laneyard 0.4.1 → 0.6.0

package/dist/src/data/remove-project.js

@@ -0,0 +1,70 @@
+import { existsSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { removeProjectFromAccounts } from "../config/accounts.js";
+import { removeProjectFromConfig } from "../cli/setup.js";
+/**
+ * Removes everything Laneyard holds for one project, and reports what went.
+ *
+ * The block leaves config.yml, through the YAML document so the rest of a
+ * hand-written file is untouched; the clone is deleted; every artifact folder
+ * goes; the run history — the rows and their logs — is deleted; and the
+ * project's own secrets and signing blocks are forgotten from the vault. The
+ * history is the one thing here that cannot be made again.
+ *
+ * What it does not reach, and why each is out of scope:
+ *
+ *  - the git remote. The repository is on the host and the user's disk. It is
+ *    theirs, not Laneyard's, and nothing here reads or writes it.
+ *  - the credential originals. Laneyard removes its own encrypted copy of a
+ *    `.p8` or a keystore; the file that went in is still in the password manager
+ *    or the safe it came from.
+ *  - global secrets and global signing blocks. They are read by every project on
+ *    the machine — `vault.forget` touches only slug-scoped rows.
+ *
+ * It removes; it does not confirm and it does not shape a reply. The callers do
+ * that: the route behind a slug typed back, the CLI behind the same. The one
+ * irreversible thing must not be reachable without one of them.
+ */
+export async function removeProjectData(deps, slug) {
+    const clonePath = deps.workspacePath(slug);
+    // Read before anything is touched. -1 is SQLite's "no limit": every run of the
+    // project, because each one names an artifact folder and a log file to remove.
+    const runs = deps.runs.listByProject(slug, -1);
+    // The config block first: once it is gone the project cannot be started, so
+    // nothing new begins reading the files the rest of this is about to remove.
+    const removed = await removeProjectFromConfig(deps.configPath, slug);
+    if (!removed) {
+        return { found: false, runs: 0, artifacts: 0, workspace: false, clonePath, secrets: 0, signingBlocks: 0 };
+    }
+    // The slug also leaves every account's grants, in the same file: a grant onto
+    // a project that no longer exists is dead data, and a slug re-used later must
+    // not silently inherit it.
+    await removeProjectFromAccounts(deps.configPath, slug);
+    await deps.reloadConfig();
+    // The clone.
+    const workspace = existsSync(clonePath);
+    await rm(clonePath, { recursive: true, force: true });
+    // The artifacts and the logs, one of each per run that produced them.
+    let artifacts = 0;
+    for (const run of runs) {
+        const dir = deps.artifactsDir(run.id);
+        if (existsSync(dir))
+            artifacts += 1;
+        await rm(dir, { recursive: true, force: true });
+        await deps.logs.remove(run.id);
+    }
+    // The run history: the rows, and their steps and artifact records by cascade.
+    deps.runs.removeByProject(slug);
+    // The project's own secrets and signing blocks. Slug-scoped only: a global
+    // secret three other projects read is not this one's to take.
+    const forgotten = deps.vault.forget(slug);
+    return {
+        found: true,
+        runs: runs.length,
+        artifacts,
+        workspace,
+        clonePath,
+        secrets: forgotten.secrets,
+        signingBlocks: forgotten.credentials,
+    };
+}

package/dist/src/db/runs.js

@@ -39,6 +39,17 @@ export class RunStore {
             .all(slug, limit);
         return rows.map(toRun);
     }
+    /**
+     * Deletes every run of a project, and returns how many rows went.
+     *
+     * The steps and the artifact records go with them, by the `ON DELETE CASCADE`
+     * on their foreign keys — with `foreign_keys = ON`, which `openDatabase` sets.
+     * The log files and the artifact folders live on disk, not here: the caller
+     * removes those, which is why it reads the run ids before calling this.
+     */
+    removeByProject(slug) {
+        return this.db.prepare("DELETE FROM run WHERE project_slug = ?").run(slug).changes;
+    }
     setStatus(id, status) {
         this.db.prepare("UPDATE run SET status = ? WHERE id = ?").run(status, id);
     }

