@timqi/pier 0.0.2 → 0.0.3

package/README.md

@@ -139,13 +139,24 @@ npm test          # vitest
 
 ## Releases
 
-Pier checks `registry.npmjs.org` in the background and shows `v0.0.1 → 0.0.2`
-in the footer when a release is out. It never updates automatically: this
-process holds provider keys and can run a shell, so rewriting its own code on a
-timer would be a supply-chain surface. `pier update` is a command someone
-types; unlike `pier restart`, it hard-stops the service, writes
-`~/.pier/db/pier.db.release.bak`, updates the npm installation recorded when
-the service was installed, and starts Pier again.
+Pier asks `registry.npmjs.org` at boot and every 30 minutes, and the version
+beside the title turns into `v0.0.1 → 0.0.2` when a release is out. Clicking it
+opens the panel: the source link, **Update now**, and **Update automatically**.
+
+Nothing here installs anything itself — the work is handed to the second
+systemd unit written at install time, because an npm running as a child of the
+process being restarted would be killed by that restart. Off systemd there is
+nothing to hand it to, so the panel says `pier update` instead.
+
+`pier update` typed in a terminal hard-stops the service. The Console and the
+automatic path both **drain first** — new work refused, running turns given
+time to finish, whatever the deadline still had to cut off written to the chat
+it belonged to — and only then hand over. The automatic path additionally waits
+for an idle instance: no turn streaming, no task run in flight.
+
+Either way the updater writes `~/.pier/db/pier.db.release.bak` before npm
+touches the package, updates the npm installation recorded when the service was
+installed, and starts Pier again.
 
 `main` is the only development line. `npm version patch` writes the tag, the
 tag builds and publishes a GitHub Release, and the version in the web footer is

package/dist/channels/slack-tool.js

@@ -45,12 +45,20 @@ export function slackToolSpec(execute) {
     return {
         name: "slack",
         label: "Slack",
-        description: "Read and write Slack through Pier, which holds the bot token. State what you want; Pier does the paging and hands back a finished transcript. context says which Slack conversation you are in; read_channel returns a channel's transcript for a time range; read_thread returns one thread, or only what is new in it since a given message via after; read_message returns the single message at a ts (pass thread_ts when it is a reply inside a thread); post sends a message; channels lists what Pier can reach. When you were reached through Slack, omit channel (and thread_ts) to act on the conversation you are already in. since/until/after accept ISO 8601, epoch seconds or a ts from an earlier read. Every read fetches live from Slack, so nothing is kept between calls — write down what you need to keep. Message text is standard markdown, but @mentions, #channels and links need Slack's own syntax — read the pier-slack skill before posting.",
+        description: "Read and write Slack through Pier, which holds the bot token. State what you want; Pier does the paging and hands back a finished transcript. context says which Slack conversation you are in; read_channel returns a channel's transcript for a time range; read_thread returns one thread, or only what is new in it since a given message via after; read_message returns the single message at a ts (pass thread_ts when it is a reply inside a thread); post sends a message; delete removes the message at a ts, which Slack allows only for messages Pier itself posted; channels lists what Pier can reach. When you were reached through Slack, omit channel (and thread_ts) to act on the conversation you are already in. since/until/after accept ISO 8601, epoch seconds or a ts from an earlier read. Every read fetches live from Slack, so nothing is kept between calls — write down what you need to keep. Message text is standard markdown, but @mentions, #channels and links need Slack's own syntax — read the pier-slack skill before posting.",
         parameters: Type.Object({
             // A JSON-Schema enum emits far fewer tokens than typebox's anyOf-of-consts.
             operation: Type.Unsafe({
                 type: "string",
-                enum: ["context", "read_channel", "read_thread", "read_message", "post", "channels"],
+                enum: [
+                    "context",
+                    "read_channel",
+                    "read_thread",
+                    "read_message",
+                    "post",
+                    "delete",
+                    "channels",
+                ],
             }),
             /**
              * Channel id (`C…`/`D…`/`G…`) or the `#name` shown by `channels`. Omit to
@@ -61,7 +69,7 @@ export function slackToolSpec(execute) {
             until: Type.Optional(Type.String()),
             /** Strictly newer than this — "what changed since I last looked". */
             after: Type.Optional(Type.String()),
-            /** The one message `read_message` is about. */
+            /** The one message `read_message` or `delete` is about. */
             ts: Type.Optional(Type.String()),
             limit: Type.Optional(Type.Number()),
             thread_ts: Type.Optional(Type.String()),
@@ -174,6 +182,21 @@ export async function handleSlackTool(deps, raw, callerSessionId = "") {
             threadTs: threadTs ?? sent.ts,
         };
     }
+    if (input.operation === "delete") {
+        // Never defaulted from `here`: the thread's ts is the parent message, and
+        // "delete" with an implied target is the one mistake with no undo.
+        const ts = required(input.ts, "ts");
+        try {
+            await client.deleteMessage(channel, ts);
+        }
+        catch (err) {
+            throw new Error(explain(err));
+        }
+        // A removal leaves nothing behind to read, so the log is the only record
+        // that it happened at all.
+        deps.log(`slack tool deleted ${ts} in ${channel}`);
+        return { channel, ts, deleted: true };
+    }
     throw new Error(`unknown slack operation: ${String(input.operation)}`);
 }
 /** Accept a `#name` or a bare name as well as an id — models prefer names. */
@@ -285,6 +308,8 @@ function explain(err) {
         missing_scope: "Pier's Slack app lacks the scope for this read; the operator must reinstall it",
         ratelimited: "Slack rate-limited this read; wait a minute or ask for a narrower range",
         thread_not_found: "no thread with that ts in this channel",
+        cant_delete_message: "Slack only lets Pier delete what its own bot posted; a person's message has to be deleted by them",
+        message_not_found: "no message with that ts in this channel — a ts only means anything in the conversation it came from",
     }[code] ?? String(err);
 }
 /** Strictly newer, so `after: <last ts I saw>` never repeats that message. */

