ledge-server 0.0.3 → 0.1.1

package/lib/serve.js

@@ -390,9 +390,9 @@ function setFavoriteLine(text, on) {
   if (!on) {
     if (b === null)
       return text;
-    const content2 = b.lines.slice(1, b.close);
-    const kept = content2.filter((l) => !FAVORITE_LINE.test(l));
-    if (kept.length === content2.length)
+    const content = b.lines.slice(1, b.close);
+    const kept = content.filter((l) => !FAVORITE_LINE.test(l));
+    if (kept.length === content.length)
       return text;
     if (kept.every((l) => l.trim() === ""))
       return text.slice(b.end);
@@ -659,7 +659,7 @@ function tagRefsOf(text) {
 }
 
 // src/bun/notes.ts
-import { basename as basename2, dirname as dirname3, join as join5, relative as relative2, resolve as resolve3, sep as sep3 } from "path";
+import { basename as basename3, dirname as dirname3, join as join5, relative as relative2, resolve as resolve3, sep as sep3 } from "path";
 import { mkdir as mkdir3, open, readdir as readdir3, readFile as readFile5, rename as rename4, rmdir as rmdir2, stat as stat2, unlink as unlink4, writeFile as writeFile4 } from "fs/promises";
 
 // src/shared/rpc-schema.ts
@@ -890,8 +890,10 @@ async function loadWorkspaces() {
 }
 async function ensureDefault() {
   if (availableRoots().some((r) => kindOf(r) !== "docs"))
-    return;
-  await createManaged("Scratch");
+    return null;
+  const first = ![...entries.keys()].some((r) => kindOf(r) !== "docs");
+  const root = await createManaged("Scratch");
+  return first ? root : null;
 }
 async function createManaged(name) {
   await ensureAppHome();
@@ -1247,10 +1249,10 @@ async function unlockVault(passphrase, device, probeHeader) {
     } catch {
       return false;
     }
-    const key2 = deriveKey(passphrase, vaultSalt);
-    if (!checkAgainstFile(key2, checkB64))
+    const key = deriveKey(passphrase, vaultSalt);
+    if (!checkAgainstFile(key, checkB64))
       return false;
-    masterKey = key2;
+    masterKey = key;
     authorize(device);
     return true;
   }
@@ -1513,7 +1515,7 @@ function stripLockedLine(text) {
 }
 
 // src/bun/assets.ts
-import { dirname as dirname2, join as join4, relative, resolve as resolve2, extname, sep as sep2 } from "path";
+import { basename as basename2, dirname as dirname2, join as join4, relative, resolve as resolve2, extname, sep as sep2 } from "path";
 import { mkdir as mkdir2, readdir as readdir2, readFile as readFile4, rename as rename3, unlink as unlink3, writeFile as writeFile3 } from "fs/promises";
 function assetsDirOf(root) {
   return join4(resolve2(root), ASSETS_DIRNAME);
@@ -1601,6 +1603,19 @@ async function savePastedImage(root, bytes, ext = ".png", seal = false, from) {
   await writeAsset(assetsDir, join4(assetsDir, name), seal ? sealAssetBytes(bytes) : bytes);
   return assetRefFor(root, join4(assetsDir, name), from);
 }
+async function copyAssetInto(root, src) {
+  const bytes = await readFile4(src).catch(() => null);
+  if (bytes === null)
+    return null;
+  const assetsDir = assetsDirOf(assertWritableRoot(assertRegisteredRoot(root)));
+  await mkdir2(assetsDir, { recursive: true });
+  const taken = new Set(await readdir2(assetsDir));
+  const ext = extname(src);
+  const name = uniqueName(basename2(src, ext), taken, ext);
+  const path = join4(assetsDir, name);
+  await writeAsset(assetsDir, path, bytes);
+  return path;
+}
 async function replaceAssetBytes(path, bytes) {
   await writeAsset(dirname2(path), path, bytes);
 }
@@ -1750,9 +1765,9 @@ async function listNotes(root) {
 }
 async function searchNotes(root, query, folder = "") {
   const metas = notesUnder(await listNotes(root), folder);
-  const open2 = metas.filter((m) => !m.locked);
-  const hits = await collectHits(query, open2, async (path) => (await readNote(path))?.text ?? null);
-  return { hits, lockedSkipped: metas.length - open2.length };
+  const open = metas.filter((m) => !m.locked);
+  const hits = await collectHits(query, open, async (path) => (await readNote(path))?.text ?? null);
+  return { hits, lockedSkipped: metas.length - open.length };
 }
 var CONTEXT_MAX = 200;
 function contextOf(lines, line) {
@@ -1895,7 +1910,7 @@ async function writeNote(path, text, baseMtimeMs = null) {
     }
   }
   tmpCounter4 += 1;
-  const tmp = join5(dir, `.${basename2(path)}.tmp-${process.pid}-${tmpCounter4}`);
+  const tmp = join5(dir, `.${basename3(path)}.tmp-${process.pid}-${tmpCounter4}`);
   try {
     await writeFile4(tmp, outgoing, "utf8");
     const mtimeMs = (await stat2(tmp)).mtimeMs;
@@ -1942,14 +1957,14 @@ function assetRefsOf(text, root, from) {
 function rebaseAssetRefs(text, root, from, to) {
   if (dirname3(resolve3(from)) === dirname3(resolve3(to)))
     return text;
-  return text.replace(IMAGE_REF, (whole, open2, ref, close) => {
+  return text.replace(IMAGE_REF, (whole, open, ref, close) => {
     let asset;
     try {
       asset = assetPathOf(root, ref, from);
     } catch {
       return whole;
     }
-    return `${open2}${assetRefFor(root, asset, to)}${close}`;
+    return `${open}${assetRefFor(root, asset, to)}${close}`;
   });
 }
 async function favoriteNote(path, on) {
@@ -2150,13 +2165,13 @@ async function rollBack(done, from, to, salt) {
 async function imageFilesUnder(root) {
   const out = [];
   const walk = async (dir) => {
-    let entries2;
+    let entries;
     try {
-      entries2 = await readdir3(dir, { withFileTypes: true });
+      entries = await readdir3(dir, { withFileTypes: true });
     } catch {
       return;
     }
-    for (const entry of entries2) {
+    for (const entry of entries) {
       if (entry.name.startsWith(".") && entry.name !== ASSETS_DIRNAME)
         continue;
       const path = join5(dir, entry.name);
@@ -2178,7 +2193,7 @@ async function writeSealed(path, outgoing, baseMtimeMs) {
       console.warn("[vault] concurrent edit preserved in trash during a lock state change:", moved);
   }
   tmpCounter4 += 1;
-  const tmp = join5(dir, `.${basename2(path)}.tmp-${process.pid}-${tmpCounter4}`);
+  const tmp = join5(dir, `.${basename3(path)}.tmp-${process.pid}-${tmpCounter4}`);
   try {
     await writeFile4(tmp, outgoing, "utf8");
     await rename4(tmp, path);
@@ -2201,8 +2216,8 @@ async function createNote(root, text, folder) {
   const dir = await ensureFolder(root, folder);
   const reserved = reservedIn(dir);
   const taken = new Set(await readdir3(dir));
-  for (const name2 of reserved)
-    taken.add(name2);
+  for (const name of reserved)
+    taken.add(name);
   const name = uniqueName(baseFor(text), taken);
   reserved.add(name);
   const path = join5(dir, name);
@@ -2213,13 +2228,14 @@ async function createNote(root, text, folder) {
   }
   return metaFor(path, text);
 }
-async function moveNote(path, folder) {
+async function moveNote(path, folder, toRoot) {
   const root = assertWritableRoot(assertNote(path));
+  const dest = toRoot == null ? root : assertWritableRoot(assertRegisteredRoot(toRoot));
   const from = resolve3(path);
   if (isInside(trashDirOf(root), from)) {
     throw new Error("that note is in the trash \u2014 restore it first, then move it");
   }
-  const dir = await ensureFolder(root, folder);
+  const dir = await ensureFolder(dest, folder);
   if (dirname3(from) === dir)
     return metaAt(from);
   const file = await readNote(from);
@@ -2230,22 +2246,65 @@ async function moveNote(path, folder) {
   }
   const reserved = reservedIn(dir);
   const taken = new Set(await readdir3(dir));
-  for (const name2 of reserved)
-    taken.add(name2);
+  for (const name of reserved)
+    taken.add(name);
   const name = uniqueName(titleOf(from), taken);
   reserved.add(name);
   const target = join5(dir, name);
   try {
     assertNote(target);
-    await rename4(from, target);
-    const rebased = rebaseAssetRefs(file.text, root, from, target);
+    const rebased = dest === root ? rebaseAssetRefs(file.text, root, from, target) : await carryAssetRefs(file.text, root, from, dest, target);
+    let baseMtimeMs = file.mtimeMs;
+    try {
+      await rename4(from, target);
+    } catch (err) {
+      if (err.code !== "EXDEV")
+        throw err;
+      await carryAcrossVolumes(from, target);
+      baseMtimeMs = null;
+    }
     if (rebased !== file.text)
-      await writeNote(target, rebased, file.mtimeMs);
+      await writeNote(target, rebased, baseMtimeMs);
   } finally {
     reserved.delete(name);
   }
   return metaAt(target);
 }
+async function carryAcrossVolumes(from, target) {
+  const bytes = await readFile5(from);
+  tmpCounter4 += 1;
+  const tmp = join5(dirname3(target), `.${basename3(target)}.tmp-${process.pid}-${tmpCounter4}`);
+  try {
+    await writeFile4(tmp, bytes);
+    await rename4(tmp, target);
+  } catch (err) {
+    await unlink4(tmp).catch(() => {});
+    throw err;
+  }
+  try {
+    await deleteNote(from);
+  } catch (err) {
+    throw new Error(`copied the note to ${target} but could not move the original to the trash: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+async function carryAssetRefs(text, root, from, dest, to) {
+  const copies = new Map;
+  for (const { path } of assetRefsOf(text, root, from)) {
+    const copied = await copyAssetInto(dest, path);
+    if (copied !== null)
+      copies.set(path, copied);
+  }
+  return text.replace(IMAGE_REF, (whole, open, ref, close) => {
+    let asset;
+    try {
+      asset = assetPathOf(root, ref, from);
+    } catch {
+      return whole;
+    }
+    const copied = copies.get(asset);
+    return copied === undefined ? whole : `${open}${assetRefFor(dest, copied, to)}${close}`;
+  });
+}
 async function sameEntry(a, b) {
   const [x, y] = await Promise.all([stat2(a).catch(() => null), stat2(b).catch(() => null)]);
   return x !== null && y !== null && x.dev === y.dev && x.ino === y.ino;
@@ -2294,12 +2353,12 @@ async function renameFolder(root, folder, name) {
 async function retitleNote(path, text) {
   assertWritableRoot(assertNote(path));
   const dir = dirname3(path);
-  const current = basename2(path);
+  const current = basename3(path);
   const reserved = reservedIn(dir);
   const taken = new Set(await readdir3(dir));
   taken.delete(current);
-  for (const name2 of reserved)
-    taken.add(name2);
+  for (const name of reserved)
+    taken.add(name);
   const name = uniqueName(baseFor(text), taken);
   if (name.toLowerCase() === current.toLowerCase()) {
     return metaFor(path, text);
@@ -2379,13 +2438,13 @@ async function stashNote(path, text) {
 async function trashFiles(root) {
   const out = [];
   const walk = async (dir) => {
-    let entries2;
+    let entries;
     try {
-      entries2 = await readdir3(dir, { withFileTypes: true });
+      entries = await readdir3(dir, { withFileTypes: true });
     } catch {
       return;
     }
-    for (const entry of entries2) {
+    for (const entry of entries) {
       if (entry.name.startsWith("."))
         continue;
       const path = join5(dir, entry.name);
@@ -2427,8 +2486,8 @@ async function restoreNote(path) {
   await mkdir3(dir, { recursive: true });
   const reserved = reservedIn(dir);
   const taken = new Set(await readdir3(dir));
-  for (const name2 of reserved)
-    taken.add(name2);
+  for (const name of reserved)
+    taken.add(name);
   const name = uniqueName(titleOf(path), taken);
   reserved.add(name);
   const target = join5(dir, name);
@@ -2506,12 +2565,12 @@ function forceTitle(text, title) {
   const start = frontmatterEnd(text);
   if (heading === null) {
     const body = text.slice(start);
-    const sep4 = body.startsWith(`
+    const sep = body.startsWith(`
 `) || body === "" ? `
 ` : `
 
