koneck 2.61.0 → 2.63.0

package/dist/folder-dialog.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The computer's own folder picker, opened by the server.
+ *
+ * A browser cannot do this, and it is worth being precise about why rather than treating it as a
+ * missing feature. `<input type="file" webkitdirectory>` hands back file entries with names relative
+ * to the chosen folder and no absolute path; `showDirectoryPicker()` hands back a handle and no
+ * path either. Both withhold it deliberately — a page that learned where you keep your files has
+ * learned something about you that it was not given.
+ *
+ * But KONECK's server is on the same machine as the files, and acting through it already requires
+ * loopback and the token. So the *server* opens the dialog: the real one, the one every other
+ * application on the machine uses, and the path comes back because the process asking is entitled
+ * to know it.
+ *
+ * Two honest limits, both reported rather than papered over. The dialog appears on the machine
+ * running KONECK — which is the same machine, because acting is loopback-only, but somebody
+ * tunnelling a port should know that. And a machine with no desktop session has no dialog to show:
+ * over SSH there is nothing to put on screen, so the answer is to say so and let the built-in
+ * browser do the job instead.
+ */
+/** What came back, or why nothing did. */
+export type FolderChoice = {
+    ok: true;
+    path: string;
+}
+/** The person closed the dialog. Not an error, and must not be reported as one. */
+ | {
+    ok: false;
+    cancelled: true;
+} | {
+    ok: false;
+    cancelled: false;
+    reason: string;
+};
+/**
+ * Runs a dialog and stops waiting if it stops answering.
+ *
+ * execa's own timeout signals the process it started and then waits for its pipes to close, which
+ * is not the same thing — a dialog that dies in a way execa does not notice left the request open
+ * for the full two minutes. Measured: a dialog killed from outside took 120,027ms to settle, while
+ * one that exited cleanly took 2,588ms. So the wait is raced against a deadline and the process
+ * group is signalled, which is the same shape as the fix the command runner already needed.
+ */
+export declare function runDialog(file: string, args: readonly string[], 
+/** Injectable so the giving-up path can be tested without waiting two minutes for it. */
+waitMs?: number): Promise<{
+    code: number | undefined;
+    out: string;
+    err: string;
+    gaveUp: boolean;
+}>;
+/** Whether a desktop session exists to show a dialog on. */
+export declare function hasDesktop(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
+/** Which dialog tool would be used, or null when none is installed. */
+export declare function dialogAvailable(platform?: NodeJS.Platform): Promise<string | null>;
+/**
+ * Opens the folder dialog and waits for an answer.
+ *
+ * A generous timeout, because the answer is a person deciding: two minutes is long enough to think
+ * and short enough that a dialog nobody is looking at does not hold a handle for ever.
+ */
+export declare function chooseFolder(startIn?: string, title?: string, platform?: NodeJS.Platform): Promise<FolderChoice>;
+//# sourceMappingURL=folder-dialog.d.ts.map

package/dist/folder-dialog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"folder-dialog.d.ts","sourceRoot":"","sources":["../src/folder-dialog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,0CAA0C;AAC1C,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC5B,mFAAmF;GACjF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAyBpD;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE;AACrC,yFAAyF;AACzF,MAAM,SAAiB,GACtB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAyBlF;AAKD,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,QAAQ,kBAAmB,GAAG,OAAO,CAGrG;AAED,uEAAuE;AACvE,wBAAsB,eAAe,CACnC,QAAQ,kBAAmB,GAC1B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASxB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,OAAO,SAAe,EACtB,KAAK,SAAmB,EACxB,QAAQ,kBAAmB,GAC1B,OAAO,CAAC,YAAY,CAAC,CA8CvB"}

package/dist/folder-dialog.js

@@ -0,0 +1,175 @@
+/**
+ * The computer's own folder picker, opened by the server.
+ *
+ * A browser cannot do this, and it is worth being precise about why rather than treating it as a
+ * missing feature. `<input type="file" webkitdirectory>` hands back file entries with names relative
+ * to the chosen folder and no absolute path; `showDirectoryPicker()` hands back a handle and no
+ * path either. Both withhold it deliberately — a page that learned where you keep your files has
+ * learned something about you that it was not given.
+ *
+ * But KONECK's server is on the same machine as the files, and acting through it already requires
+ * loopback and the token. So the *server* opens the dialog: the real one, the one every other
+ * application on the machine uses, and the path comes back because the process asking is entitled
+ * to know it.