package/dist/core/router.js

@@ -29,8 +29,9 @@ export class Router {
     channels = new Map();
     /** Who each session last heard from, so a header costs tokens only on news. */
     senders = new SenderPrefix();
-    /** Set once by a graceful restart (src/drain.ts); never unset — the process
-     *  exits when the drain ends. */
+    /** Set by a graceful restart (src/drain.ts). Usually never unset, because
+     *  the process exits when the drain ends — `endDrain` exists for the one
+     *  caller that drains *speculatively* and may not get to exit. */
     draining = false;
     constructor(hub, 
     /** Create or resume the session owning a conversation (wired in main.ts). */
@@ -91,13 +92,19 @@ export class Router {
      *
      * Skipped for anything that would notice: a streaming turn, and a session
      * someone is still watching over SSE.
+     *
+     * `includeWatched` is the one caller that may take a watched session too:
+     * configuration a session reads only when it opens has just changed, and the
+     * session most likely to need it is the one open in the tab that changed it.
+     * A turn in flight is still never touched — the exemption that stands is the
+     * one about interrupting work, not the one about being looked at.
      */
-    async evictIdle(ttlMs = IDLE_TTL_MS, now = Date.now()) {
+    async evictIdle(ttlMs = IDLE_TTL_MS, now = Date.now(), { includeWatched = false } = {}) {
         let evicted = 0;
         for (const [id, attached] of [...this.bySession]) {
             if (attached.session.state === "streaming")
                 continue;
-            if (this.hub.hasSubscribers(id))
+            if (!includeWatched && this.hub.hasSubscribers(id))
                 continue;
             if (now - attached.activeAt < ttlMs)
                 continue;
@@ -237,6 +244,13 @@ export class Router {
     beginDrain() {
         this.draining = true;
     }
+    /** Take work again. The auto-updater closes the gate *before* handing over,
+     *  so a turn cannot slip in behind the idle check — and when the handover
+     *  never happens, a Pier left refusing every message forever would be a far
+     *  worse outcome than the race it was avoiding. */
+    endDrain() {
+        this.draining = false;
+    }
     /** For surfaces that mutate state before dispatching (the web's edit and
      *  queue-deliver routes): ask first, so a refused dispatch cannot cost a
      *  rewound transcript or a cleared queue. */

