickers offer, and the diffs it tones into a
+// file. Every route here runs git and nothing else — reading the directory and
+// the files themselves is web/fs.ts, which also owns the scoping both share.
 import { execFile } from "node:child_process";
-import { readdir, readFile, realpath, stat } from "node:fs/promises";
-import { basename, extname, isAbsolute, resolve, sep } from "node:path";
 import { promisify } from "node:util";
-import { guarded } from "./files.js";
+import { scoped } from "./fs.js";
+import { guarded } from "./route.js";
 const run = promisify(execFile);
-// Inline-renderable binary types; text is sniffed, everything else downloads.
-const BINARY_TYPES = {
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".jpeg": "image/jpeg",
-    ".gif": "image/gif",
-    ".webp": "image/webp",
-    ".avif": "image/avif",
-    ".bmp": "image/bmp",
-    ".svg": "image/svg+xml",
-    ".pdf": "application/pdf",
-};
-const MAX_FILE_BYTES = 32 * 1024 * 1024;
 const MAX_DIFF_BYTES = 2 * 1024 * 1024;
 /** A ref never starts with `-`: execFile blocks the shell, this blocks the
  *  argument parser (`--output=…` is a write). Git validates the rest. */
@@ -30,53 +14,11 @@ const REF_RE = /^[^-\s][^\s]*$/;
 /** git in `root`, output capped — a diff is display data, not an archive. */
 const git = async (root, ...args) => (await run("git", ["-C", root, ...args], { maxBuffer: MAX_DIFF_BYTES })).stdout;
 export function registerExplorerRoutes(app) {
-    /** The scope check every route shares: `root` must be an absolute directory,
-     *  and `path` must resolve inside it (realpath both ends — neither `..` nor a
-     *  symlink steps outside). Returns the real target. */
-    const resolveScoped = async (root, path = "") => {
-        if (!root || !isAbsolute(root))
-            throw new Error("root must be an absolute directory");
-        const real = await realpath(root);
-        if (!(await stat(real)).isDirectory())
-            throw new Error("root must be an absolute directory");
-        const target = await realpath(resolve(real, path));
-        if (target !== real && !target.startsWith(real + sep))
-            throw new Error("path escapes root");
-        return target;
-    };
-    // Directory listing, names only. `.git` is plumbing, not content.
-    guarded(app, "GET", "/api/explorer/ls", 404, async (c) => {
-        c.header("cache-control", "no-store");
-        const dir = await resolveScoped(c.req.query("root"), c.req.query("path"));
-        const entries = (await readdir(dir, { withFileTypes: true }))
-            .filter((e) => e.name !== ".git" && (e.isDirectory() || e.isFile()))
-            .map((e) => ({ name: e.name, dir: e.isDirectory() }))
-            .sort((a, b) => Number(b.dir) - Number(a.dir) || a.name.localeCompare(b.name));
-        return c.json({ entries });
-    });
-    // File bytes, read-only. Known binary types render inline; anything else is
-    // sniffed — a NUL in the head means bytes we can't vouch for, so it
-    // downloads instead of rendering (that is how a file starts executing).
-    guarded(app, "GET", "/api/explorer/file", 404, async (c) => {
-        const file = await resolveScoped(c.req.query("root"), c.req.query("path"));
-        if (!(await stat(file)).isFile())
-            throw new Error("not a file");
-        const bytes = await readFile(file);
-        if (bytes.byteLength > MAX_FILE_BYTES)
-            return c.json({ error: "file too large" }, 413);
-        const binary = BINARY_TYPES[extname(file).toLowerCase()];
-        const text = !binary && !bytes.subarray(0, 8192).includes(0);
-        return c.body(bytes, 200, {
-            "content-type": binary ?? (text ? "text/plain; charset=utf-8" : "application/octet-stream"),
-            "content-disposition": `${binary || text ? "inline" : "attachment"}; filename*=UTF-8''${encodeURIComponent(basename(file))}`,
-            "cache-control": "no-store",
-        });
-    });
     // Git refs for the diff pickers: current branch, branches+tags, recent
     // commits. Not a repo → { branch: null }, which the UI renders as "no git".
     guarded(app, "GET", "/api/explorer/git", 404, async (c) => {
         c.header("cache-control", "no-store");
-        const root = await resolveScoped(c.req.query("root"));
+        const root = await scoped(c.req.query("root"));
         let branch;
         try {
             branch = (await git(root, "rev-parse", "--abbrev-ref", "HEAD")).trim();
@@ -85,11 +27,20 @@ export function registerExplorerRoutes(app) {
             // not a repo, or no commits yet
             return c.json({ branch: null, refs: [], commits: [], worktrees: [] });
         }
+        // Three reads of the same repository, none of which is an argument to
+        // another: one wait, not three. The rev-parse above stays alone — it is
+        // the guard that decides whether these three are asked at all.
+        const [worktreeList, refList, commitLog] = await Promise.all([
+            git(root, "worktree", "list", "--porcelain"),
+            git(root, "for-each-ref", "--format=%(refname:short)\t%(subject)", "refs/heads", "refs/tags"),
+            // Unit/record separators, because a body is multi-line by nature.
+            git(root, "log", "-20", "--format=%h\u001f%at\u001f%an\u001f%ae\u001f%s\u001f%b\u001e"),
+        ]);
         // Every checkout of this repository, from git rather than from the
         // sessions that happen to live in one: a worktree created ten seconds ago
         // has no session in it yet, and that is exactly when its files are worth
         // opening. Detached heads have no `branch` line, so the path stands alone.
-        const worktrees = (await git(root, "worktree", "list", "--porcelain"))
+        const worktrees = worktreeList
             .split("\n\n")
             .map((block) => {
             const path = /^worktree (.+)$/m.exec(block)?.[1];
@@ -97,15 +48,14 @@ export function registerExplorerRoutes(app) {
             return path ? { path, ...(on ? { branch: on } : {}) } : null;
         })
             .filter((w) => w !== null);
-        const refs = (await git(root, "for-each-ref", "--format=%(refname:short)\t%(subject)", "refs/heads", "refs/tags"))
+        const refs = refList
             .split("\n")
             .filter(Boolean)
             .map((line) => {
             const tab = line.indexOf("\t");
             return { name: line.slice(0, tab), subject: line.slice(tab + 1) };
         });
-        // Unit/record separators, because a body is multi-line by nature.
-        const commits = (await git(root, "log", "-20", "--format=%h\u001f%at\u001f%an\u001f%ae\u001f%s\u001f%b\u001e"))
+        const commits = commitLog
             .split("\u001e")
             .map((r) => r.trimStart())
             .filter(Boolean)
@@ -120,7 +70,7 @@ export function registerExplorerRoutes(app) {
     // means the working tree.
     guarded(app, "GET", "/api/explorer/diff", 404, async (c) => {
         c.header("cache-control", "no-store");
-        const root = await resolveScoped(c.req.query("root"));
+        const root = await scoped(c.req.query("root"));
         const base = c.req.query("base") ?? "";
         const head = c.req.query("head") ?? "";
         if (!REF_RE.test(base) || (head !== "" && !REF_RE.test(head)))