package/dist/src/fastfile/adoption.js

@@ -0,0 +1,142 @@
+import { defaultVarNames } from "../credentials/kinds.js";
+/** Which action arguments name a credential file, and which block they mean. */
+const FILE_ARGS = [
+    { action: /^app_store_connect_api_key$/, arg: "key_filepath", kind: "apple_asc" },
+    { action: /^(supply|upload_to_play_store|validate_play_store_json_key)$/, arg: "json_key", kind: "play_service_account" },
+];
+/**
+ * Arguments holding a credential's *contents* inline, and the argument they
+ * must become.
+ *
+ * The rename is not cosmetic. `materialise.ts` stores a block as a file and
+ * exports its *path*; there is no slot that exports contents. Replacing the
+ * value alone would hand a filesystem path to an argument expecting PEM text,
+ * and fastlane's complaint would point nowhere near here.
+ */
+const INLINE_ARGS = [
+    { action: /^app_store_connect_api_key$/, arg: "key_content", becomes: "key_filepath", kind: "apple_asc" },
+    { action: /^(supply|upload_to_play_store)$/, arg: "json_key_data", becomes: "json_key", kind: "play_service_account" },
+];
+/** What a literal secret looks like when nothing more specific matched. */
+const SECRET_ARG = /(^|_)(token|password|secret|api_key|url)$/;
+/** `AuthKey_<KEY ID>.p8` is the name fastlane's own documentation uses. */
+const P8_KEY_ID = /(?:^|\/)AuthKey_([A-Z0-9]+)\.p8$/;
+/**
+ * Turns what a Fastfile literally says into what could be done about it.
+ *
+ * Pure, and deliberately so: every judgement about credentials is here, in one
+ * function, beside the one table that describes them. `ruby/scan.rb` reports
+ * what the file says and knows nothing of any of this.
+ *
+ * The order of the three passes is the order of confidence. A `json_key`
+ * pointing at a literal path is unambiguous; an `api_token` holding a literal
+ * might be a real token or might be a placeholder, so it falls through to the
+ * unchecked tier rather than being claimed by a rule that was almost right.
+ */
+export function proposalsFor(literals) {
+    const out = [];
+    // The App Store Connect identifiers written inline, to be carried by whatever
+    // proposal creates the `apple_asc` block. Attributed by action alone: the
+    // literals arrive as a flat list with no call identity, and the vault holds
+    // one `apple_asc` block per project — so a second `app_store_connect_api_key`
+    // call's key is already unrepresentable, and gathering both calls' identifiers
+    // here does not widen a limit the block model does not already impose.
+    const appleIdentifiers = literals.filter((l) => l.action === "app_store_connect_api_key" &&
+        (l.arg === "key_id" || l.arg === "issuer_id") &&
+        l.value.trim() !== "");
+    for (const literal of literals) {
+        if (literal.value.trim() === "")
+            continue;
+        const file = FILE_ARGS.find((r) => r.action.test(literal.action) && r.arg === literal.arg);
+        if (file) {
+            const name = defaultVarNames(file.kind)["path"];
+            const identifiers = file.kind === "apple_asc" ? appleIdentifierRewrites(appleIdentifiers) : EMPTY;
+            out.push({
+                tier: "file",
+                kind: file.kind,
+                varName: name,
+                // The explicit literal wins over the Key ID read from the filename.
+                suggestedFields: { ...suggestedFields(file.kind, literal.value), ...identifiers.fields },
+                literal,
+                edits: [
+                    { start: literal.valueStart, length: literal.valueLength, replacement: `ENV.fetch("${name}")` },
+                    ...identifiers.edits,
+                ],
+                checked: true,
+            });
+            continue;
+        }
+        const inline = INLINE_ARGS.find((r) => r.action.test(literal.action) && r.arg === literal.arg);
+        if (inline) {
+            const name = defaultVarNames(inline.kind)["path"];
+            const identifiers = inline.kind === "apple_asc" ? appleIdentifierRewrites(appleIdentifiers) : EMPTY;
+            out.push({
+                tier: "inline",
+                kind: inline.kind,
+                varName: name,
+                suggestedFields: identifiers.fields,
+                literal,
+                // The whole pair, because the keyword changes too.
+                edits: [
+                    {
+                        start: literal.pairStart,
+                        length: literal.pairLength,
+                        replacement: `${inline.becomes}: ENV.fetch("${name}")`,
+                    },
+                    ...identifiers.edits,
+                ],
+                checked: true,
+            });
+            continue;
+        }
+        if (SECRET_ARG.test(literal.arg)) {
+            const name = `${literal.action}_${literal.arg}`.toUpperCase();
+            out.push({
+                tier: "secret",
+                varName: name,
+                literal,
+                suggestedFields: {},
+                edits: [{ start: literal.valueStart, length: literal.valueLength, replacement: `ENV.fetch("${name}")` }],
+                // Unticked on purpose. This is the one tier where a false positive is
+                // likely — a non-secret URL, a placeholder — and a patch applied by
+                // default to a value that was not a secret is a silent regression in
+                // someone's build.
+                checked: false,
+            });
+        }
+    }
+    return out;
+}
+/** Neither an edit nor a field: an `apple_asc` block that names no identifier. */
+const EMPTY = { edits: [], fields: {} };
+/**
+ * The rewrites and pre-filled fields for the identifiers written beside an
+ * App Store Connect key file.
+ *
+ * The variable names come from `defaultVarNames("apple_asc")`, the same table
+ * `materialise.ts` exports the block's fields through — so the name the Fastfile
+ * is patched to read is the name the run will set. These never form a proposal
+ * of their own: an identifier is only ever lifted when the key file that anchors
+ * its block is, because nothing else exports the variable it would come to read.
+ */
+function appleIdentifierRewrites(identifiers) {
+    const defaults = defaultVarNames("apple_asc");
+    const edits = [];
+    const fields = {};
+    for (const id of identifiers) {
+        edits.push({
+            start: id.valueStart,
+            length: id.valueLength,
+            replacement: `ENV.fetch("${defaults[id.arg]}")`,
+        });
+        fields[id.arg] = id.value;
+    }
+    return { edits, fields };
+}
+/** What the credential's filename gives away, so the prompt starts filled in. */
+function suggestedFields(kind, path) {
+    if (kind !== "apple_asc")
+        return {};
+    const keyId = P8_KEY_ID.exec(path)?.[1];
+    return keyId ? { key_id: keyId } : {};
+}