 `;
-    return `${text.slice(0, start)}# ${title}${sep4}${body}`;
+    return `${text.slice(0, start)}# ${title}${sep}${body}`;
   }
   const gap = start === 0 ? 0 : /^(?:[ \t]*\r?\n)+/.exec(text.slice(start))?.[0].length ?? 0;
   const lineStart = start + gap;
@@ -2563,9 +2622,9 @@ async function findTemplate(title, preferredRoot) {
   const pref = assertRegisteredRoot(preferredRoot);
   const local = resolveWikiTitle(title, await listNotes(pref));
   if (local) {
-    const file2 = await readNote(local.path);
-    if (file2)
-      return { path: local.path, text: templateText(file2, title) };
+    const file = await readNote(local.path);
+    if (file)
+      return { path: local.path, text: templateText(file, title) };
   }
   const others = availableRoots().filter((r) => r !== pref);
   const metas = (await Promise.all(others.map((r) => listNotes(r)))).flat();
@@ -3040,7 +3099,7 @@ function endOfString(text, start) {
 // src/bun/spawnParams.ts
 import { accessSync, constants } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename3, isAbsolute as isAbsolute2, join as join6, resolve as resolve4 } from "path";
+import { basename as basename4, isAbsolute as isAbsolute2, join as join6, resolve as resolve4 } from "path";
 
 // src/shared/dotenv.ts
 function parseDotenv(text) {
@@ -3113,7 +3172,7 @@ var SHELL_FALLBACKS = [
   "/usr/local/bin/bash"
 ];
 function isSupportedShell(path) {
-  return SUPPORTED_SHELLS.includes(basename3(path));
+  return SUPPORTED_SHELLS.includes(basename4(path));
 }
 function resolveShellPath(loginShell, isExecutable) {
   if (loginShell && isAbsolute2(loginShell) && isSupportedShell(loginShell) && isExecutable(loginShell)) {
@@ -3147,7 +3206,7 @@ function defaultShellPath() {
   return resolveShellPath(process.env["SHELL"], isExecutableFile);
 }
 function resolveShellArgs(path, args) {
-  if (basename3(path) !== "zsh")
+  if (basename4(path) !== "zsh")
     return args;
   if (args.some((a) => a.toLowerCase().replace(/_/g, "") === "interactivecomments"))
     return args;
@@ -3189,6 +3248,12 @@ function mergeDotenv(env, path, label, deps) {
     deps.warn(`${label}: ${p}`);
   Object.assign(env, vars);
 }
+function spawnKeyOf(params, host = LOCAL_HOST) {
+  const env = Object.keys(params?.env ?? {}).sort().map((key) => [key, params.env[key]]);
+  if (host !== LOCAL_HOST)
+    return JSON.stringify([env, params?.cwd ?? null]);
+  return JSON.stringify([env, params?.cwd ?? null, params?.profile ?? null, params?.envFile ?? null]);
+}
 