package/dist/main.js

@@ -28,8 +28,9 @@ import { TaskStore } from "./tasks/store.js";
 import { taskToolSpec } from "./tasks/tool.js";
 import { PIER_HOME, pierPath } from "./paths.js";
 import { Secrets } from "./secrets.js";
+import { startUpdate, unitPath, updaterProblem } from "./service.js";
 import { SettingsStore } from "./settings.js";
-import { UpdateCheck } from "./update.js";
+import { startAutoUpdate, UpdateCheck } from "./update.js";
 import { AuthStore, registerAuthRoutes, requireAuth } from "./web/auth.js";
 import { SessionStateStore } from "./web/session-state.js";
 import { createServer } from "./web/server.js";
@@ -135,6 +136,100 @@ const startChannels = async () => {
         .catch((err) => log.error("restart-note delivery failed", err));
 };
 void secrets.unlock().then(startChannels, (err) => log.error("secrets locked — channels not started; unlock from Console → Settings → Security, or repair master.key", err));
+// Replacing Pier is systemd's job, not this process's: the oneshot unit stops
+// the service, snapshots the database, installs and starts it again. Without
+// that unit there is nothing to hand the work to, and the Console says so
+// instead of offering a button that cannot work.
+const updates = new UpdateCheck();
+// Asked once at boot, not lazily on the first page load: a restart is exactly
+// when "am I current?" is worth knowing, and it puts the answer in the journal
+// of a Pier nobody has a browser open on.
+void updates.refresh();
+/**
+ * Hand over, but not onto a running turn. The updater's first act is
+ * `systemctl stop`, i.e. a SIGTERM, which is the *fast* teardown — so anything
+ * that started since the idle check would be killed with no note anywhere. The
+ * gate closes first and the drain waits, exactly as `pier restart` does,
+ * ledger included; only then is the install handed over. A handover that never
+ * starts reopens the gate, because a Pier that silently refuses every message
+ * forever is worse than the race it was avoiding.
+ */
+// Shared restart state. The updater's handover, the SIGUSR2 drain (below) and
+// the final teardown must see each other: without this, two paths drain the
+// same Pier at once, and a failure on one reopens the gate the other still
+// needs shut.
+let handingOver = false;
+let draining = false;
+let shuttingDown = false;
+const takeWorkAgain = (why) => {
+    handingOver = false;
+    log.error(`${why} — taking work again`);
+    // Not ours to reopen: a SIGUSR2 restart or the teardown owns the gate now,
+    // and reopening it would hand new work to a process that is exiting.
+    if (draining || shuttingDown)
+        return;
+    router.endDrain();
+    tasks.unpause();
+    // The drain may have deadline-aborted turns into the ledger. Without the
+    // restart that was supposed to follow, that debt would wait for one days
+    // away (§5b) — so the chats are told now, by the process that cut them off.
+    void deliverLedger(restartLedger, (entry) => channels.notify(entry.channelId, entry.conversationId, entry.note))
+        .catch((err) => log.error("restart-note delivery failed", err));
+};
+/** How long the handover has to actually stop us. `systemctl start --no-block`
+ *  returns when the job is *queued*, so "started" is not proof of anything;
+ *  the real outcome is a SIGTERM a second or two later. */
+const HANDOVER_GRACE_MS = 60_000;
+const handOverToUpdater = async () => {
+    // One handover at a time, and never on top of a restart: the Console button,
+    // the auto-update tick and SIGUSR2 would otherwise drain the same Pier
