k0-board 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -6,6 +6,71 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.4.0]
+
+The file viewer stops being read-only, and stops being just a pile of documents. It now shows the
+folders a repository is built from, and behind a switch it shows the configuration too — an
+`.env`, a `package.json`, a workflow's YAML — laid out as the kind of thing each one is, and
+editable in place with a Save button. The name search, meanwhile, turns out to have been quietly
+wrong the whole time: it matched letters scattered across a whole path rather than the file you
+meant, and it now looks only at the name and shows you why a row is there at all.
+
+### Added
+
+- **Folders, at last.** The file viewer's listing starts with the folders, and clicking one takes
+  you inside it: the folders it holds first, then its files. The path is written across the top
+  one piece at a time and **every piece is a way back up** — from `docs/backlog/handover` you
+  reach `docs` in one click, and the whole repository by clicking its name. The path above an open
+  document does the same, so from a file you can step out into the folder it lives in. Arrow keys
+  walk folders, Enter goes in, Esc comes out, ⌘-click opens one in another tab, and the address
+  follows you so a reload puts you back where you were.
+- **Open in Finder.** A button on a folder opens that folder in your file manager, and the same
+  button in the row above a file points the file out inside its own folder. It works on macOS,
+  Windows and Linux; where a system gives k0 no way to do it, the button stays where it is, greyed
+  out, with the reason in its tooltip rather than quietly doing nothing.
+- **The `config` button beside the search shows the configuration.** The viewer lists
+  documents, which is right until the day you want to check a key in an `.env`. Switch it on and
+  `.env` (and `.env.local`, and the rest), `.json`, `.yml`, `.yaml`, `.toml` and `.ini` join the
+  listing, the name search and the search inside the text — **including the ones git is told to
+  ignore**, because an `.env` is ignored by definition and it is the file you came for. Code stays
+  out either way. The switch is remembered, per browser.
+- **Configuration opens as the kind of thing it is.** A **JSON** file becomes a tree that folds,
+  coloured by type, with the first two levels open — and with **its own search box**, because the
+  browser's find does not look inside a closed branch: on a folded tree ⌘F says "not found" for
+  something three lines away. This one counts what it found and opens the branches holding it. An
+  **.env** becomes a table of names and values, comments kept. **YAML, TOML and INI** keep their
+  shape, with keys, values and comments told apart by colour.
+- **Configuration and notes can be edited here, with a Save button.** The pencil in the row above
+  a document turns it into a text box as tall as the pane — not a small window over it, because a
+  README does not fit in one. ⌘S saves, Cancel goes back to what is on disk. Only `.env` and the
+  other configuration, `.md` and `.txt`: no code, no PDFs, no images, and no creating or deleting
+  files. If the file **changed on disk while you were editing it** — a session wrote it, or you
+  did, in another window — the save stops and says so, and what you typed stays exactly where it
+  is. k0 will not write over somebody else's work without telling you.
+- **A search whose best answer is switched off says so.** Looking for `.env` with the switch off
+  used to give eighty files that merely contain those four letters somewhere in their path, and no
+  hint that the one you wanted was a click away. Now a line appears above the results — *3
+  configuration files also match — show them* — and it is the button: clicking it turns the switch
+  on. It appears only when a hidden file would have come **above** everything on screen, so it is
+  not there on the searches where it would only be noise.
+- **The name search looks only inside the file's own name, and underlines what it found.** The
+  directory used to be searched too, scattered letters and all, which is how `.env` once turned up
+  `v1.0-ROADMAP.md` — three of its four letters came from `.planning/milestones/`, a folder nobody
+  was reading, with no way to see that from the row. Now the directory is never searched, and the
+  letters that matched are underlined right in the name: `aud`it-`rep`ort reads as the two words
+  you meant. Neighbouring letters are underlined as one stretch, not one by one. The mark is a
+  line and not the yellow used for the text search, so the two answers stay apart: yellow means
+  the word is inside the file, a line means it is in the name.
+
+### Changed
+
+- **On a card, the git mark sits against the right edge** instead of hanging off the end of the
+  repository's name, where it landed in a different place on every note. It is now the same shape
+  as the heading of a column, so a row of cards has a line you can read down. A long repository
+  name is cut with an ellipsis rather than pushing the mark about.
+- Nothing a user can see: the coverage floor moves up to 87% of lines and 85% of branches, which
+  is where the two new modules leave it.
+
 ## [0.3.0]
 
 k0 could already tell you what each session was costing you in memory, and `Close` on a card was

package/README.md

@@ -398,12 +398,12 @@ yet — a **lens** takes its place, so every card and every column still leads i
 
 Files on the left, what they say on the right, and a divider in between that you can drag.
 