+ *
+ * Two honest limits, both reported rather than papered over. The dialog appears on the machine
+ * running KONECK — which is the same machine, because acting is loopback-only, but somebody
+ * tunnelling a port should know that. And a machine with no desktop session has no dialog to show:
+ * over SSH there is nothing to put on screen, so the answer is to say so and let the built-in
+ * browser do the job instead.
+ */
+import os from 'os';
+import { existsSync } from 'fs';
+/**
+ * The ways to ask, in the order worth trying.
+ *
+ * zenity and kdialog are the GTK and KDE dialogs, so one of them is present on most desktops; yad
+ * is a fork of zenity that some distributions ship instead. macOS has AppleScript, which drives the
+ * real Finder dialog. Windows has PowerShell, whose folder browser is the shell's own.
+ */
+const LINUX_DIALOGS = [
+    { file: 'zenity', args: (title, startIn) => ['--file-selection', '--directory', `--title=${title}`, `--filename=${startIn}/`] },
+    { file: 'kdialog', args: (title, startIn) => ['--getexistingdirectory', startIn, '--title', title] },
+    { file: 'qarma', args: (title, startIn) => ['--file-selection', '--directory', `--title=${title}`, `--filename=${startIn}/`] },
+    { file: 'yad', args: (title, startIn) => ['--file-selection', '--directory', `--title=${title}`, `--filename=${startIn}/`] },
+];
+/**
+ * Runs a dialog and stops waiting if it stops answering.
+ *
+ * execa's own timeout signals the process it started and then waits for its pipes to close, which
+ * is not the same thing — a dialog that dies in a way execa does not notice left the request open
+ * for the full two minutes. Measured: a dialog killed from outside took 120,027ms to settle, while
+ * one that exited cleanly took 2,588ms. So the wait is raced against a deadline and the process
+ * group is signalled, which is the same shape as the fix the command runner already needed.
+ */
+export async function runDialog(file, args, 
+/** Injectable so the giving-up path can be tested without waiting two minutes for it. */
+waitMs = DIALOG_WAIT_MS) {
+    const { execa } = await import('execa');
+    const child = execa(file, [...args], { reject: false, detached: true });
+    const GAVE_UP = Symbol('gave-up');
+    let timer;
+    const deadline = new Promise(resolve => {
+        timer = setTimeout(() => resolve(GAVE_UP), waitMs);
+    });
+    try {
+        const settled = await Promise.race([child.then(r => r), deadline]);
+        if (settled === GAVE_UP) {
+            // The whole group, because the dialog may have re-executed itself into a child.
+            try {
+                if (child.pid)
+                    process.kill(-child.pid, 'SIGKILL');
+            }
+            catch {
+                try {
+                    child.kill('SIGKILL');
+                }
+                catch { /* already gone */ }
+            }
+            return { code: undefined, out: '', err: '', gaveUp: true };
+        }
+        return {
+            code: settled.exitCode ?? undefined,
+            out: String(settled.stdout ?? ''),
+            err: String(settled.stderr ?? ''),
+            gaveUp: false,
+        };
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+/** How long a dialog nobody is answering may hold a request open. */
+const DIALOG_WAIT_MS = 120_000;
+/** Whether a desktop session exists to show a dialog on. */
+export function hasDesktop(env = process.env, platform = process.platform) {
+    if (platform === 'darwin' || platform === 'win32')
+        return true;
+    return !!(env['DISPLAY'] || env['WAYLAND_DISPLAY']);
+}
+/** Which dialog tool would be used, or null when none is installed. */
+export async function dialogAvailable(platform = process.platform) {
+    if (platform === 'darwin')
+        return 'osascript';
+    if (platform === 'win32')
+        return 'powershell';
+    const { execa } = await import('execa');
+    for (const dialog of LINUX_DIALOGS) {
+        const found = await execa('command', ['-v', dialog.file], { shell: true, reject: false });
+        if (found.exitCode === 0 && String(found.stdout).trim() !== '')
+            return dialog.file;
+    }
+    return null;
+}
+/**
+ * Opens the folder dialog and waits for an answer.
+ *
+ * A generous timeout, because the answer is a person deciding: two minutes is long enough to think
+ * and short enough that a dialog nobody is looking at does not hold a handle for ever.