+    // twice, each believing the gate is its own to reopen on failure.
+    if (handingOver || draining || shuttingDown)
+        return "busy";
+    handingOver = true;
+    await drainForRestart({ router, tasks, ledger: restartLedger });
+    const started = startUpdate({ say: (message) => log.info(message) });
+    if (started !== "started") {
+        takeWorkAgain(`update not started (${started})`);
+        return started;
+    }
+    // The gate is closed and nothing in this process will open it again, so a
+    // handover that queues and then goes nowhere — npm failed, the unit was
+    // masked, the job sat behind another — would leave Pier alive and refusing
+    // every message with no way back. Unref'd: this must not be what keeps the
+    // process up while systemd is trying to stop it.
+    setTimeout(() => {
+        takeWorkAgain(`still running ${String(HANDOVER_GRACE_MS / 1000)}s after handing over — pier-update.service never stopped Pier` +
+            ` (check: journalctl --user -u pier-update.service -e)`);
+    }, HANDOVER_GRACE_MS).unref();
+    return started;
+};
+const updater = process.platform === "linux" && existsSync(unitPath())
+    ? { apply: handOverToUpdater, problem: () => updaterProblem() }
+    : null;
+// Unattended only when the operator asked for it *and* nothing is running.
+if (updater) {
+    const problem = updaterProblem();
+    // Loudly, at boot: this is the one moment the operator is looking, and the
+    // alternative is a restart that fails months from now.
+    if (problem)
+        log.warn(`the updater cannot run: ${problem}`);
+    startAutoUpdate(updates, {
+        enabled: () => settings.get().autoUpdate,
+        idle: () => router.busy().length === 0 && tasks.activeRunCount() === 0,
+        apply: async () => {
+            // Re-checked here, not only at boot: a version manager can remove the
+            // recorded Node months into an uptime, and draining for a handover that
+            // cannot happen would take the whole instance down with it.
+            const now = updaterProblem();
+            if (now) {
+                log.error(`auto-update skipped: ${now}`);
+                return "not-installed";
+            }
+            return handOverToUpdater();
+        },
+    });
+}
 // Composition happens here so web/ and tasks/ never import each other.
 const app = new Hono();
 // A route that threw would otherwise answer 500 and leave no trace anywhere:
@@ -162,7 +257,8 @@ app.route("/", createServer({
     providers: factory,
     settings,
     secrets,
-    updates: new UpdateCheck(),
+    updates,
+    updater,
     // Unlocked from the Console: start the channels boot held back.
     onUnlocked: () => void startChannels(),
     backgroundRuns: (id) => tasks.backgroundRuns(id),
@@ -185,7 +281,6 @@ process.on("uncaughtException", (err) => {
 process.on("unhandledRejection", (reason) => {
     log.error("unhandled rejection", reason);
 });
-let shuttingDown = false;
 const shutdown = (stopTasks = true) => {
     // Once: SIGTERM can land while a drain is finishing, and two teardowns
     // racing each other close the same sockets twice.
@@ -221,7 +316,6 @@ for (const signal of ["SIGTERM", "SIGINT"]) {
 // next process up. SIGTERM above stays the fast path systemd expects. `on`,
 // not `once`: a second SIGUSR2 with no handler would fall back to Node's
 // default and kill the drain it meant to hurry.
-let draining = false;
 process.on("SIGUSR2", () => {
     if (draining) {
         log.info("SIGUSR2 received again — already draining");