package/dist/src/fastfile/splice.js

@@ -0,0 +1,38 @@
+/**
+ * Replaces ranges of a source, leaving every other byte exactly as it was.
+ *
+ * The same requirement `fastfile/store.ts` documents: a file written by hand
+ * must never come back reformatted, reordered, or with its trailing newline
+ * fixed. Someone may have spent a long time on that file.
+ *
+ * **Byte offsets, not string indices.** Prism reports positions in bytes, and
+ * one accented character above the literal would put every later offset off by
+ * one — a patch landing in the middle of a string, on a build file, silently.
+ * So the work happens on a Buffer.
+ *
+ * Edits are applied last-first so an earlier replacement cannot shift the
+ * offsets of the ones after it, and may be handed in in any order. Overlapping
+ * edits throw: two rules that both claim the same bytes is a bug in the rule
+ * table, and applying one of them arbitrarily would hide it.
+ */
+export function splice(source, edits) {
+    if (edits.length === 0)
+        return source;
+    const ordered = [...edits].sort((a, b) => a.start - b.start);
+    for (let i = 1; i < ordered.length; i += 1) {
+        const previous = ordered[i - 1];
+        if (previous.start + previous.length > ordered[i].start) {
+            throw new Error("edits overlap");
+        }
+    }
+    let buffer = Buffer.from(source, "utf8");
+    for (let i = ordered.length - 1; i >= 0; i -= 1) {
+        const edit = ordered[i];
+        buffer = Buffer.concat([
+            buffer.subarray(0, edit.start),
+            Buffer.from(edit.replacement, "utf8"),
+            buffer.subarray(edit.start + edit.length),
+        ]);
+    }
+    return buffer.toString("utf8");
+}