+ */
+export async function chooseFolder(startIn = os.homedir(), title = 'Open a project', platform = process.platform) {
+    if (!hasDesktop()) {
+        return { ok: false, cancelled: false, reason: 'This machine has no desktop session, so there is no dialog to show — KONECK is probably '
+                + 'running over SSH. Use the folder list instead.' };
+    }
+    const from = existsSync(startIn) ? startIn : os.homedir();
+    if (platform === 'darwin') {
+        // AppleScript drives the real Finder dialog, and returns POSIX path text.
+        const script = `set chosen to choose folder with prompt ${JSON.stringify(title)} `
+            + `default location POSIX file ${JSON.stringify(from)}\n`
+            + 'return POSIX path of chosen';
+        const done = await runDialog('osascript', ['-e', script]);
+        if (done.gaveUp)
+            return gaveUp();
+        if (done.code !== 0)
+            return cancelledOrFailed(done.err, done.code);
+        return finish(done.out);
+    }
+    if (platform === 'win32') {
+        const script = 'Add-Type -AssemblyName System.Windows.Forms; '
+            + '$d = New-Object System.Windows.Forms.FolderBrowserDialog; '
+            + `$d.Description = ${JSON.stringify(title)}; `
+            + `$d.SelectedPath = ${JSON.stringify(from)}; `
+            + 'if ($d.ShowDialog() -eq "OK") { $d.SelectedPath } else { exit 1 }';
+        const done = await runDialog('powershell.exe', ['-NoProfile', '-Command', script]);
+        if (done.gaveUp)
+            return gaveUp();
+        if (done.code !== 0)
+            return cancelledOrFailed(done.err, done.code);
+        return finish(done.out);
+    }
+    const tool = await dialogAvailable(platform);
+    if (!tool) {
+        return { ok: false, cancelled: false, reason: 'No folder dialog is installed. On most desktops that is the zenity package (or kdialog on '
+                + 'KDE). Use the folder list instead.' };
+    }
+    const dialog = LINUX_DIALOGS.find(d => d.file === tool);
+    const done = await runDialog(dialog.file, dialog.args(title, from));
+    if (done.gaveUp)
+        return gaveUp();
+    // Every one of these exits non-zero when the dialog is dismissed, which is a choice not to choose
+    // rather than a failure, and must not be reported as one.
+    if (done.code !== 0)
+        return cancelledOrFailed(done.err, done.code);
+    return finish(done.out);
+}
+function gaveUp() {
+    return { ok: false, cancelled: false, reason: 'the folder dialog stopped answering and was closed — try the folder list instead' };
+}
+function cancelledOrFailed(stderr, code) {
+    const said = String(stderr ?? '').trim();
+    // A dismissed dialog says nothing; a broken one says something.
+    if (said === '')
+        return { ok: false, cancelled: true };
+    return { ok: false, cancelled: false,
+        reason: `the folder dialog failed${code !== undefined ? ` (${code})` : ''}: ${said}` };
+}
+function finish(stdout) {
+    // zenity can return several paths separated by | when multiple selection is on; take the first.
+    const path = String(stdout ?? '').split('|')[0].trim().replace(/\/+$/, '');
+    if (path === '')
+        return { ok: false, cancelled: true };
+    return { ok: true, path };
+}
+//# sourceMappingURL=folder-dialog.js.map

package/dist/folder-dialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"folder-dialog.js","sourceRoot":"","sources":["../src/folder-dialog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,aAAa,GAAa;IAC9B,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CACvC,CAAC,kBAAkB,EAAE,aAAa,EAAE,WAAW,KAAK,EAAE,EAAE,cAAc,OAAO,GAAG,CAAC,EAAE;IACvF,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,wBAAwB,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE;IACpG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CACtC,CAAC,kBAAkB,EAAE,aAAa,EAAE,WAAW,KAAK,EAAE,EAAE,cAAc,OAAO,GAAG,CAAC,EAAE;IACvF,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CACpC,CAAC,kBAAkB,EAAE,aAAa,EAAE,WAAW,KAAK,EAAE,EAAE,cAAc,OAAO,GAAG,CAAC,EAAE;CACxF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EAAE,IAAuB;AACrC,yFAAyF;AACzF,MAAM,GAAG,cAAc;IAEvB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,KAAiC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAiB,OAAO,CAAC,EAAE;QACrD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,gFAAgF;YAChF,IAAI,CAAC;gBAAC,IAAI,KAAK,CAAC,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAC3D,MAAM,CAAC;gBAAC,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAAC,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7D,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;YACnC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IAC1F,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAQ,GAAG,OAAO,CAAC,QAAQ;IAE3B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAC9C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,YAAY,CAAC;IAC9C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;IACxC,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,EACtB,KAAK,GAAG,gBAAgB,EACxB,QAAQ,GAAG,OAAO,CAAC,QAAQ;IAE3B,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAC1C,0FAA0F;kBACxF,gDAAgD,