-**Only documents are listed** — markdown, html, text, PDF, Word: things you read and print. In a
-real repository code is 95% of the files, and among two thousand `.tsx` files the document you
+**Documents are what is listed** — markdown, html, text, PDF, Word: things you read and print. In
+a real repository code is 95% of the files, and among two thousand `.tsx` files the document you
 were after cannot be found. This closes nothing off: a code file reached by a link inside a
-document still opens, and so do images.
+document still opens, and so do images — and the configuration is one switch away, below.
 
-The listing is flat, in three groups:
+At the top come the **folders**, then the files, in three groups:
 
 - **Changed** — what this session has touched: files still hanging in the working tree plus the
   ones inside commits made since it started.
@@ -411,19 +411,91 @@ The listing is flat, in three groups:
   no git.
 - **All files** — everything else, in path order.
 
+### Searching
+
 The search at the top looks in two places and keeps them apart:
 
-- **Names** — not the exact word, but the letters you type in the order you type them: `audrep`
-  finds `docs/audit-report.md`. It filters as you type, asking the server nothing.
+- **Names** — not the exact word, but the letters you type in the order you type them, **inside
+  the file's own name**: `audrep` finds `docs/audit-report.md`. It filters as you type, asking the
+  server nothing. The directory is never searched — it used to be, and `.env` would turn up a
+  `v1.0-ROADMAP.md` that merely had those four letters scattered across its folder, three of them
+  in a name nobody was reading. The letters that matched are **underlined**, so every row says why
+  it is there: `aud`it-`rep`ort reads as the two words you meant.
 - **In the text** — inside the documents, with the line the word appears on and the word
-  highlighted. Because what you remember about a file is what was in it, not what it was called.
-  Accents do not need typing — `cafe` finds `café`.
+  highlighted in yellow. Because what you remember about a file is what was in it, not what it was
+  called. Accents do not need typing — `cafe` finds `café`.
+
+The two marks are different on purpose: a line under the letters means they are in the file's
+name, yellow means the word was found inside the file.
 
 There is no index. The documents are read every time: a few hundred files of a few KB, all
 already in the operating system's cache. An index would cost more and go stale.
 
 `/` puts the cursor in the search, arrows scroll, Enter opens, Esc clears.
 