package/dist/src/logs/store.js

@@ -1,5 +1,5 @@
 import { createReadStream } from "node:fs";
-import { mkdir, open, readFile } from "node:fs/promises";
+import { mkdir, open, readFile, rm } from "node:fs/promises";
 import { join } from "node:path";
 /**
  * Append-only writer for a run.
@@ -63,4 +63,12 @@ export class LogStore {
     stream(runId, fromOffset = 0) {
         return createReadStream(this.pathFor(runId), { start: fromOffset });
     }
+    /**
+     * Removes a run's log file. A run that never opened one is not an error:
+     * `force` makes a missing file a no-op, which is exactly the case for a run
+     * that failed before it wrote a line.
+     */
+    async remove(runId) {
+        await rm(this.pathFor(runId), { force: true });
+    }
 }

package/dist/src/main.js

@@ -7,7 +7,8 @@ import { bold, dim, field, heading } from "./cli/style.js";
 import { fileURLToPath } from "node:url";
 import { PromptAborted } from "./cli/prompt.js";
 import { runSetupCommand } from "./cli/setup.js";
-import { runSecretCommand } from "./cli/secret.js";
+import { runRemoveCommand } from "./cli/remove.js";
+import { runResetCommand } from "./cli/reset.js";
 import { runUninstallCommand } from "./cli/uninstall.js";
 import { runUserCommand } from "./cli/user.js";
 import { ConfigStore } from "./config/store.js";
@@ -21,7 +22,7 @@ import { Vault } from "./secrets/vault.js";
 import { makeInvoke } from "./sidecar/bridge.js";
 import { LaneReader } from "./sidecar/lanes.js";
 import { UsesReader } from "./sidecar/uses.js";
-export const version = "0.4.1";
+export const version = "0.5.0";
 /** Assembles the server from a data folder. */
 export async function createServerFromConfig(root) {
     const config = new ConfigStore(join(root, "config.yml"));
@@ -108,10 +109,13 @@ const USAGE = `laneyard — a self-hosted web UI for fastlane
 
   laneyard setup      set up the project in the current directory
                       --yes accepts every detected value without asking
-  laneyard secret set NAME [--project <slug>]
-                      store a secret, its value read from standard input
   laneyard user add NAME [--role admin|builder]
                       create an account, its password read from standard input
+  laneyard remove     remove the project of the current directory, and its
+                      laneyard.yml — run from where that file lives
+                      --dry-run shows what would go and stops
+  laneyard reset      wipe the data, keeping the accounts and the vault key
+                      --dry-run shows what would go and stops
   laneyard uninstall  remove Laneyard's data folder, after showing what is in it
                       --dry-run shows the inventory and stops
   laneyard            start the server
@@ -152,7 +156,7 @@ if (invokedDirectly()) {
         // this before. Interactive is the default because the values are guesses.
         const yes = rest.includes("--yes") || rest.includes("-y");
         try {
-            process.exit(await runSetupCommand(process.cwd(), join(home, "config.yml"), { slug, yes }));
+            process.exit(await runSetupCommand(process.cwd(), join(home, "config.yml"), { slug, yes, home }));
         }
         catch (cause) {
             // Ctrl-C in the middle of the questions. Nothing is written before the
@@ -168,17 +172,6 @@ if (invokedDirectly()) {
             process.exit(1);
         }
     }
-    // Above the catch-all below, which would otherwise reject it as unknown.
-    if (command === "secret") {
-        const home = homeDir();
-        await mkdir(home, { recursive: true });
-        process.exit(await runSecretCommand(home, rest, {
-            stdin: process.stdin,
-            interactive: process.stdin.isTTY === true,
-            out: (text) => process.stdout.write(text),
-            err: (text) => process.stderr.write(text),
-        }));
-    }
     if (command === "user") {
         const home = homeDir();
         await mkdir(home, { recursive: true });
@@ -198,6 +191,21 @@ if (invokedDirectly()) {
             err: (text) => process.stderr.write(text),
         }));
     }
+    // No `mkdir` either: like `uninstall`, these read what is already there.
+    if (command === "remove") {
+        process.exit(await runRemoveCommand(homeDir(), process.cwd(), rest, {
+            stdin: process.stdin,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
+    if (command === "reset") {
+        process.exit(await runResetCommand(homeDir(), rest, {
+            stdin: process.stdin,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
     // 0.1.0 shipped this as `add`. Anyone who learned that name deserves a
     // sentence rather than "Unknown command".
     if (command === "add") {