package/dist/service.js

@@ -185,6 +185,56 @@ export function install(options) {
     say(`started. The first run prints a password once: journalctl --user -u pier -e`);
     return true;
 }
+/**
+ * Why the installed updater could not do its job, or `null` when nothing is
+ * wrong. Checked while Pier is still alive, because the alternative is finding
+ * out at the next restart, from a service that no longer starts.
+ *
+ * The absolute node and npm paths in the unit are deliberate — systemd's PATH
+ * has neither — but they pin the unit to one directory of one version manager.
+ * `fnm install 26 && fnm uninstall 24` leaves ExecStart naming a Node that is
+ * gone; the running process survives (Linux keeps a deleted binary mapped),
+ * so nothing would notice until the update, or the next boot, failed.
+ */
+export function updaterProblem(home = homedir()) {
+    if (!existsSync(unitPath(home)))
+        return null; // not a service install; nothing to check
+    const path = updateUnitPath(home);
+    let unit;
+    if (existsSync(path)) {
+        try {
+            unit = readFileSync(path, "utf8");
+        }
+        catch (err) {
+            return `${path} cannot be read: ${String(err)}`;
+        }
+    }
+    else {
+        // A 0.0.1 install: startUpdate generates the updater from the main unit,
+        // so a missing file is only a problem when that bridge cannot either —
+        // and the generated text gets the same executable check below.
+        try {
+            unit = renderUpdateUnit(legacyOptions(home));
+        }
+        catch {
+            return `${UPDATE_UNIT_NAME} is missing — run: pier service install --force`;
+        }
+    }
+    // The one line that names both executables, quoted and escaped by quote().
+    // Unparseable means hand-edited, which is not this function's business to
+    // judge; the escaping is undone before existsSync sees a path (a `%` or `$`
+    // in it would otherwise read as gone on a working updater).
+    const install = unit.match(/^ExecStart="((?:\\.|[^"\r\n])+)" "((?:\\.|[^"\r\n])+)" install -g/m);
+    if (!install)
+        return null;
+    const unescape = (word) => word.replaceAll("$$", "$").replaceAll("%%", "%").replace(/\\(.)/g, "$1");
+    for (const [what, bin] of [["node", unescape(install[1])], ["npm", unescape(install[2])]]) {
+        if (!existsSync(bin)) {
+            return `the ${what} the updater would use is gone (${bin}) — a version manager removed it; run: pier service install --force`;
+        }
+    }
+    return null;
+}
 function runningPierHome(home) {
     const pid = Number(execFileSync("systemctl", ["--user", "show", UNIT_NAME, "--property=MainPID", "--value"], { encoding: "utf8" }).trim());
     if (Number.isInteger(pid) && pid >= 1) {

package/dist/settings.js

@@ -72,7 +72,11 @@ export class SettingsStore {
         this.#db = db;
     }
     get() {
-        return { publicUrl: this.#value("publicUrl") ?? "", modelMenu: this.#menu() };
+        return {
+            publicUrl: this.#value("publicUrl") ?? "",
+            modelMenu: this.#menu(),
+            autoUpdate: this.#value("autoUpdate") === "1",
+        };
     }
     #menu() {
         const raw = this.#value("modelMenu");
@@ -105,6 +109,10 @@ export class SettingsStore {
         this.#set("modelMenu", JSON.stringify(menu));
         return this.get();
     }
+    setAutoUpdate(on) {
+        this.#set("autoUpdate", on ? "1" : "0");
+        return this.get();
+    }
     #set(key, value) {
         this.#db.prepare(`
       INSERT INTO settings(key, value) VALUES (?, ?)

package/dist/tasks/service.js

@@ -85,6 +85,9 @@ export class TaskService {
         this.definitions.resetNextRuns(now);
         this.callbacks.recover(now);
         this.groups.recover(now);
+        this.runTimer(tickMs);
+    }
+    runTimer(tickMs) {
         this.timer = setInterval(() => {
             // The scheduler's own loop: a throw here would stop nothing (the next
             // tick still fires) and say nothing, so due tasks would just stop.
@@ -92,6 +95,16 @@ export class TaskService {
         }, tickMs);
         this.timer.unref();
     }
+    /** Undo a `pause()` that was not followed by an exit — the auto-updater
+     *  drains before handing over, and a handover that never started must not
+     *  leave the scheduler switched off. Deliberately not `start()`: the boot
+     *  recovery in there would write off runs this process is still running. */
+    unpause(tickMs = 1000) {
+        if (this.timer)
+            return;
+        this.paused = false;
+        this.runTimer(tickMs);
+    }
     stop() {
         this.pause();
         this.execution.stop();