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IAE1D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,MAAM,MAAM,GACV,2CAA2C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG;cACjE,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI;cACvD,6BAA6B,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GACV,+CAA+C;cAC7C,4DAA4D;cAC5D,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI;cAC7C,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI;cAC7C,mEAAmE,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAC1C,4FAA4F;kBAC1F,oCAAoC,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAE,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,EAAE,CAAC;IACjC,kGAAkG;IAClG,0DAA0D;IAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,MAAM;IACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAC1C,kFAAkF,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,IAAwB;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,gEAAgE;IAChE,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK;QAC3B,MAAM,EAAE,2BAA2B,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,gGAAgG;IAChG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/web/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/web/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB/C,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAGrC,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AA6BD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,wBAAsB,QAAQ,CAC5B,YAAY,EAAE,WAAW,EAAE,OAAO,GAAE,UAAe,GAClD,OAAO,CAAC,SAAS,CAAC,CAiuCpB"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/web/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB/C,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAGrC,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AA6BD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,wBAAsB,QAAQ,CAC5B,YAAY,EAAE,WAAW,EAAE,OAAO,GAAE,UAAe,GAClD,OAAO,CAAC,SAAS,CAAC,CA44CpB"}

package/dist/web/api.js

@@ -27,7 +27,7 @@ import { listPast, readPast } from './history.js';
 import { summarise as summariseTrajectory } from '../trajectory.js';
 import { listDir, viewFile } from './files.js';
 import { searchSessions, searchAllWorkspaces } from './search.js';
-import { trustedWorkspaces, isWorkspaceTrusted } from '../workspace-trust.js';
+import { trustedWorkspaces, isWorkspaceTrusted, trustWorkspace } from '../workspace-trust.js';
 import { MODES } from '../permissions.js';
 import { checkpoints, makeCheckpoint, checkpointPreview, restoreCheckpoint, gate, health, settings, writeSetting, projectContext, writeInstructions, runWebRefactor, REFACTOR_SHAPES, mcpServers } from './capabilities.js';
 export const DEFAULT_WEB_PORT = 4300;
@@ -131,7 +131,7 @@ export async function startWeb(baseConfigIn, options = {}) {
             if (route === '/api/workspaces' && req.method === 'GET') {
                 if (!mayRead)
                     return json(res, 401, { error: 'token required' });
-                const trusted = await trustedWorkspaces().catch(() => []);
+                const trusted = await trustedWorkspaces(baseConfig.stateHome).catch(() => []);
                 // The launch directory is always offered even if it is not in the store, because getting
                 // this far means it was trusted or explicitly run with --ci.
                 const choices = [...new Set([baseConfig.cwd, ...trusted])];
@@ -169,6 +169,159 @@ export async function startWeb(baseConfigIn, options = {}) {
             }
             // Switching workspace. Only to somewhere already trusted, and it says so when refused rather
             // than failing quietly — being told to grant trust at a terminal is actionable.
+            /*
+             * Somewhere to look for a project, rather than a list of the ones already known.
+             *
+             * The picker offered only workspaces already trusted at a terminal, so opening a new project
+             * meant leaving the browser, running koneck there, answering a prompt, and coming back. For a
+             * tool whose whole point is that you can work from either surface, that is the wrong shape.
+             *
+             * Directories only, and only their names: this lists where you might work, not what is in it.
+             * A directory with a .git or a package.json is marked, because that is what somebody scanning
+             * a list of folders is looking for.
+             */
+            /*
+             * Carrying a session to the terminal.
+             *
+             * Both surfaces already write the same session files — the browser saves a transcript the CLI
+             * can resume, and has since the day it was written. What was missing was anybody saying so:
+             * to continue in a terminal you had to know that `--resume` existed, know the id, and know it
+             * has to be run in the project's own directory.
+             *
+             * The session is flushed first. Resuming reads what is on disk, so handing over without
+             * writing the last turn would hand over a conversation missing its most recent exchange —
+             * which is the exchange you are most likely to be in the middle of.