 // src/bun/settings.ts
 var SETTINGS_PATH = join7(APP_HOME, "settings.jsonc");
@@ -3297,10 +3362,10 @@ function folderOut(meta) {
   return meta.folder ? { folder: meta.folder } : {};
 }
 async function notesIn(workspace, folder = null) {
-  const roots2 = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
+  const roots = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
   const scope = folderScopeOf(folder);
   const out = [];
-  for (const root of roots2) {
+  for (const root of roots) {
     try {
       for (const n of notesUnder(await listNotes(root), scope))
         out.push({ ...n, workspace: root });
@@ -3385,10 +3450,10 @@ function targetWorkspace(args) {
       throw new Error(`LEDGE_WORKSPACE names ${env}, which is no longer a registered workspace root \u2014 name one explicitly (list_workspaces shows them)`);
     }
   }
-  const roots2 = writableRoots();
-  if (roots2.length === 1)
-    return roots2[0];
-  throw new Error(roots2.length === 0 ? "no workspace is available to create in (unmounted volume? list_workspaces shows what Ledge knows)" : "several workspaces exist \u2014 name one (list_workspaces shows them), or call from a shell in a Ledge note's terminal, where LEDGE_WORKSPACE names the current one");
+  const roots = writableRoots();
+  if (roots.length === 1)
+    return roots[0];
+  throw new Error(roots.length === 0 ? "no workspace is available to create in (unmounted volume? list_workspaces shows what Ledge knows)" : "several workspaces exist \u2014 name one (list_workspaces shows them), or call from a shell in a Ledge note's terminal, where LEDGE_WORKSPACE names the current one");
 }
 function dailyWorkspace(args, settings) {
   const asked = args["workspace"];
@@ -3502,11 +3567,11 @@ var ledgeTools = [
         throw new Error("give a non-empty query");
       await loadWorkspaces();
       const workspace = args["workspace"];
-      const roots2 = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
+      const roots = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
       const folder = folderScopeOf(args["folder"]);
       const all = [];
       let lockedSkipped = 0;
-      for (const root of roots2) {
+      for (const root of roots) {
         try {
           const res = await searchNotes(root, query, folder);
           lockedSkipped += res.lockedSkipped;
@@ -3564,16 +3629,16 @@ var ledgeTools = [
     handler: async (args) => {
       await loadWorkspaces();
       const workspace = args["workspace"];
-      const roots2 = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
+      const roots = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
       const tag = args["tag"];
       const folder = folderScopeOf(args["folder"]);
       if (typeof tag === "string" && normalizeTag(tag) !== "") {
         const all = [];
-        let lockedSkipped2 = 0;
-        for (const root of roots2) {
+        let lockedSkipped = 0;
+        for (const root of roots) {
           try {
             const res = await notesTagged(root, tag, folder);
-            lockedSkipped2 += res.lockedSkipped;
+            lockedSkipped += res.lockedSkipped;
             for (const h of res.hits) {
               all.push({ path: h.path, title: h.title, workspace: root, mtimeMs: h.mtimeMs, line: h.line, context: h.context });
             }
@@ -3588,12 +3653,12 @@ var ledgeTools = [
         return {
           hits: hits.map(({ mtimeMs, ...h }) => ({ ...h, modified: iso(mtimeMs) })),
           truncated: all.length > MAX_HITS,
-          ...lockedSkipped2 > 0 ? { lockedNoteBodiesSkipped: lockedSkipped2 } : {}
+          ...lockedSkipped > 0 ? { lockedNoteBodiesSkipped: lockedSkipped } : {}
         };
       }
       const merged = new Map;
       let lockedSkipped = 0;
-      for (const root of roots2) {
+      for (const root of roots) {
         try {
           const res = await tagsIn(root, folder);
           lockedSkipped += res.lockedSkipped;
@@ -3651,9 +3716,9 @@ var ledgeTools = [
         if (typeof title !== "string" || title.trim() === "") {
           throw new Error("creating from a template needs a `title` for the new note");
         }
-        const root2 = targetWorkspace(args);
-        const meta2 = await createFromTemplate(root2, template.trim(), title.trim(), folder);
-        return { path: meta2.path, title: meta2.title, workspace: root2, ...folderOut(meta2), modified: iso(meta2.mtimeMs) };
+        const root = targetWorkspace(args);
+        const meta = await createFromTemplate(root, template.trim(), title.trim(), folder);
+        return { path: meta.path, title: meta.title, workspace: root, ...folderOut(meta), modified: iso(meta.mtimeMs) };
       }
       const text = args["text"];
       if (typeof text !== "string" || text.trim() === "") {
@@ -4077,17 +4142,17 @@ async function runCli(argv, io) {
           const ws = scope ?? (flags.all ? null : here);
           const base = inFolder(ws !== null ? { workspace: ws } : {});
           if (arg === "") {
-            const res2 = await tool("tags", base);
+            const res = await tool("tags", base);
             if (flags.json) {
-              io.out(JSON.stringify(res2, null, 2));
+              io.out(JSON.stringify(res, null, 2));
               return 0;
             }
-            if (res2.tags.length === 0) {
+            if (res.tags.length === 0) {
               io.err(ws !== null ? `no tags in ${tildify(folder === "" ? ws : join10(ws, folder))}` : "no tags");
               return 0;
             }
-            const width = res2.tags.reduce((w, t) => Math.max(w, t.tag.length + 1), 0);
-            for (const t of res2.tags)
+            const width = res.tags.reduce((w, t) => Math.max(w, t.tag.length + 1), 0);
+            for (const t of res.tags)
               io.out(`${`#${t.tag}`.padEnd(width)}  ${t.count}`);
             return 0;
           }
@@ -4119,11 +4184,11 @@ async function runCli(argv, io) {
             const args = inFolder({ template: flags.template, title });
             if (scope !== null)
               args["workspace"] = scope;
-            const n2 = await tool("create_note", args);
+            const n = await tool("create_note", args);
             if (flags.json)
-              io.out(JSON.stringify(n2, null, 2));
+              io.out(JSON.stringify(n, null, 2));
             else
-              io.out(n2.path);
+              io.out(n.path);
             return 0;
           }
           if (title === "" && body === "") {
@@ -4230,8 +4295,8 @@ import { join as join16 } from "path";
 
 // src/bun/server.ts
 import { watch as watch2 } from "fs";
-import { homedir as homedir6 } from "os";
-import { basename as basename7, resolve as resolve10 } from "path";
+import { homedir as homedir7 } from "os";
+import { basename as basename8, resolve as resolve10 } from "path";
 