package/dist/src/secrets/vault.js

@@ -51,12 +51,13 @@ export class Vault {
     /**
      * Forgets everything stored under one project's name.
      *
-     * Never called by removing a project: that route leaves the vault alone on
-     * purpose and says what stayed. This is the separate, deliberate act someone
-     * takes afterwards, once they have read what it is they are about to lose —
-     * a credential is the one thing here that cannot be looked at before it goes.
+     * Part of removing a project: that act clears the vault along with the clone,
+     * the artifacts and the run history, behind the one typed confirmation that
+     * covers all of it. What it forgets is Laneyard's own encrypted copy — the
+     * `.p8` and the keystore that went in are still wherever the user keeps them.
      *
-     * Scoped by slug, so a global secret or a global signing block survives it.
+     * Scoped by slug, so a global secret or a global signing block survives it:
+     * those are read by every project and are never one project's to remove.
      */
     forget(projectSlug) {
         return {

package/dist/src/server/app.js

@@ -4,7 +4,6 @@ import Fastify from "fastify";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { LEGACY_ADMIN_NAME } from "../config/load.js";
 import { RunStore } from "../db/runs.js";
 import { SessionRecords } from "../db/sessions.js";
 import { Workspace } from "../git/workspace.js";
@@ -13,7 +12,7 @@ import { materialiseCredentials } from "../runner/materialise.js";
 import { executeRun } from "../runner/orchestrate.js";
 import { RunQueue } from "../runner/queue.js";
 import { authenticate, LoginThrottle, COOKIE_OPTIONS, SESSION_COOKIE, SessionStore } from "./auth.js";
-import { requiresAdmin } from "./permissions.js";
+import { accountMayReach, projectSlugOfRequest, requiresAdmin } from "./permissions.js";
 import { registerCredentialRoutes } from "./routes/credentials.js";
 import { registerFastfileRoutes } from "./routes/fastfile.js";
 import { registerProjectRoutes } from "./routes/projects.js";
@@ -130,13 +129,7 @@ export async function buildApp(deps) {
     const throttle = new LoginThrottle();
     app.post("/api/login", async (req, reply) => {
         const { name, password } = (req.body ?? {});
-        // A body with no name is the 0.2 login form, which knew only a password.
-        // It authenticates as `admin`, which is precisely the account a lone
-        // `server.password_hash` is loaded as — so an upgraded install keeps
-        // working, and the loader still owes nobody an answer about which form
-        // the file used.
-        const account = name ?? LEGACY_ADMIN_NAME;
-        const waitMs = throttle.retryAfterMs(account);
+        const waitMs = name ? throttle.retryAfterMs(name) : 0;
         if (waitMs > 0) {
             return reply
                 .code(429)
@@ -144,15 +137,16 @@ export async function buildApp(deps) {
                 .send({ error: `Too many attempts. Try again in ${Math.ceil(waitMs / 1000)}s.` });
         }
         const users = deps.config.server()?.users ?? [];
-        const identity = password ? await authenticate(users, account, password) : null;
+        const identity = name && password ? await authenticate(users, name, password) : null;
         if (!identity) {
-            throttle.recordFailure(account);
+            if (name)
+                throttle.recordFailure(name);
             // One message for a wrong password and for a name that does not exist:
             // telling them apart is telling a stranger which accounts are worth
             // attacking.
             return reply.code(401).send({ error: "Incorrect name or password" });
         }
-        throttle.recordSuccess(account);
+        throttle.recordSuccess(identity.name);
         const token = ctx.sessions.issue(identity);
         return reply
             .setCookie(SESSION_COOKIE, token, COOKIE_OPTIONS)
@@ -180,6 +174,17 @@ export async function buildApp(deps) {
         if (identity.role !== "admin" && requiresAdmin(req.method, req.url)) {
             return reply.code(403).send({ error: "This action requires the admin role" });
         }
+        // Per-project reach, for a non-admin only: a project this account may not
+        // reach is invisible, not shown-and-locked, so it answers 404 with the very
+        // body a genuinely unknown project gives. A 403 would confirm the project
+        // exists. The slug is resolved here, in the one hook, rather than in each
+        // run and project handler — the same reason `requiresAdmin` lives here.
+        if (identity.role !== "admin") {
+            const slug = projectSlugOfRequest(req.url, (id) => ctx.runs.get(id)?.projectSlug ?? null);
+            if (slug !== null && !accountMayReach(account, slug)) {
+                return reply.code(404).send({ error: "Unknown project" });
+            }
+        }
     });
     /**
      * Signing out ends this session and no other.