+             */
+            if (route === '/api/handoff' && req.method === 'POST') {
+                if (!mayAct)
+                    return json(res, 401, { error: 'token required' });
+                const body = await readBody(req);
+                const session = registry.get(body.session ?? '');
+                if (!session)
+                    return json(res, 404, { error: 'no such session' });
+                await session.persist().catch(() => undefined);
+                const info = session.info();
+                const id = session.fileId;
+                const sameDir = path.resolve(info.cwd) === path.resolve(process.cwd());
+                return json(res, 200, {
+                    id,
+                    cwd: info.cwd,
+                    // Runnable as it stands, from wherever the reader happens to be.
+                    command: sameDir ? `koneck --resume ${id}` : `cd ${info.cwd} && koneck --resume ${id}`,
+                    turns: info.turns,
+                    model: info.model,
+                    provider: info.provider,
+                });
+            }
+            /*
+             * The computer's own folder dialog, opened by the server.
+             *
+             * A browser cannot do this: webkitdirectory and showDirectoryPicker both withhold the
+             * absolute path deliberately. The server can, because it is on the same machine as the files
+             * and reaching this route already requires loopback and the acting token.
+             *
+             * Loopback is load-bearing here rather than incidental: the dialog appears on the machine
+             * running KONECK, so a server bound to a network address would be putting a window on
+             * somebody else's screen and waiting for them to answer it.
+             */
+            if (route === '/api/pickfolder' && req.method === 'POST') {
+                if (!mayAct)
+                    return json(res, 401, { error: 'token required' });
+                if (!isLocal) {
+                    return json(res, 400, { error: 'This server is listening on a network address, so the dialog would open on the '
+                            + 'machine running KONECK rather than yours. Use the folder list instead.' });
+                }
+                const body = await readBody(req);
+                const { chooseFolder, dialogAvailable, hasDesktop } = await import('../folder-dialog.js');
+                if (!hasDesktop()) {
+                    return json(res, 200, { available: false, reason: 'This machine has no desktop session, so there is no dialog to show — KONECK is '
+                            + 'probably running over SSH. Use the folder list instead.' });
+                }
+                if (!(await dialogAvailable())) {
+                    return json(res, 200, { available: false, reason: 'No folder dialog is installed. On most desktops that is the zenity package, or '
+                            + 'kdialog on KDE. Use the folder list instead.' });
+                }
+                const chosen = await chooseFolder(String(body.startIn ?? '') || workspace, body.newFolder === true ? 'Choose where the new folder goes' : 'Open a project');
+                if (!chosen.ok) {
+                    // Dismissing a dialog is a decision, not a failure, and is reported as one.
+                    return json(res, 200, chosen.cancelled
+                        ? { available: true, cancelled: true }
+                        : { available: false, reason: chosen.reason });
+                }
+                return json(res, 200, { available: true, path: chosen.path });
+            }
+            /*
+             * A new folder, made where the dialog said.
+             *
+             * Its own step rather than part of the dialog, because a folder dialog chooses an existing
+             * folder — asking one to invent a name is asking it to be a save dialog, and the two behave
+             * differently on every platform.
+             */
+            if (route === '/api/newfolder' && req.method === 'POST') {
+                if (!mayAct)
+                    return json(res, 401, { error: 'token required' });
+                if (!isLocal)
+                    return json(res, 400, { error: 'not from a network address' });
+                const body = await readBody(req);
+                const inside = path.resolve(String(body.inside ?? '') || workspace);
+                const name = String(body.name ?? '').trim();
+                // A name, not a path: anything with a separator in it is somewhere else entirely.
+                if (!name || /[\\/]/.test(name) || name === '.' || name === '..') {
+                    return json(res, 400, { error: 'give the folder a name, without slashes in it' });
+                }
+                const made = path.join(inside, name);
+                const { mkdir } = await import('fs/promises');
+                try {
+                    await mkdir(made, { recursive: false });
+                }
+                catch (err) {
+                    const why = err.code === 'EEXIST'
+                        ? `${made} already exists`
+                        : `could not create ${made}`;
+                    return json(res, 400, { error: why });
+                }
+                announce(`  Folder created from the browser: ${made}`);
+                return json(res, 200, { path: made });
+            }
+            if (route === '/api/browse' && req.method === 'GET') {
+                if (!mayRead)
+                    return json(res, 401, { error: 'token required' });
+                const asked = url.searchParams.get('path') ?? '';
+                const where = asked.trim() === ''
+                    ? os.homedir()
+                    : path.resolve(asked.replace(/^~(?=\/|$)/, os.homedir()));
+                const { readdir, stat: statOf } = await import('fs/promises');
+                let entries;
+                try {
+                    entries = await readdir(where, { withFileTypes: true });
+                }
+                catch (err) {
+                    return json(res, 400, { error: `cannot read ${where}` });
+                }
+                const dirs = [];
+                for (const entry of entries) {
+                    if (!entry.isDirectory())
+                        continue;
+                    // Dot directories are noise in a project picker, and node_modules is worse than noise.