 // src/bun/pty.ts
 import { dlopen, ptr, CString, cc } from "bun:ffi";
@@ -4423,8 +4488,8 @@ class PtyProcess {
   constructor(opts) {
     this.interruptViaChar = opts.interruptViaChar ?? false;
     const keep = [];
-    const cstr = (str2) => {
-      const enc = new TextEncoder().encode(str2);
+    const cstr = (str) => {
+      const enc = new TextEncoder().encode(str);
       const b = new Uint8Array(enc.length + 1);
       b.set(enc);
       keep.push(b);
@@ -4742,12 +4807,12 @@ class MarkerParser {
     if (!tag.startsWith("ledge="))
       return null;
     const payload = tag.slice("ledge=".length);
-    const sep5 = payload.indexOf(":");
-    if (sep5 === -1)
+    const sep = payload.indexOf(":");
+    if (sep === -1)
       return null;
-    if (payload.slice(0, sep5) !== this.nonce)
+    if (payload.slice(0, sep) !== this.nonce)
       return null;
-    return payload.slice(sep5 + 1);
+    return payload.slice(sep + 1);
   }
 }
 function concat(a, b) {
@@ -4821,11 +4886,11 @@ class InlinePool {
     }
     let slot = session.primaries.get(host);
     if (!slot) {
-      slot = this.newSlot(sessionId, host);
+      slot = this.newSlot(sessionId, host, true);
       session.primaries.set(host, slot);
     }
     if (slot.activeRun !== null) {
-      slot = this.newSlot(sessionId, host);
+      slot = this.newSlot(sessionId, host, false);
       session.overflow.set(id, slot);
     }
     slot.activeRun = id;
@@ -4917,11 +4982,11 @@ class InlinePool {
           continue;
         }
         if (slot.shell.exited) {
-          const open2 = slot.parser.openBlockId ?? slot.activeRun;
-          if (open2 && !slot.began)
+          const open = slot.parser.openBlockId ?? slot.activeRun;
+          if (open && !slot.began)
             this.flushPreamble(slot, emit);
-          if (open2)
-            emit({ type: "ended", blockId: open2, exitCode: null }, slot.client);
+          if (open)
+            emit({ type: "ended", blockId: open, exitCode: null }, slot.client);
           this.dropSlot(session, slot);
         }
       }
@@ -4943,9 +5008,9 @@ class InlinePool {
     const session = this.sessions.get(sessionId);
     if (session) {
       for (const slot of this.slots(session)) {
-        const open2 = slot.parser.openBlockId ?? slot.activeRun;
-        if (open2)
-          emit({ type: "ended", blockId: open2, exitCode: null }, slot.client);
+        const open = slot.parser.openBlockId ?? slot.activeRun;
+        if (open)
+          emit({ type: "ended", blockId: open, exitCode: null }, slot.client);
         slot.shell.close();
       }
       this.sessions.delete(sessionId);
@@ -4955,6 +5020,16 @@ class InlinePool {
         this.pendingResize.delete(id);
     }
   }
+  primaryHosts(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session)
+      return [];
+    const out = [];
+    for (const [host, slot] of session.primaries)
+      if (!slot.shell.exited)
+        out.push(host);
+    return out;
+  }
   closeSession(sessionId) {
     const session = this.sessions.get(sessionId);
     if (session) {
@@ -5013,8 +5088,8 @@ class InlinePool {
     if (out.length > 0)
       emit({ type: "output", blockId: slot.activeRun, data: out }, slot.client);
   }
-  newSlot(sessionId, host) {
-    const shell = this.spawn(sessionId, host);
+  newSlot(sessionId, host, persistent) {
+    const shell = this.spawn(sessionId, host, persistent);
     return {
       shell,
       parser: new MarkerParser(this.nonce),
@@ -5057,14 +5132,14 @@ class InlinePool {
   }
   dropSlot(session, slot) {
     slot.shell.close();
-    for (const [host, s2] of session.primaries) {
-      if (s2 === slot) {
+    for (const [host, s] of session.primaries) {
+      if (s === slot) {
         session.primaries.delete(host);
         return;
       }
     }
-    for (const [id, s2] of session.overflow) {
-      if (s2 === slot)
+    for (const [id, s] of session.overflow) {
+      if (s === slot)
         session.overflow.delete(id);
     }
   }
@@ -5134,8 +5209,59 @@ async function writeProfile(name, text) {
   }
 }
 
+// src/shared/welcome.ts
+var WELCOME_TITLE = "Welcome to Ledge";
+var WELCOME_DOC = [
+  `# ${WELCOME_TITLE}`,
+  "",
+  "Ledge runs code and commands straight from your Markdown. This note is yours: edit it, or start a new one with \u2318N.",
+  "",
+  "## Run a block",
+  "",
+  "\u2318\u21A9 inside the block below, or the Run button on it (a tap, on a phone), runs it.",
+  "",
+  "```sh",
+  "curl -s https://api.github.com/zen",
+  "```",
+  "",
+  "One line of output streams into a panel beneath the block, and Dismiss puts the panel away.",
+  "",
+  "## The shell persists between blocks",
+  "",
+  "Each note keeps one shell for inline runs, so a `cd` or an exported variable carries into the next block. Run these two in order:",
+  "",
+  "```sh",
+  "cd /tmp",
+  "export FLAVOR=nautical",
+  "```",
+  "",
+  "```sh",
+  "pwd",
+  'echo "this shell is feeling $FLAVOR"',
+  "```",
+  "",
+  "\u21E7\u2318\u21A9 sends a block to the note's terminal drawer instead, a separate shell you can keep typing in. \u2303` opens the drawer.",
+  "",
+  "## Other languages",
+  "",
+  "`python`, `node`, `ts`, and others are runnable out of the box, each run a fresh process, and TypeScript runs on Bun, which Ledge already has:",
+  "",
+  "```ts",
+  "const now = new Date();",
+  "console.log(`hello from TypeScript, it is ${now.toLocaleTimeString()}`);",
+  "```",
+  "",
+  "## Where to next",
+  "",
+  "- The first line of a note names its file, so this one is `welcome-to-ledge.md`. Delete it from the sidebar once you are done with it.",
+  "- \u2318P opens a note by title, and \u2325\u2318P searches every note.",
+  '- The manual is behind the help button in the header, or "Documentation" in the command palette (\u21E7\u2318P). Getting Started is its first page.',
+  ""
+].join(`
+`);
+
 // src/bun/docs.ts
-import { basename as basename5, join as join13, resolve as resolve9 } from "path";
+import { basename as basename6, join as join13, resolve as resolve9 } from "path";
 import { mkdir as mkdir5, readdir as readdir4, readFile as readFile9, rename as rename8, unlink as unlink7, writeFile as writeFile8 } from "fs/promises";
 
 // docs/user/01-getting-started.md
@@ -5143,7 +5269,7 @@ var _01_getting_started_default = `# Getting Started
 
 Ledge is the notebook for developers and DevOps. It runs code and commands straight from your Markdown.
 
-The manual is read-only and its code blocks do not run. The note called Welcome to Ledge, which opens on a first launch and on a server that has no notes yet, is where the same examples do run.
+The manual is read-only and its code blocks do not run. The note called Welcome to Ledge is where the same examples do run. Ledge creates it the first time it starts on a machine, whether that is your Mac or a new server, and it stays in the Scratch workspace until you delete it.
 
 ## Your first note
 
@@ -5351,7 +5477,7 @@ The terminal drawer is a separate shell from the inline one. Both belong to this
 
 Comments mean the same thing on both chords. A \`#\` line inside a shell block is a comment whether you run the block inline or send it to the drawer, so you can annotate a block without breaking it.
 
-Frontmatter applies to newly spawned shells, so after editing it run "Restart Note Shell" from the palette. It kills the note's shells and lets them respawn. Use the same command when an experiment leaves a shell in a strange state.
+Frontmatter applies to newly spawned shells, so editing \`cwd:\` leaves a running shell where it was. The block grows a **Restart Note Shell** button when that happens, and pressing it lets the shells respawn with what the note now says. The same command is in the palette and the Note menu, for when an experiment leaves a shell in a strange state. [[Frontmatter and Environments]] has the detail.
 
 ## Change the shell
 
@@ -5366,6 +5492,8 @@ Ledge spawns your own login shell with \`-i\` for every inline shell and every t
 
 Relaunch to apply. Keep an interactive flag in \`args\`, usually \`-i\`, so your rc files run and blocks get the aliases and PATH you expect.
 
+Ledge also reads your login profile (\`~/.zprofile\`, \`~/.bash_profile\` or \`~/.profile\`) once at launch, so a PATH set there, such as Homebrew's, reaches every block even when you open Ledge from the Dock. Relaunch Ledge after editing your profile.
+
 zsh and bash are the two shells Ledge can read block output from. It marks where a block's output starts and stops with a hook that only those two provide. Any other shell runs the terminal drawer normally, and its inline runs show no output and no exit code. Ledge warns about that in the launch log rather than overriding what you set.
 
 A shell that is not installed refuses the run and names the path it could not find. Nothing quietly falls back to a different shell, because a different shell is not the one you asked for.
@@ -5528,6 +5656,16 @@ A locked note has to be unlocked before it can move, because those image referen
 
 Two notes in different folders may share a title. Ledge shows the folder beside the title wherever the list is flat: quick-open, full text search, backlinks, and tag results.
 
+## Moving a note to another workspace
+
+Choose "Move to Workspace\u2026" from the note's right-click menu or the command palette, or drag its row onto a workspace in the strip above the list.
+The note lands at the top level of that workspace, under the name it had, and any tab you have open on it goes along.
+Its images go with it: Ledge copies them into the other workspace's own image folder and rewrites the note's references, so the pictures still show. The copies in the workspace you left stay there, in case another note there shows the same picture.
+Wikilinks are the one thing that does not travel. \`[[Title]]\` finds a note in its own workspace, so notes here that linked to the moved note will stop finding it, and the strip at the bottom of the sidebar says how many that is. "Undo" there moves the note straight back.
+A locked note moves with its vault open and is refused with it shut, as with moving between folders ([[Note Locking]]).
+Folders do not move between workspaces; move their notes one at a time.
+The two workspaces are on the same machine, since a window shows one machine's notes at a time ([[Keep Notes on a Remote Server]]). If they are on different disks, the original is put in the old workspace's Trash rather than deleted, and the copy in the new workspace is the note from then on.
+
 ## Favorites
 
 A favorite note sits in a Favorites section at the top of the sidebar, above the tree, however deep in a folder it actually lives.
@@ -5889,7 +6027,13 @@ Three keys feed the environment, layered in this order, with later layers overri
 
 Frontmatter is read when a shell spawns, and a note's running shells keep the settings they started with.
 