+### Going into a folder
+
+Click a folder and the listing narrows to it: the folders inside it first, then its files. At the
+top the path is written out one piece at a time, and **every piece is a way back up** — from
+`docs/backlog/handover` you get to `docs` in one click, and to the whole repository by clicking
+the repository's name. The path above an open document works the same way, so from a file you can
+step into the folder it lives in.
+
+The arrows walk folders like anything else and Enter goes in; Esc comes back out. A folder is a
+real link, so ⌘/Ctrl-click opens it in another tab, and the address follows you: reload it and
+you are still where you were.
+
+Next to it is a button that hands the folder to your **file manager** — the Finder on a Mac,
+Explorer on Windows, whatever your desktop uses on Linux. Every file has the same button in the
+row above it, and there it points the file out inside its folder rather than opening it. On a
+system where k0 has no way to do that, the button stays where it is, greyed out, with the reason
+in its tooltip.
+
+### The `config` switch, beside the search
+
+The viewer lists documents. The one thing that was missing from that is **configuration**: an
+`.env` you want to check a key in, the `package.json`, a workflow's YAML. They are not documents,
+and in a repository of prose they would be noise — so they live behind a switch, the **`config`**
+button to the right of the search box.
+
+Switch it on and `.env` (and `.env.local`, and the rest of them), `.json`, `.yml`, `.yaml`,
+`.toml` and `.ini` join the listing, the name search and the search inside the text. **Including
+the ones git is told to ignore** — an `.env` is ignored by definition, and it is the file you came
+for. Code does not join: `.js`, `.py`, `.css` stay out either way.
+
+The switch is remembered, per browser. It is not a search, it is a way of working.
+
+And if you forget it is off, the search says so: when a hidden configuration file would have come
+**above** everything on screen — searching `.env` in a repository that has one — a line appears at
+the top of the results saying how many, and clicking it turns the switch on. Only then: a hidden
+file that merely matches somewhere does not raise it, or the line would be there on every search
+and you would stop seeing it.
+
+Each of them opens as the kind of thing it is:
+
+- a **JSON** file becomes a tree that folds, coloured by type, with the first two levels open;
+- an **.env** becomes a table of names and values, comments and all;
+- **YAML, TOML and INI** keep their shape, with keys, values and comments told apart by colour.
+
+A JSON tree has its **own search box**, and that is not a duplicate of the browser's: the
+browser's find does not look inside a branch that is closed, so on a folded tree ⌘F says "not
+found" for something three lines away. This one counts what it found and opens the branches
+holding it.
+
+### Editing a file
+
+Configuration and notes can be changed from here: `.env` and the rest of the configuration above,
+plus `.md` and `.txt`. Click the **pencil** in the row above the document and the file becomes a
+text box as tall as the pane — not a small window over it, because a README does not fit in one.
+**Save** (or ⌘/Ctrl+S) writes it; **Cancel** goes back to what is on disk.
+
+Nothing else is editable: no code, no PDFs, no images, and no creating or deleting files. That is
+what you opened the repository with Claude for.
+
+If the file **changed on disk** while you were editing — a session wrote it, or you did, in
+another window — the save stops and says so, and what you typed stays where it is. k0 will not
+quietly write over somebody else's work.
+
 ### Pasting a chunk of chat
 
 There is a way to reach files that does not go through searching for them. When a session ends,
@@ -837,7 +909,8 @@ server/
   mode.js        the four modes: how awake to keep the machine, and whether the text goes large
   projects.js    the repositories, in the order you last used them
   sessions.js    digs already-lived sessions out of the transcripts, to import as cards
-  files.js       the only one that reads the projects' disk: what is there, what changed, what it says
+  files.js       the only one that reads the projects' disk — and the only one that writes back
+                 into it: what is there, what changed, what it says, and the one small write
   machine.js     the only one that looks at processes and memory: what it all costs, and who is costing it
   pdf.js         the document on paper, printed by a headless browser
 web/             the three pages (html, css, js served exactly as they are)
@@ -853,6 +926,8 @@ web/             the three pages (html, css, js served exactly as they are)
   fuzzy.js       searching the names: the letters you type, in the order you type them
   mentions.js    which of a repository's files a piece of text names
   refs.js        what a name written inside a document points at, and which of the nine READMEs
+  json.js        a JSON file as a tree that folds, and the search that opens the right branches
+  conf.js        an .env as the table it always was, and YAML/TOML/INI with their parts told apart
 .claude/skills/
   k0-import/     the skill that fills the board with sessions you have already had
   k0-changelog/  the one that turns the facts of a stretch of work into something readable. k0
@@ -871,6 +946,12 @@ test/            npm test — Node's own runner, no framework. See docs/testing.
 
 ### What it reads, and what it never does
 
+k0 reads your repositories. It writes into one of them in exactly one place: the pencil in the
+file viewer, on a configuration file or a note that is already there. That write is deliberately
+narrow — no code, no new files, no deletions — it carries the file's own permissions across, it
+lands as a rename so an interrupted save leaves the old file whole, and it refuses outright if the
+file has changed on disk since the page read it.
+
 k0 does not emulate a terminal and installs no hooks. It reads two things Claude Code already
 writes for itself:
 
@@ -984,11 +1065,12 @@ The full picture, and how to report a problem privately, is in [SECURITY.md](SEC
 