package/dist/update.js

@@ -1,20 +1,22 @@
-// Whether a newer Pier exists. Checking, and nothing more.
+// The newer Pier: whether one exists, and when this one may become it.
 //
 // The registry is asked, not the GitHub API: `registry.npmjs.org` is a CDN with
 // no rate limit and no token, and it is the same place `npm i -g` would look,
 // so what it reports is what an update would actually get.
 //
-// Deliberately only an answer. Applying it is `pier update`, a command someone
-// types: this process holds provider keys and can run a shell, so a service
-// that rewrites its own code on a timer is a supply-chain surface (AGENTS.md 8)
-// — and the updater's hard stop would kill whatever turn was mid-flight.
+// Nothing here installs anything. Applying is handed to whatever supervises
+// this process (service.ts's oneshot unit, injected as `apply`): a web server
+// holding provider keys must not npm-install as its own child, and the two
+// gates below — the operator switched it on, and nothing is running — are why
+// a self-replacing timer is not simply a supply-chain surface (AGENTS.md 8).
 import { createRequire } from "node:module";
 import { logger } from "./log.js";
 const log = logger("update");
 const PACKAGE = "@timqi/pier";
 const ENDPOINT = `https://registry.npmjs.org/${PACKAGE}/latest`;
-/** Long, because the answer changes on release days and never in between. */
-const TTL_MS = 6 * 60 * 60_000;
+/** One conditional-GET-sized request against a CDN, so the cost of asking is
+ *  not what sets this — how long a released fix may sit unnoticed is. */
+const TTL_MS = 30 * 60_000;
 const TIMEOUT_MS = 5_000;
 export const currentVersion = () => createRequire(import.meta.url)("../package.json").version;
 export const isValidVersion = (version) => /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(version);
@@ -59,6 +61,15 @@ export class UpdateCheck {
             available: this.#latest !== null && isNewer(this.#latest, this.current),
         };
     }
+    /** The answer, waiting for the very first check instead of reporting "no
+     *  idea". A browser asks once per page load, so a process that had never
+     *  checked told every one of them `latest: null` — which is exactly how a
+     *  published release looked undetected. Later loads are served from cache. */
+    async statusNow() {
+        if (this.#checkedAt === 0)
+            await this.refresh();
+        return this.status();
+    }
     /** Ask now. Concurrent callers share the one request. */
     refresh() {
         this.#inFlight ??= this.fetchLatest()
@@ -77,6 +88,47 @@ export class UpdateCheck {
         return this.#inFlight;
     }
 }
+/** Often enough to catch an idle window on a busy box, and cheap: the registry
+ *  itself is still only asked once per TTL (`status()` owns that). */
+const AUTO_POLL_MS = 15 * 60_000;
+/** Watch for the moment all three conditions hold. Returns its own stop. */
+export function startAutoUpdate(check, auto, pollMs = AUTO_POLL_MS) {
+    // A handover drains first, which can outlast a poll interval; a second
+    // attempt on top of it would drain an already-draining Pier.
+    let handingOver = false;
+    const tick = async () => {
+        if (handingOver || !auto.enabled())
+            return;
+        // Refreshes in the background when stale; today's answer is good enough,
+        // because the next tick is a quarter of an hour away either way.
+        const { latest, available } = check.status();
+        if (!available || !auto.idle())
+            return;
+        log.info(`auto-update: idle and ${latest ?? "a newer version"} is out — handing over to the updater`);
+        handingOver = true;
+        try {
+            const started = await auto.apply();
+            // Not silent (§5b): an update that never happens must not look like an
+            // update that was never wanted. `busy` is the one non-start that is
+            // fine — someone else is already restarting this Pier.
+            if (started === "busy")
+                log.info("auto-update: a handover or restart is already in progress");
+            else if (started !== "started")
+                log.error(`auto-update could not start: ${started}`);
+        }
+        catch (err) {
+            log.error("auto-update failed", err);
+        }
+        finally {
+            // Only reached when the handover did *not* take the process with it, so
+            // the next tick is allowed to try again.
+            handingOver = false;
+        }
+    };
+    const timer = setInterval(() => void tick(), pollMs);
+    timer.unref(); // a pending check must never be what keeps the process alive
+    return () => clearInterval(timer);
+}
 export async function fetchLatestVersion() {
     // Plain JSON: the abbreviated-packument content type npm uses for a whole
     // package is a 406 on this endpoint, which answers one version already.