-After editing the block, run "Restart Note Shell" from the command palette (\u21E7\u2318P). It kills the note's shells, and the next run or drawer visit respawns them with the current frontmatter. Use the same command when an experiment leaves a shell in a strange state.
+So editing \`cwd:\` does not move a shell that is already running. A block that printed one directory keeps printing it until the note's shells are replaced.
+
+The block says when that has happened. Edit a key that feeds a shell while the note has one running, and a **Restart Note Shell** button appears at the end of the block. Pressing it kills the note's shells; the next run or drawer visit spawns them with the frontmatter as it now reads.
+
+The same command is in the palette (\u21E7\u2318P) and the Note menu. Use it when an experiment leaves a shell in a strange state, too.
+
+The button is about the four keys a shell is spawned with: \`cwd\`, \`profile\`, \`envFile\`, and \`env\`. The rest of the block applies as you type it, so tagging or favoriting a note never raises it. Typing the old value back takes it down again, and so does the shell exiting on its own.
 
 ## Every key
 
@@ -5908,7 +6052,7 @@ After editing the block, run "Restart Note Shell" from the command palette (\u21
 `;
 
 // docs/user/07-profiles-and-secrets.md
-var _07_profiles_and_secrets_default = "# Profiles and Secrets\n\nA profile is a named file of environment variables that lives outside your notes folder and is injected into the shells of any note that names it.\n\nUse one for secrets. Notes get synced, backed up, shared, and read by agents, so an API key written in an `env:` line travels everywhere the note does. With a profile, the note carries only a name.\n\n## Declare a profile\n\nAdd one line of frontmatter (see [[Frontmatter and Environments]] for the block itself):\n\n```\n---\nprofile: deploy\n---\n```\n\nProfile names may contain letters, digits, `-`, and `_`. The name resolves to a file under `~/.config/ledge/profiles/` on the machine holding the notes, here `deploy.env`, created for you the first time you open it for editing.\n\nA note names at most one profile, and any number of notes can share one. Every deploy-related note can say `profile: deploy` and pick up the same credentials.\n\nOne name is taken. `backup` is the profile `ledge backup setup` writes, holding the backup repository and its credentials ([[Keep Notes on a Remote Server]]). A note that says `profile: backup` runs with those variables, which is how a note runs restic by hand.\n\n## Edit a profile\n\nClick the profile name in the frontmatter block, or run \"Edit Note Profile\u2026\" from the command palette. The command appears whenever the current note names a profile.\n\nOn a touch device the palette command is the whole of it. The small key button beside the name is a pointer control and is not drawn there, and the command asks for nothing to be pointed at: it follows the note you are in.\n\nEither way you get Ledge's profile editor: KEY=value rows with the values masked.\n\nOn disk the profile is a plain dotenv file: `KEY=value` per line, `#` comments, and an optional `export ` prefix. Ledge creates it readable only by you. Hand edits and editor edits coexist, and saves from the editor preserve your comments.\n\n```\n# deploy.env\nAPI_TOKEN=abc123\nDEPLOY_REGION=eu-west-1\n```\n\n## How profiles layer\n\nProfile variables merge into the shell environment at spawn, above the note's `envFile` and below its inline `env:` lines. An `env:` line can therefore override a profile value for one note without editing the shared file.\n\nA `profile:` line naming a file that does not exist is skipped, and the shell spawns without it.\n\nA profile edit applies to newly spawned shells, like every frontmatter change. Run \"Restart Note Shell\" after changing one.\n\n## Profiles stay with the notes\n\nA profile lives on the machine that holds the notes and runs their blocks. With your notes on this Mac, that is this Mac. With your notes on a server, the file is on the server, \"Edit Note Profile\u2026\" edits it there, and the values never come to this app. [[Keep Notes on a Remote Server]] has the table of what lives where.\n\nWhen a note runs its blocks on a remote host over ssh, Ledge does not send the profile ([[Run Code on Remote Hosts]]). A secret passed on a remote command line would be visible in that machine's process table to anyone who can list processes. If a remote run needs credentials, put them on the remote machine.\n";
+var _07_profiles_and_secrets_default = "# Profiles and Secrets\n\nA profile is a named file of environment variables that lives outside your notes folder and is injected into the shells of any note that names it.\n\nUse one for secrets. Notes get synced, backed up, shared, and read by agents, so an API key written in an `env:` line travels everywhere the note does. With a profile, the note carries only a name.\n\n## Declare a profile\n\nAdd one line of frontmatter (see [[Frontmatter and Environments]] for the block itself):\n\n```\n---\nprofile: deploy\n---\n```\n\nProfile names may contain letters, digits, `-`, and `_`. The name resolves to a file under `~/.config/ledge/profiles/` on the machine holding the notes, here `deploy.env`, created for you the first time you open it for editing.\n\nA note names at most one profile, and any number of notes can share one. Every deploy-related note can say `profile: deploy` and pick up the same credentials.\n\nOne name is taken. `backup` is the profile `ledge backup setup` writes, holding the backup repository and its credentials ([[Keep Notes on a Remote Server]]). A note that says `profile: backup` runs with those variables, which is how a note runs restic by hand.\n\n## Edit a profile\n\nClick the profile name in the frontmatter block, or run \"Edit Note Profile\u2026\" from the command palette. The command appears whenever the current note names a profile.\n\nOn a touch device the palette command is the whole of it. The small key button beside the name is a pointer control and is not drawn there, and the command asks for nothing to be pointed at: it follows the note you are in.\n\nEither way you get Ledge's profile editor: KEY=value rows with the values masked.\n\nOn disk the profile is a plain dotenv file: `KEY=value` per line, `#` comments, and an optional `export ` prefix. Ledge creates it readable only by you. Hand edits and editor edits coexist, and saves from the editor preserve your comments.\n\n```\n# deploy.env\nAPI_TOKEN=abc123\nDEPLOY_REGION=eu-west-1\n```\n\n## How profiles layer\n\nProfile variables merge into the shell environment at spawn, above the note's `envFile` and below its inline `env:` lines. An `env:` line can therefore override a profile value for one note without editing the shared file.\n\nA `profile:` line naming a file that does not exist is skipped, and the shell spawns without it.\n\nA profile edit applies to newly spawned shells, like every frontmatter change. Changing which profile a note names raises the block's **Restart Note Shell** button; editing the values inside a profile file does not, so run the command yourself after that.\n\n## Profiles stay with the notes\n\nA profile lives on the machine that holds the notes and runs their blocks. With your notes on this Mac, that is this Mac. With your notes on a server, the file is on the server, \"Edit Note Profile\u2026\" edits it there, and the values never come to this app. [[Keep Notes on a Remote Server]] has the table of what lives where.\n\nWhen a note runs its blocks on a remote host over ssh, Ledge does not send the profile ([[Run Code on Remote Hosts]]). A secret passed on a remote command line would be visible in that machine's process table to anyone who can list processes. If a remote run needs credentials, put them on the remote machine.\n";
 
 // docs/user/08-run-code-on-remote-hosts.md
 var _08_run_code_on_remote_hosts_default = `# Run Code on Remote Hosts
@@ -6101,17 +6245,36 @@ Closing the last window quits Ledge.
 