 ## What is not here yet
 
-Checkboxes inside a card. In the viewer only documents are listed: code opens if you arrive at it
-from a link, but it is not browsable and the text search does not look at it. Files are read only:
-they are not edited, not diffed, and you cannot talk to them — for that you open the repository
-with Claude. Sessions opened by hand outside k0 are picked up with `/k0-import`, on request:
-nothing notices them by itself yet.
+Checkboxes inside a card. In the viewer the listing is documents and configuration: code opens if
+you arrive at it from a link, but it is not browsable and the text search does not look at it.
+Only configuration and notes can be edited, one file at a time — nothing is diffed, no file is
+created or deleted, and you cannot talk to them; for that you open the repository with Claude.
+Sessions opened by hand outside k0 are picked up with `/k0-import`, on request: nothing notices
+them by itself yet.
 
 ## Contributing
 

package/bin/k0-board.js

@@ -418,6 +418,8 @@ async function doctor() {
     ['read the kernel memory-pressure verdict', capabilities.metrics.pressure],
     ['start at login', capabilities.service.autostart],
     ['show a tray icon', capabilities.tray],
+    ['show a file in the file manager', capabilities.revealInFileManager],
+    ['open a folder in the file manager', capabilities.openInFileManager],
   ]
   for (const [what, yes] of rows) (yes ? ok : warn)(what)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "k0-board",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "A board of sticky notes that drives your Claude Code sessions",
   "keywords": [
     "claude-code",

package/platform/contract.js

@@ -40,7 +40,8 @@
  * @property {object} service
  * @property {boolean} service.autostart             can register a service that starts at login
  * @property {boolean} tray                          a menu bar / system tray icon is available
- * @property {boolean} revealInFileManager
+ * @property {boolean} revealInFileManager           can show a file selected in the file manager
+ * @property {boolean} openInFileManager             can open a directory in the file manager
  */
 
 /**
@@ -55,6 +56,7 @@ export const NO_CAPABILITIES = {
   service: { autostart: false },
   tray: false,
   revealInFileManager: false,
+  openInFileManager: false,
 }
 
 /**
@@ -133,6 +135,10 @@ export const NO_CAPABILITIES = {
 /**
  * @typedef {object} ShellAdapter
  * @property {(absPath: string) => Promise<unknown>} revealInFileManager
+ *   Shows the file in its own folder, selected. A folder handed to this gets selected in its
+ *   parent, which is the neighbouring thing and not the same one.
+ * @property {(absDir: string) => Promise<unknown>} openInFileManager
+ *   Opens the directory itself, so you are looking at what is inside it.
  * @property {(url: string) => Promise<unknown>} openBrowser
  * @property {() => string|null} findChrome        a Chromium-family browser able to print
  * @property {() => Set<string>} homeSkipList      directories under $HOME that are never projects

package/platform/darwin/index.js

@@ -18,6 +18,7 @@ export const capabilities = {
   service: service.capabilities,
   tray: true,
   revealInFileManager: true,
+  openInFileManager: true,
 }
 
 /**

package/platform/darwin/shell.js

@@ -7,6 +7,9 @@ const OPEN = () => which('open', ['/usr/bin/open'])
 
 export const revealInFileManager = (abs) => run(OPEN(), ['-R', abs], { timeout: 4000 })
 
+/** Without `-R` the Finder opens the directory instead of picking it out in the one above. */
+export const openInFileManager = (abs) => run(OPEN(), [abs], { timeout: 4000 })
+
 export const openBrowser = (url) => run(OPEN(), [url], { timeout: 4000 })
 
 /**
@@ -56,4 +59,4 @@ export function findClaude() {
   return claudeBin
 }
 
-export const capabilities = { revealInFileManager: true }
+export const capabilities = { revealInFileManager: true, openInFileManager: true }

package/platform/index.js

@@ -65,6 +65,7 @@ const unsupported = {
   },
   shell: {
     revealInFileManager: async () => {},
+    openInFileManager: async () => {},
     openBrowser: async () => {},
     findChrome: () => null,
     homeSkipList: () => new Set(),

package/platform/linux/index.js

@@ -24,6 +24,7 @@ export const capabilities = {
   service: service.capabilities(),
   tray: !!which('python3'),
   revealInFileManager: shell.capabilities().revealInFileManager,
+  openInFileManager: shell.capabilities().openInFileManager,
 }
 