package/dist/web/auth.js

@@ -17,7 +17,7 @@
 // header) because the workbench lives on SSE, and EventSource sends no headers.
 import { createHash, createHmac, randomBytes, randomInt, scryptSync, timingSafeEqual, } from "node:crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
-import { getCookie, setCookie } from "hono/cookie";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { pierDb } from "../db.js";
 import { logger } from "../log.js";
 const log = logger("auth");
@@ -271,9 +271,19 @@ export function registerAuthRoutes(app, store) {
         }
         failures.delete(client);
         store.setPassword(next);
-        // The rotation just killed this caller's cookie too; re-issue rather than
-        // bounce the person who is holding the new password to the login form.
-        issueCookie(c, store);
+        // The rotation just killed every cookie out there, this caller's included —
+        // a password is changed because the old one may be known, and "everyone
+        // signs in again" is the whole point. Clear the dead cookie; the client
+        // sends the person to the login form with the password they just chose.
+        deleteCookie(c, COOKIE, { path: "/" });
+        return c.json({ ok: true });
+    });
+    // Signs out this browser by clearing its cookie. The value itself stays
+    // verifiable until it expires — it is a signature, not a stored id — so the
+    // full revocation story remains the password change above. Behind the
+    // boundary like every write: only a signed-in browser has anything to end.
+    app.post("/logout", (c) => {
+        deleteCookie(c, COOKIE, { path: "/" });
         return c.json({ ok: true });
     });
 }

package/dist/web/explorer.js

@@ -1,7 +1,9 @@
 // Files view backend: read-only directory listing, file bytes and git
-// ref/diff queries for the Console's Files view. Every route is scoped to a
-// known project cwd — the picker offers exactly those roots, and nothing
-// outside one is ever listed, read or diffed.
+// ref/diff queries for the Console's Files view. `root` is any directory the
+// process can read — sessions work in worktrees and siblings of their cwd, and
+// an owner who is already past the Console password can reach those paths
+// anyway. `path` is still confined to the `root` it was asked under, so a
+// listing can never widen itself, and nothing here writes.
 import { execFile } from "node:child_process";
 import { readdir, readFile, realpath, stat } from "node:fs/promises";
 import { basename, extname, isAbsolute, resolve, sep } from "node:path";
@@ -27,17 +29,16 @@ const MAX_DIFF_BYTES = 2 * 1024 * 1024;
 const REF_RE = /^[^-\s][^\s]*$/;
 /** git in `root`, output capped — a diff is display data, not an archive. */
 const git = async (root, ...args) => (await run("git", ["-C", root, ...args], { maxBuffer: MAX_DIFF_BYTES })).stdout;
-export function registerExplorerRoutes(app, { factory, nascentCwds }) {
-    /** The scope check every route shares: `root` must be a project cwd Pi
-     *  already knows, and `path` must resolve inside it (realpath both ends —
-     *  neither `..` nor a symlink steps outside). Returns the real target. */
+export function registerExplorerRoutes(app) {
+    /** The scope check every route shares: `root` must be an absolute directory,
+     *  and `path` must resolve inside it (realpath both ends — neither `..` nor a
+     *  symlink steps outside). Returns the real target. */
     const resolveScoped = async (root, path = "") => {
         if (!root || !isAbsolute(root))
-            throw new Error("root must be a known project directory");
-        const known = new Set([...(await factory.list()).map((s) => s.cwd), ...nascentCwds()]);
-        if (!known.has(root))
-            throw new Error("root must be a known project directory");
+            throw new Error("root must be an absolute directory");
         const real = await realpath(root);
+        if (!(await stat(real)).isDirectory())
+            throw new Error("root must be an absolute directory");
         const target = await realpath(resolve(real, path));
         if (target !== real && !target.startsWith(real + sep))
             throw new Error("path escapes root");

package/dist/web/files.js

@@ -39,7 +39,7 @@ export function guarded(app, method, path, status, fn) {
         }
     });
 }
-export function registerFileRoutes(app, { factory, config, nascentCwd }) {
+export function registerFileRoutes(app, { factory, config, nascentCwd, onConfigWritten }) {
     // Scope comes from the client as "global" or a project cwd; only cwds Pi
     // already knows (the session list) are accepted — never an arbitrary path.
     const parseScope = async (raw) => {
@@ -77,6 +77,7 @@ export function registerFileRoutes(app, { factory, config, nascentCwd }) {
         }
         const name = c.req.param("name");
         await config.writeFile(scope, name, body.content, body.expected);
+        onConfigWritten?.();
         return c.json({ ok: true, content: await config.readFile(scope, name) });
     });
     // Resource names may contain slashes — query params, not path params.