 ## Install the server
 
-The other machine needs the \`ledge\` command on the PATH an incoming ssh gets. It comes from the \`ledge-server\` package, so a few commands install it. [[Tutorial: Set Up a Ledge Server]] walks through them on a fresh VPS, with an account for Ledge and the sshd hardening this page describes further down.
+The other machine needs the server, which is the \`ledge-server\` package. One command installs it, on Linux or a Mac. Run it in a terminal on that machine, signed in as the account Ledge will sign in to:
 
-The server runs on Bun, and where Bun goes decides where the server goes, because Bun puts global commands beside itself. On a Linux machine, install Bun into \`/usr/local\` and both names land in \`/usr/local/bin\`, which is where the short PATH of an ssh command looks:
+\`\`\`sh norun
+curl -fsSL https://ledge.sh/server.sh | sh
+\`\`\`
+
+It needs no \`sudo\` and nothing installed first. It downloads the package and a Bun of its own, checks both against the checksums written into the script, and puts them in \`~/.ledge/.server\` in that account's home. Ledge's ssh command looks in \`~/.ledge/.server/bin\` before anything else, so an incoming ssh finds the server with no change to the PATH. The script also adds a PATH line to the shell's startup file, so your own new terminals find \`ledge\` too.
+
+It refuses to run as root, because the server belongs to the account Ledge signs in to. To install for another account, such as one named \`ledge\`, run it through \`sudo\`:
 
 \`\`\`sh norun
-curl -fsSL https://bun.sh/install | sudo BUN_INSTALL=/usr/local bash
+curl -fsSL https://ledge.sh/server.sh | sudo -iu ledge sh
 \`\`\`
 
-Then the server, into the same place:
+Running the same command again updates the server. A server that is already running goes on serving until it exits on its own, a minute or more after the last device disconnects, and the next connection starts the new version. [[Tutorial: Set Up a Ledge Server]] walks through the install on a fresh VPS, with an account for Ledge and the sshd hardening this page describes further down.
+
+A Mac that runs the Ledge app needs none of this. "Install Shell Command (ledge)" in the app's command palette puts \`ledge\` in \`~/.ledge/.server/bin\`, where an incoming ssh looks first, pointing at the app's own copy. Signing in as that account then reaches the notes the app shows, with the app's server answering both. On a Mac, the machine also needs Remote Login turned on ("Expose ssh carefully").
+
+macOS and Linux are supported, on arm64 or x64. On Linux the floor is glibc 2.29, which means Debian 11, Ubuntu 20.04, RHEL 9, or anything newer. Alpine and other musl systems are not supported.
+
+Nothing else has to be installed and no port is opened. Ledge speaks its protocol over ssh's stdin and stdout.
+
+Blocks need zsh or bash on that machine. Ledge spawns the account's login shell when it is one of those, and otherwise the first of the two it finds, so an ordinary Linux install needs nothing extra. Where neither exists, a run refuses and names the shell it looked for instead of appearing to do nothing.
+
+## Install the server with Bun
+
+If the machine already has Bun and you would rather use it, the same package installs with \`bun add -g\`. Where Bun goes decides where the server goes, because Bun puts global commands beside itself, and both have to be on the short PATH an incoming ssh gets. On Linux, that means Bun in \`/usr/local\`:
 
 \`\`\`sh norun
+curl -fsSL https://bun.sh/install | sudo BUN_INSTALL=/usr/local bash
 sudo BUN_INSTALL=/usr/local bun add -g ledge-server
 \`\`\`
 
@@ -6128,27 +6291,23 @@ bun add -g ledge-server
 
 Run them as the account Ledge signs in to. None of them needs \`sudo\`. The account's shell has to be zsh, which it is unless the account predates macOS Catalina.
 
-A Mac that runs the Ledge app needs none of this. "Install Shell Command (ledge)" in the app's command palette puts \`ledge\` in \`~/.ledge/.server/bin\`, where an incoming ssh looks first, pointing at the app's own copy. Signing in as that account then reaches the notes the app shows, with the app's server answering both.
-
-macOS and Linux are supported, on arm64 or x64. On Linux the floor is glibc 2.29, which means Debian 11, Ubuntu 20.04, RHEL 9, or anything newer. Alpine and other musl systems are not supported.
-
-Nothing else has to be installed and no port is opened. Ledge speaks its protocol over ssh's stdin and stdout.
-
-Blocks need zsh or bash on that machine. Ledge spawns the account's login shell when it is one of those, and otherwise the first of the two it finds, so an ordinary Linux install needs nothing extra. Where neither exists, a run refuses and names the shell it looked for instead of appearing to do nothing.
+Updating is \`bun add -g ledge-server@latest\`, with the same \`sudo BUN_INSTALL=/usr/local\` in front on Linux.
 
 ## Check that ssh can find the server
 
 Worth doing once, because Ledge reports the failure it catches as a server that is not installed. A remote shell that cannot find a command says only that, so that is all the app has to go on.
 
-Ledge starts the server by running \`ledge serve\` over ssh. A command run that way gets a short PATH and skips the startup files a terminal reads, so both \`ledge\` and the \`bun\` its first line names have to be on that PATH already. From your Mac's own terminal:
+Ledge starts the server by running \`PATH=$HOME/.ledge/.server/bin:$PATH ledge serve\` over ssh. A command run that way skips the startup files a terminal reads, so \`ledge\` has to be in \`~/.ledge/.server/bin\` or on the short PATH an incoming ssh gets. From your Mac's own terminal, ask the machine the same question:
 
 \`\`\`sh norun
-ssh you@machine 'command -v ledge; command -v bun'
+ssh you@machine 'PATH=$HOME/.ledge/.server/bin:$PATH command -v ledge'
 \`\`\`
 
-Two paths printed means the machine is ready to add.
+A path printed means the machine is ready to add.
 
-On Linux, nothing printed means Bun is installed for one user rather than system-wide, which is what a machine that already had Bun before you started usually has. Its global commands are then in \`~/.bun/bin\`, which an incoming ssh does not search, and \`bun pm bin -g\` on that machine confirms where they went. Linking both names into a system directory, on that machine, fixes it without reinstalling anything:
+Nothing printed after \`server.sh\` means it ran as a different account from the one you signed in as. Run it again as that account.
+
+After an install with Bun, check \`bun\` as well, since the package starts with it: \`ssh you@machine 'command -v bun'\`. On Linux, nothing printed means Bun is installed for one user rather than in \`/usr/local\`, which is what a machine that already had Bun before you started usually has. Its global commands are then in \`~/.bun/bin\`, which an incoming ssh does not search, and \`bun pm bin -g\` on that machine confirms where they went. Linking both names into a system directory, on that machine, fixes it without reinstalling anything:
 
 \`\`\`sh norun
 sudo ln -s "$(bun pm bin -g)/ledge" /usr/local/bin/ledge
@@ -6177,10 +6336,10 @@ Optional, and worth doing on a server you care about. Ledge connects with an ord
 Restricting gives the server a key that can speak Ledge's protocol and nothing else. In that machine's \`~/.ssh/authorized_keys\`:
 
 \`\`\`
-restrict,command="/usr/local/bin/ledge serve" ssh-ed25519 AAAA... ledge@laptop
+restrict,command="PATH=$HOME/.ledge/.server/bin:$PATH ledge serve" ssh-ed25519 AAAA... ledge@laptop
 \`\`\`
 
-Use the absolute path that \`command -v ledge\` printed above. sshd runs this line instead of whatever the client asked for, so naming the file outright settles where it is. It does not settle where Bun is, which is the other half of the check.
+The command is the one Ledge itself runs, so it finds the server wherever the check above found it. sshd runs this line instead of whatever the client asked for.
 
 That key cannot forward a port, run \`scp\`, or open a shell over ssh. What it limits is what the key is good for if it is ever stolen: no route into the network behind that server, and no file copying.
 
@@ -6250,7 +6409,7 @@ Backups run every hour while the server is up, and once more before it exits: af
 
 Three things to know before you rely on it:
 
-- Keep the restic password somewhere other than this machine. \`setup\` prints it once. A restore starts on a machine that has nothing on it, and a password stored only inside the backup is a backup you cannot open.
+- Keep the restic password somewhere other than this machine, such as a password manager. \`setup\` prints it once. It is the only key to the backup, and nothing can be restored without it.
 - The backup holds secrets. Profile values are plain text on disk and so are unlocked notes, which is why restic encrypts before uploading. The bucket sees ciphertext only.
 - Locked notes and the vault travel together. \`.vault.json\` is inside the app home, so it is always in the backup, and a restore opens locked notes with the passphrase they had ([[Note Locking]]).
 