 export const notes = {
@@ -61,6 +62,16 @@ export const notes = {
           'Neither ss nor lsof was found, so k0 cannot see which port a dev server is listening ' +
           'on. Install iproute2 (for ss) and the globe will know where to send you.',
       }),
+  ...(capabilities.openInFileManager
+    ? {}
+    : {
+        revealInFileManager:
+          'xdg-open was not found, so k0 has no way to hand a file or a folder to your file ' +
+          'manager. Install xdg-utils and the button will work.',
+        openInFileManager:
+          'xdg-open was not found, so k0 has no way to hand a file or a folder to your file ' +
+          'manager. Install xdg-utils and the button will work.',
+      }),
   ...(capabilities.servers.adopt
     ? {}
     : {

package/platform/linux/shell.js

@@ -31,6 +31,15 @@ export async function revealInFileManager(abs) {
   if (open) await runQuiet(open, [path.dirname(abs)])
 }
 
+/**
+ * Opening a directory needs none of the dance above: every desktop that has a file manager at
+ * all hands a directory to it through xdg-open.
+ */
+export async function openInFileManager(abs) {
+  const open = XDG_OPEN()
+  if (open) await runQuiet(open, [abs])
+}
+
 export const openBrowser = (url) => run(XDG_OPEN(), [url], { timeout: 4000 })
 
 const CHROME_CANDIDATES = [
@@ -94,4 +103,4 @@ export function findClaude() {
   return claudeBin
 }
 
-export const capabilities = () => ({ revealInFileManager: !!XDG_OPEN() })
+export const capabilities = () => ({ revealInFileManager: !!XDG_OPEN(), openInFileManager: !!XDG_OPEN() })

package/platform/win32/index.js

@@ -24,6 +24,7 @@ export const capabilities = {
   service: service.capabilities(),
   tray: hasPowerShell(),
   revealInFileManager: true,
+  openInFileManager: true,
 }
 
 export const notes = {

package/platform/win32/shell.js

@@ -8,6 +8,9 @@ const EXPLORER = () => which('explorer') || 'explorer.exe'
 /** `explorer /select,` opens the folder with the file already highlighted. */
 export const revealInFileManager = (abs) => runQuiet(EXPLORER(), [`/select,${path.normalize(abs)}`])
 
+/** The same command without `/select,` opens the folder itself. */
+export const openInFileManager = (abs) => runQuiet(EXPLORER(), [path.normalize(abs)])
+
 export const openBrowser = (url) => runQuiet('cmd', ['/c', 'start', '', url])
 
 const programFiles = [
@@ -61,4 +64,4 @@ export function findClaude() {
   return claudeBin
 }
 
-export const capabilities = () => ({ revealInFileManager: true })
+export const capabilities = () => ({ revealInFileManager: true, openInFileManager: true })

package/server/files.js

@@ -36,6 +36,29 @@ const DOC_EXT = new Set([
 
 export const isDoc = (p) => DOC_EXT.has(path.extname(p).toLowerCase())
 
+// The other half of what is worth listing: the files that say how a project is set up. They are
+// not documents — nobody prints an `.env` — but they are the ones you go looking for by hand, and
+// until now the viewer was the only place in k0 you could not reach them from. They stay behind a
+// switch in the page, because in a repository of prose they would only be noise.
+const CONFIG_EXT = new Set(['.json', '.yml', '.yaml', '.toml', '.ini', '.cfg', '.conf'])
+
+// `.env.local` has extension `.local`, and `.env` has no extension at all: this rule reads the
+// name, not the end of it, or the commonest file of the lot would be the one that got away.
+const ENV_NAME = /^\.env(\..+)?$/
+
+export const isConfig = (p) =>
+  CONFIG_EXT.has(path.extname(p).toLowerCase()) || ENV_NAME.test(path.basename(p))
+
+/** Everything the listing carries: documents to read, configuration to check. */
+export const isListed = (p) => isDoc(p) || isConfig(p)
+
+// What can be written back from the page. Configuration, and the notes kept next to it — never
+// code: k0 is not an editor, and a `.js` changed in a browser tab with no undo and no syntax
+// check is a good way to break a project without noticing.
+const NOTE_EXT = new Set(['.md', '.markdown', '.mdx', '.txt'])
+
+export const isEditable = (p) => NOTE_EXT.has(path.extname(p).toLowerCase()) || isConfig(p)
+
 // ── What kind of file is this ─────────────────────────────────────────────────
 const MARKDOWN = new Set(['.md', '.markdown', '.mdx'])
 