package/dist/src/server/permissions.js

@@ -73,3 +73,53 @@ export function requiresAdmin(method, url) {
         return expected.every((seg, i) => seg.startsWith(":") || seg === parts[i]);
     });
 }
+/**
+ * May this account reach that project?
+ *
+ * The other half of the auth answer, and data-driven rather than a role: it is
+ * still two roles, with the builder's reach narrowed by a list. An `admin`
+ * reaches everything — managing the server is the whole role. A `builder` with
+ * no `projects` field reaches everything too (an old config, untouched by this
+ * feature); an empty list reaches nothing; a list reaches its slugs.
+ *
+ * Named and beside `REQUIRES_ADMIN` on purpose: the reach check is a permission,
+ * and a permission expressed as an `if` inside a handler is one nobody finds
+ * during an audit.
+ */
+export function accountMayReach(account, slug) {
+    if (account.role === "admin")
+        return true;
+    if (account.projects === undefined)
+        return true;
+    return account.projects.includes(slug);
+}
+/**
+ * The project a request concerns, or null when it concerns none.
+ *
+ * Two shapes carry a project:
+ *
+ *   `/api/projects/:slug/*` — the slug is in the path. The bare `/api/projects`
+ *     listing carries none: it is filtered in its own handler, per account.
+ *   `/api/runs/:id/*` — a run addresses a project by id, not a slug, so the id
+ *     is mapped through `runSlug`. An id that names no run yields null, and the
+ *     handler answers its own 404 for the unknown run.
+ *
+ * Everything else — the vault, the accounts, `/api/me` — concerns no single
+ * project and returns null, passing the reach check untouched.
+ *
+ * `runSlug` is handed in rather than the run store reached into, so the mapping
+ * this depends on stays a one-line lookup the caller owns and this stays a pure,
+ * testable function.
+ */
+export function projectSlugOfRequest(url, runSlug) {
+    const parts = segments(url);
+    if (parts[0] !== "api")
+        return null;
+    if (parts[1] === "projects" && parts.length >= 3)
+        return parts[2] ?? null;
+    if (parts[1] === "runs" && parts.length >= 3) {
+        const id = Number(parts[2]);
+        return Number.isInteger(id) ? runSlug(id) : null;
+    }
+    return null;
+}