@@ -6395,6 +6554,8 @@ var _10_ledge_on_your_phone_default = `# Ledge on Your Phone
 
 Ledge runs on an iPhone or iPad as a window onto a server. The phone holds no notes: it reaches a server over ssh, the way a Mac does in [[Keep Notes on a Remote Server]], and shows you what is there.
 
+Get Ledge for iPhone from the App Store. It runs on iOS and iPadOS 17 or newer, and it needs a server to connect to before it shows anything.
+
 A server that already serves your Mac needs nothing more. A machine without one needs the server installed first, as "Install the server" on that page describes, and the phone shows the same commands ("Set up a server" below).
 
 ## The first screen
@@ -6431,31 +6592,20 @@ A code never replaces a host key the phone already has. When Ledge has a differe
 
 ## Set up a server
 
-I don't have a server yet opens "Set up a server", which shows the commands that make a machine a Ledge server. Choose Linux or Mac above them. On Linux:
+I don't have a server yet opens "Set up a server", which shows the two commands that make a machine a Ledge server, on Linux or a Mac:
 
 \`\`\`sh norun
-curl -fsSL https://bun.sh/install | sudo BUN_INSTALL=/usr/local bash
-sudo BUN_INSTALL=/usr/local bun add -g ledge-server
-ledge pair
-\`\`\`
-
-On a Mac:
-
-\`\`\`sh norun
-curl -fsSL https://bun.sh/install | bash
-echo 'export PATH="$HOME/.bun/bin:$PATH"' >> ~/.zshenv
-source ~/.zshenv
-bun add -g ledge-server
-ledge pair
+curl -fsSL https://ledge.sh/server.sh | sh
+~/.ledge/.server/bin/ledge pair
 \`\`\`
 
-Run them in a terminal on that machine, signed in as the account the phone should use. They install Bun and the server where a command run over ssh can find them, which on Linux needs \`sudo\` and on a Mac needs the \`~/.zshenv\` line instead. The last command prints a pairing code for that account, and Scan the pairing code on the same screen reads it.
+Run them in a terminal on that machine, signed in as the account the phone should use rather than root. The first installs the server in that account's home, where a command run over ssh finds it, and needs no \`sudo\`. The second prints a pairing code for that account, and Scan the pairing code on the same screen reads it. It names \`ledge\` by its full path because the PATH line the installer adds reaches only new terminals.
 
 Copy commands puts them on the phone's pasteboard. Share commands hands them to AirDrop, Messages, or any app that can carry them to a computer with a terminal open on that machine.
 
-On a Mac, turn on Remote Login first, in System Settings under General, then Sharing. A Mac that runs the Ledge app needs only "Install Shell Command (ledge)" from the app's command palette in place of the first four commands: it puts \`ledge\` where the phone's ssh looks, pointing at the app's own copy, so the phone sees the same notes the app shows. \`ledge pair\` in a new terminal then prints the code.
+On a Mac, turn on Remote Login first, in System Settings under General, then Sharing. A Mac that runs the Ledge app needs only "Install Shell Command (ledge)" from the app's command palette in place of the first command: it puts \`ledge\` where the phone's ssh looks, pointing at the app's own copy, so the phone sees the same notes the app shows. The second command then prints the code.
 
-The machine needs sshd running and an address the phone can reach. [[Keep Notes on a Remote Server]] has the details of the install, including a machine that already has Bun, and [[Tutorial: Set Up a Ledge Server]] walks through a fresh VPS.
+The machine needs sshd running and an address the phone can reach. [[Keep Notes on a Remote Server]] has the details of the install, including installing with Bun instead, and [[Tutorial: Set Up a Ledge Server]] walks through a fresh VPS.
 
 If you already have a server, Add an existing server at the bottom of the screen opens the form from "Pair by address", and Back from there returns to the first screen.
 
@@ -6465,13 +6615,19 @@ Add an existing server opens "Pair with a server", a form with three parts. The
 
 The first part is the machine: \`user@host\`, and a port when sshd is not on 22. A phone reads no \`~/.ssh/config\`, so write the address out.
 
-The second is how to sign in. With A key, the default, the form shows a key line. On its first launch the phone makes a key of its own in the Secure Enclave, and that key never leaves the phone: there is no file to copy in or out. What leaves is the public half, as one line for the server's \`~/.ssh/authorized_keys\`:
+The second is how to sign in. With A key, the default, the form shows a command to run on the server. On its first launch the phone makes a key of its own in the Secure Enclave, and that key never leaves the phone: there is no file to copy in or out. What leaves is the public half, as one line for the server's \`~/.ssh/authorized_keys\`:
 
 \`\`\`
 restrict,command="PATH=$HOME/.ledge/.server/bin:$PATH ledge serve" ecdsa-sha2-nistp256 AAAA... ledge-iphone-3f2a91c0
 \`\`\`
 
-Copy line puts it on the phone's pasteboard. Share line hands it to AirDrop, Messages, or any app that can carry it to a machine with a shell on the server, which is where the pasteboard on a phone falls short. Add it to \`~/.ssh/authorized_keys\` there. The comment at the end names the phone, so the line is easy to find again when you want to revoke it.
+The command adds that line to the file, creating \`~/.ssh\` first if the account has none:
+
+\`\`\`sh norun
+mkdir -p ~/.ssh && chmod 700 ~/.ssh && printf '\\n%s\\n' 'restrict,command="PATH=$HOME/.ledge/.server/bin:$PATH ledge serve" ecdsa-sha2-nistp256 AAAA... ledge-iphone-3f2a91c0' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys
+\`\`\`
+
+Run it on the server, signed in as the account Ledge uses: over ssh from a Mac, or in the provider's web console for a new VPS. Copy command puts it on the phone's pasteboard. Share command hands it to AirDrop, Messages, or any app that can carry it to that terminal, which is where the pasteboard on a phone falls short. The comment at the end of the line names the phone, so the line is easy to find again when you want to revoke it.
 
 The line arrives already restricted, in the way "Restrict the key to Ledge" on [[Keep Notes on a Remote Server]] describes: the phone's key can speak Ledge's protocol and nothing else. It looks for \`ledge\` in \`~/.ledge/.server/bin\` first and then on the PATH an incoming ssh gets, so a server installed in either place starts ("Check that ssh can find the server" on the same page).
 
@@ -6481,7 +6637,7 @@ Ledge adds the server only once \`ledge serve\` answers there. On a machine wher
 
 ## Sign in with a password instead
 
-Choose "A password" under Sign in with and type the password for that account. The phone keeps it in its own keychain, and no key line has to be installed.
+Choose "A password" under Sign in with and type the password for that account. The eye button at the end of the field shows what you typed, to check it before connecting. The phone keeps the password in its own keychain, and no key line has to be installed.
 
 The trade-off is the one described on [[Keep Notes on a Remote Server]]: a password reaches a fresh machine today, and a key is the better long-term answer. A server with \`PasswordAuthentication no\` refuses it.
 
@@ -6497,7 +6653,7 @@ Removing the last server returns the phone to the first screen. Deleting the app
 
 ## More than one server
 
-Inside the app the connection bar works as on a Mac: tap it to add, edit, remove, or switch servers, with the same fingerprint step ([[Keep Notes on a Remote Server]]). The form shows the phone's key line where a Mac's shows a key path, with Share Line beside Copy Line.
+Inside the app the connection bar works as on a Mac: tap it to add, edit, remove, or switch servers, with the same fingerprint step ([[Keep Notes on a Remote Server]]). The form shows the command that installs the phone's key where a Mac's shows a key path, with Share Command beside Copy Command.
 
 Add Server\u2026 starts with Scan a pairing code, where a Mac's form has a field for the pasted link. It opens the camera, then the same "Pair with a server" screen as the first launch, and the app reopens on the new server once you tap Connect there. Cancel returns you to the form, where you can type the address instead. Editing a server has no scan: a code never replaces a host key the phone already has.
 