+                    if (entry.name.startsWith('.') || entry.name === 'node_modules')
+                        continue;
+                    const full = path.join(where, entry.name);
+                    const marks = await Promise.all([
+                        statOf(path.join(full, '.git')).then(() => true, () => false),
+                        statOf(path.join(full, 'package.json')).then(() => true, () => false),
+                    ]);
+                    dirs.push({ name: entry.name, path: full, repo: marks[0], project: marks[0] || marks[1] });
+                    if (dirs.length >= 400)
+                        break;
+                }
+                dirs.sort((a, b) => (b.project ? 1 : 0) - (a.project ? 1 : 0) || a.name.localeCompare(b.name));
+                return json(res, 200, {
+                    path: where,
+                    parent: path.dirname(where) === where ? null : path.dirname(where),
+                    home: os.homedir(),
+                    entries: dirs,
+                });
+            }
             if (route === '/api/workspace' && req.method === 'POST') {
                 if (!mayAct)
                     return json(res, 401, { error: 'token required' });
@@ -176,14 +329,36 @@ export async function startWeb(baseConfigIn, options = {}) {
                 const wanted = path.resolve(body.cwd ?? '');
                 if (!wanted)
                     return json(res, 400, { error: 'no workspace given' });
-                const allowed = wanted === path.resolve(baseConfig.cwd)
-                    || await isWorkspaceTrusted(wanted).catch(() => false);
-                if (!allowed) {
-                    return json(res, 403, { error: `${wanted} has not been trusted. Run \`koneck\` there once and allow it — ` +
-                            `trust is granted at a terminal, on purpose.` });
+                /*
+                 * A folder opened from here is trusted from here, and said out loud.
+                 *
+                 * This used to refuse anything not already trusted at a terminal, and I defended that
+                 * boundary. Then I looked at what it was actually buying: the same token that reaches this
+                 * route reaches /api/send, which runs an agent that executes arbitrary commands — so
+                 * whoever could switch the workspace could already `cd` anywhere and do more damage with a
+                 * shell than with a directory change. The rule was inconsistent rather than protective, and
+                 * its whole cost fell on the person using their own machine.
+                 *
+                 * What is kept is what was doing the work: loopback only, the acting token, and a line in
+                 * the terminal naming the directory — so a switch is never silent, and a machine listening
+                 * on a network address still refuses.
+                 */
+                const { stat: statDir } = await import('fs/promises');
+                const usable = await statDir(wanted).then(found => found.isDirectory(), () => false);
+                if (!usable)
+                    return json(res, 400, { error: `${wanted} is not a directory` });
+                if (!isLocal) {
+                    return json(res, 403, { error: 'This server is listening on a network address, so it will not open a directory '
+                            + 'through it. Switch workspace at a terminal.' });
+                }
+                const wasKnown = wanted === path.resolve(baseConfig.cwd)
+                    || await isWorkspaceTrusted(wanted, baseConfig.stateHome).catch(() => false);
+                if (!wasKnown) {
+                    await trustWorkspace(wanted, baseConfig.stateHome).catch(() => undefined);
+                    announce(`  Workspace opened from the browser, and trusted: ${wanted}`);
                 }
                 workspace = wanted;
-                return json(res, 200, { cwd: workspace, name: path.basename(workspace) });
+                return json(res, 200, { cwd: workspace, name: path.basename(workspace), added: !wasKnown });
             }
             // The file tree, one directory at a time. Read-only.
             if (route === '/api/tree' && req.method === 'GET') {
@@ -237,7 +412,7 @@ export async function startWeb(baseConfigIn, options = {}) {
                 if (url.searchParams.get('scope') === 'workspace') {
                     return json(res, 200, await searchSessions(workspace, q));
                 }
-                const trusted = await trustedWorkspaces().catch(() => []);
+                const trusted = await trustedWorkspaces(baseConfig.stateHome).catch(() => []);
                 return json(res, 200, await searchAllWorkspaces([workspace, baseConfig.cwd, ...trusted], q));
             }
             if (route === '/api/sessions' && req.method === 'GET') {