package/dist/src/server/routes/account.js

@@ -1,4 +1,4 @@
-import { MIN_PASSWORD_LENGTH, upsertUserInConfig } from "../../config/accounts.js";
+import { MIN_PASSWORD_LENGTH, VALID_NAME, renameUserInConfig, upsertUserInConfig } from "../../config/accounts.js";
 import { COOKIE_OPTIONS, SESSION_COOKIE, authenticate } from "../auth.js";
 /**
  * What someone may do to their own account, whatever their role.
@@ -54,4 +54,59 @@ export async function registerAccountRoutes(app, ctx) {
             .code(204)
             .send();
     });
+    /**
+     * Changing your own name — the other thing only you can do for yourself.
+     *
+     * Everything the password route is careful about is careful here for the same
+     * reasons: the current password is asked for because a session is a cookie in
+     * a browser that may have been left open; the role comes from the session and
+     * never from the body, so a rename cannot smuggle in a promotion; and the
+     * account this touches is only ever the session's own, there being no name in
+     * the body to point anywhere else.
+     *
+     * The one thing that is not like the password route is the write. A rename is
+     * not `upsertUserInConfig`, which keys by name and would add a second account
+     * under the new name and leave the old one — and its `projects` grants —
+     * behind. `renameUserInConfig` edits the `name` field of the existing entry in
+     * place, so role, hash and grants ride along untouched.
+     */
+    app.post("/api/account/name", async (req, reply) => {
+        const { name, role } = req.identity;
+        const { current, next } = (req.body ?? {});
+        if (typeof next !== "string" || !VALID_NAME.test(next)) {
+            return reply.code(400).send({
+                error: "A name is letters, digits, dot, dash and underscore, starting with a letter or a digit.",
+            });
+        }
+        const users = ctx.config.server()?.users ?? [];
+        if (typeof current !== "string" || !(await authenticate(users, name, current))) {
+            // No throttle, for the same reason as the password route: reaching here
+            // already costs a valid session.
+            return reply.code(401).send({ error: "That is not your current password." });
+        }
+        if (next === name) {
+            return reply.code(400).send({ error: "That is the name you already have." });
+        }
+        // A collision is refused rather than allowed to collapse two accounts into
+        // one. The comparison is case-sensitive, because the stored names are: `Ci`
+        // and `ci` are two accounts, and a rename to either is a rename to that one.
+        if (users.some((u) => u.name === next)) {
+            return reply.code(409).send({ error: `${next} is already the name of another account.` });
+        }
+        await renameUserInConfig(ctx.config.configPath(), name, next);
+        // Every session under the old name goes — the auth hook matches a session's
+        // name against a live account, and after this there is no account by that
+        // name for it to match. A fresh session under the new name is issued at once,
+        // so the person who just did it stays signed in on this page.
+        ctx.sessions.revokeAllFor(name);
+        const token = ctx.sessions.issue({ name: next, role });
+        // The file is watched on a debounce; loading here is what makes the very next
+        // request see the account under its new name rather than its old one.
+        await ctx.config.load();
+        // The new name is returned so the interface can update the header and this
+        // page, now that the cookie it carries belongs to a different name.
+        return reply
+            .setCookie(SESSION_COOKIE, token, COOKIE_OPTIONS)
+            .send({ name: next, role });
+    });
 }

package/dist/src/server/routes/fastfile.js

@@ -1,6 +1,7 @@
 import { join } from "node:path";
 import { FastfileStore } from "../../fastfile/store.js";
 import { Workspace } from "../../git/workspace.js";
+import { assertFastlaneDir } from "../../sidecar/fastlane-dir.js";
 export async function registerFastfileRoutes(app, ctx) {
     // Stateless: the previous content it keeps in memory during a write lives
     // on the call stack, not on the instance, so sharing one across requests
@@ -40,6 +41,12 @@ export async function registerFastfileRoutes(app, ctx) {
         if (!r)
             return;
         try {
+            // The common case is not a hand-deleted Fastfile but a `fastlane_dir`
+            // that never reached the clone — a path only in someone's working copy,
+            // uncommitted or gitignored, or a stray local copy. `store.read` would
+            // surface that as a bare ENOENT; this turns it into the same sentence the
+            // sidecar gives, naming the directory and how to fix it.
+            await assertFastlaneDir(join(r.workspacePath, r.fastlaneDir), r.fastlaneDir);
             const [content, dirty, diff] = await Promise.all([
                 store.read(r.workspacePath, r.fastlaneDir),
                 r.workspace.isDirty(),