@@ -213,7 +236,17 @@ const cache = new Map()
  */
 async function scan(root) {
   const names = hasGit() && fs.existsSync(path.join(root, '.git')) ? await tracked(root) : null
-  return { git: !!names, ...(names ? withStats(root, names) : walk(root)) }
+  if (!names) return { git: false, ...walk(root, isListed) }
+
+  // git's listing is missing exactly the file all this was built for: an `.env` is ignored by
+  // definition, so `ls-files -co --exclude-standard` will never name it. So the disk is walked a
+  // second time for configuration alone — a handful of names, under the same bounds as the other
+  // walk — and what git already gave is kept as it is.
+  const fromGit = withStats(root, names)
+  const seen = new Set(fromGit.files.map((f) => f.p))
+  const extra = walk(root, isConfig)
+  for (const f of extra.files) if (!seen.has(f.p)) fromGit.files.push(f)
+  return { git: true, files: fromGit.files, truncated: fromGit.truncated || extra.truncated }
 }
 
 const tracked = (root) =>
@@ -226,14 +259,14 @@ function withStats(root, names) {
   const files = []
   let truncated = false
   for (const p of names) {
-    if (!isDoc(p)) continue
+    if (!isListed(p)) continue
     if (files.length >= MAX_FILES) {
       truncated = true
       break
     }
     try {
       const s = fs.statSync(path.join(root, p))
-      if (s.isFile()) files.push({ p, m: Math.floor(s.mtimeMs), s: s.size })
+      if (s.isFile()) files.push(entry(p, s))
     } catch {
       /* deleted between the listing and now */
     }
@@ -241,7 +274,18 @@ function withStats(root, names) {
   return { files, truncated }
 }
 
-function walk(root) {
+/**
+ * One row of the listing. `c` marks a configuration file, so the page can leave it out without
+ * having to ask a second time: one byte on the wire, one switch on the other side.
+ */
+const entry = (p, s) => {
+  const row = { p, m: Math.floor(s.mtimeMs), s: s.size }
+  if (isConfig(p)) row.c = 1
+  return row
+}
+
+/** Everything under `root` that `pick` accepts. */
+function walk(root, pick) {
   const files = []
   let truncated = false
 
@@ -258,18 +302,20 @@ function walk(root) {
         truncated = true
         return
       }
-      if (e.name.startsWith('.')) continue
+      // A directory whose name starts with a dot is skipped whole: that one rule removes .git,
+      // the caches and the virtual environments in a single stroke. A dotted *file* is not —
+      // `.env` is a dotted name, and it is the one this walk was taught to find.
       const child = path.join(dir, e.name)
       const childRel = rel ? `${rel}/${e.name}` : e.name
       if (e.isDirectory()) {
-        if (!SKIP.has(e.name)) rec(child, childRel, depth + 1)
+        if (!e.name.startsWith('.') && !SKIP.has(e.name)) rec(child, childRel, depth + 1)
         continue
       }
       // No symbolic links: a loop would send the walk round forever.
-      if (!e.isFile() || !isDoc(e.name)) continue
+      if (!e.isFile() || !pick(e.name)) continue
       try {
         const s = fs.statSync(child)
-        files.push({ p: childRel, m: Math.floor(s.mtimeMs), s: s.size })
+        files.push(entry(childRel, s))
       } catch {
         /* gone in the meantime */
       }
@@ -392,9 +438,9 @@ export async function changed(root, headAtStart) {
           .catch(() => []) // the starting commit may not be there any more
       : [],
   ])
-  // Documents only here too: a "Changed 40" made of `.tsx` files would say there are forty
-  // things to read, when there is nothing to read at all.
-  return [...new Set([...now, ...mine])].filter(isDoc)
+  // What the listing carries, here too: a "Changed 40" made of `.tsx` files would say there are
+  // forty things to read, when there is nothing to read at all.
+  return [...new Set([...now, ...mine])].filter(isListed)
 }
 
 // ── Searching inside the files ────────────────────────────────────────────────
@@ -406,6 +452,8 @@ export async function changed(root, headAtStart) {
 // of a few KB, all already in the operating system's cache — it costs less than keeping an
 // index up to date, and an index goes stale.
 const TEXTY = new Set(['.md', '.markdown', '.mdx', '.txt', '.html', '.htm'])
+/** Read only when the page asks for them: they are hidden by default, and so are their lines. */
+const TEXTY_CONFIG = new Set(['.json', '.yml', '.yaml', '.toml', '.ini', '.cfg', '.conf'])
 const GREP_FILES = 80 // how many results are enough: past that nobody scrolls anyway
 const GREP_BYTES = 1 << 20
 const SNIPPET = 200
@@ -421,8 +469,13 @@ export const plain = (s) =>
     .toLowerCase()
     .replace(/[\u00C0-\u024F]/g, (c) => c.normalize('NFD')[0])
 
-/** The documents that contain all the words searched for, with the line they appear on. */
-export async function grep(root, query) {
+/**
+ * The documents that contain all the words searched for, with the line they appear on.
+ *
+ * With `nerd` the configuration files are looked inside as well. It has to follow what the page
+ * is showing: finding a line in a file the listing is hiding would be a result you cannot open.
+ */
+export async function grep(root, query, nerd = false) {
   const words = plain(query).split(/\s+/).filter(Boolean)
   if (!words.length) return []
 
@@ -430,7 +483,10 @@ export async function grep(root, query) {
   const hits = []
   for (const f of files) {
     if (hits.length >= GREP_FILES) break
-    if (!TEXTY.has(path.extname(f.p).toLowerCase()) || f.s > GREP_BYTES) continue
+    if (f.c && !nerd) continue
+    const ext = path.extname(f.p).toLowerCase()
+    const texty = TEXTY.has(ext) || (nerd && (TEXTY_CONFIG.has(ext) || ENV_NAME.test(path.basename(f.p))))
+    if (!texty || f.s > GREP_BYTES) continue
     let text
     try {
       text = fs.readFileSync(path.join(root, f.p), 'utf8')
@@ -484,5 +540,40 @@ export function read(abs) {
   return { kind, ...meta, text, truncated }
 }
 
+/**
+ * Writes the file back, or refuses.
+ *
+ * `was` is the modification time the page was handed when it opened the file. If the file on disk
+ * has moved on since, the write does not happen: somebody else — a session, an editor, a script —
+ * has written it in the meantime, and overwriting silently would throw their work away. The page
+ * is told, and it still has what you typed.
+ *
+ * The bytes go to a neighbouring name and are then renamed over the original, which on the same
+ * filesystem is one indivisible step: an interrupted save leaves the old file whole rather than
+ * half the new one. The mode is carried over, or a `.env` at 600 would come back readable by all.
+ */
+export function write(abs, text, was) {
+  const s = fs.statSync(abs)
+  if (!s.isFile()) throw new Error('Not a file')
+  if (Math.floor(s.mtimeMs) !== was) {
+    const clash = new Error('This file changed on disk while you were editing it. Nothing was saved.')
+    clash.conflict = true
+    throw clash
+  }
+  const tmp = `${abs}.k0-tmp`
+  try {
+    fs.writeFileSync(tmp, text, { mode: s.mode & 0o777 })
+    fs.renameSync(tmp, abs)
+  } catch (e) {
+    fs.rmSync(tmp, { force: true })
+    throw e
+  }
+  const now = fs.statSync(abs)
+  return { size: now.size, mtime: Math.floor(now.mtimeMs) }
+}
+
 /** Show it in the file manager: the only way to open what cannot be shown here. */
 export const reveal = (abs) => shell.revealInFileManager(abs)
+
+/** A folder is opened rather than pointed at: what you want is to be inside it. */
+export const openFolder = (abs) => shell.openInFileManager(abs)