@@ -7117,7 +7273,7 @@ They combine: a synced drive for the always-on workspaces, a git repo for the on
 `;
 
 // docs/user/20-tutorial-set-up-a-ledge-server.md
-var _20_tutorial_set_up_a_ledge_server_default = '# Tutorial: Set Up a Ledge Server\n\nTurn a fresh Linux VPS into a Ledge server: an account for Ledge, the server package, a key that can do nothing but Ledge, and an sshd that ignores everyone else.\n\nThis builds on [[Keep Notes on a Remote Server]], which is the reference for every step here. The commands assume Debian or Ubuntu. Any Linux with glibc 2.29 or newer works, so substitute your package manager on anything else.\n\nTwo accounts appear throughout. `you@vps` is the account your provider gave you, which can `sudo`. `ledge@vps` is the account you create in step 1, which cannot.\n\n## 1. Create an account for Ledge\n\nOn the VPS, as your own account:\n\n```sh norun\nsudo adduser --disabled-password --gecos "" ledge\n```\n\nThe account has no password and no `sudo`. Everything Ledge does on this machine runs as this account: the server, the shells, and every block in every note. A key for it that is ever stolen cannot become root.\n\nIf your notes need `sudo`, that is a decision for later, made with `visudo` and as narrow as you can make it.\n\n`adduser` gives the account bash as its login shell, which is one of the two shells Ledge runs blocks in.\n\n## 2. Make a key on your Mac\n\nIn a terminal on your Mac:\n\n```sh norun\nssh-keygen -t ed25519 -f ~/.ssh/ledge -C ledge@laptop\ncat ~/.ssh/ledge.pub\n```\n\nLeave the key\'s passphrase empty, or use one your ssh agent already holds. Ledge\'s ssh runs with no terminal attached, so a passphrase it would have to type at a prompt never gets typed. This is about the key file only: signing in with the account\'s password is a choice on the form, and [[Keep Notes on a Remote Server]] covers it. This tutorial uses a key so that step 8 can turn passwords off.\n\nCopy the printed line, then put it on the VPS as the new account\'s only key. As your own account there, with the line pasted in place of the placeholder:\n\n```sh norun\nsudo install -d -m 700 -o ledge -g ledge /home/ledge/.ssh\necho \'ssh-ed25519 AAAA... ledge@laptop\' | sudo tee /home/ledge/.ssh/authorized_keys\nsudo chown ledge:ledge /home/ledge/.ssh/authorized_keys\nsudo chmod 600 /home/ledge/.ssh/authorized_keys\n```\n\nThe line goes in unrestricted for now. Step 7 restricts it, once you know the server works.\n\n## 3. Install the server\n\nStill on the VPS, as your own account:\n\n```sh norun\ncurl -fsSL https://bun.sh/install | sudo BUN_INSTALL=/usr/local bash\nsudo BUN_INSTALL=/usr/local bun add -g ledge-server\n```\n\nBoth commands carry `BUN_INSTALL=/usr/local`. Bun puts global commands beside itself, and `/usr/local/bin` is on the short PATH an incoming ssh gets. Without the variable, the server lands in a home directory that ssh never searches.\n\nNothing else needs installing and no service needs starting. Ledge starts the server over ssh when it connects, and the server exits a minute after the last device leaves, unless a block is still running.\n\n## 4. Check that ssh can find it\n\nFrom your Mac, as the new account, with the new key:\n\n```sh norun\nssh -i ~/.ssh/ledge ledge@vps \'command -v ledge; command -v bun\'\n```\n\nTwo paths printed means the machine is ready. Keep the first one; step 7 needs it.\n\nNothing printed means Bun was already installed for one user before you started, and its commands are in a directory ssh does not search. [[Keep Notes on a Remote Server]] shows the two symlinks that fix it.\n\n## 5. Add the server in Ledge\n\nRun "Notes On\u2026" from the command palette, choose Add, and fill in the form:\n\n| Field | Value |\n| --- | --- |\n| Name | Whatever you want the connection bar to say |\n| SSH destination | `ledge@vps` |\n| Port | Blank |\n| Sign in with | A key |\n| Key | `~/.ssh/ledge` |\n\nLedge fetches the machine\'s host key and shows its fingerprint. Get the same fingerprint from the machine itself, in your terminal on the VPS:\n\n```sh norun\nssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub\n```\n\nChoose "It Matches, Add" when the two agree. Ledge pins the key and refuses any future connection from that address that presents a different one.\n\n## 6. Try it\n\nThe connection bar now names the server. Press \u2318N, and the note you create is a file on the VPS. Give it one block:\n\n````\n```sh\nhostname; whoami\n```\n````\n\n\u2318\u21A9 prints the VPS\'s hostname and `ledge`. The block ran on the server, as the account you made, and the note never left it.\n\n## 7. Restrict the key to Ledge\n\nEdit `/home/ledge/.ssh/authorized_keys` on the VPS and put a prefix in front of the key, using the path step 4 printed:\n\n```\nrestrict,command="/usr/local/bin/ledge serve" ssh-ed25519 AAAA... ledge@laptop\n```\n\nThat key can now speak Ledge\'s protocol and nothing else: no shell, no port forwarding, no file copying. sshd runs the named command whatever the client asks for, so the terminal check in step 4 stops working for this key. That is expected. Your own account is the one for terminals.\n\nThe connection you already have keeps working. Ledge\'s next connection, at the next launch or after a drop, uses the restricted line.\n\n## 8. Turn off passwords in sshd\n\nA Ledge server runs whatever its notes say, so sshd should answer keys and nothing else. Create `/etc/ssh/sshd_config.d/10-ledge.conf`:\n\n```\nPasswordAuthentication no\nKbdInteractiveAuthentication no\nPermitRootLogin prohibit-password\n```\n\nThe `10-` matters. sshd keeps the first value it reads for a setting, and it reads this directory in name order. Cloud images ship a `50-cloud-init.conf` that turns passwords on, and a file named after it would lose.\n\nYour own account has to sign in with a key from now on. The provider usually installed one when it created the VPS, and this line from your Mac says whether it did:\n\n```sh norun\nssh -o PasswordAuthentication=no you@vps true\n```\n\nIf it asks for a password, put a key on that account first, with `ssh-copy-id`.\n\nThen check the configuration and reload, keeping your current terminal open until a second one has logged in:\n\n```sh norun\nsudo sshd -t && sudo systemctl reload ssh\n```\n\n## 9. Ban repeated guesses with fail2ban\n\nKeys-only sshd refuses every guess, but a box on the public internet still receives thousands of them a day, and each one costs a log line and a connection slot. fail2ban blocks an address after a few failures.\n\n```sh norun\nsudo apt-get install -y fail2ban\n```\n\nCreate `/etc/fail2ban/jail.local`:\n\n```ini\n[sshd]\nenabled = true\nbackend = systemd\nmaxretry = 5\nbantime = 1h\n```\n\n`backend = systemd` reads sshd\'s log from the journal. Debian 12, Ubuntu 24.04, and anything newer ship without a text `auth.log`, and fail2ban without this line fails to start on them.\n\n```sh norun\nsudo systemctl enable --now fail2ban\nsudo fail2ban-client status sshd\n```\n\nThe second command prints the jail\'s counts. Ledge never trips it: it connects with a key sshd accepts, and reconnects the same way.\n\n## 10. Close every other port\n\nOnly sshd needs to be reachable. Allow it, then turn the firewall on:\n\n```sh norun\nsudo apt-get install -y ufw\nsudo ufw allow 22/tcp\nsudo ufw enable\nsudo ufw status\n```\n\nUbuntu has `ufw` already, and the install line does nothing there.\n\nIf the VPS is on a tailnet or VPN, allow ssh from that interface alone and drop the public rule:\n\n```sh norun\nsudo ufw allow in on tailscale0 to any port 22\nsudo ufw delete allow 22/tcp\n```\n\nThen use the tailnet address as the SSH destination in Ledge. A server nobody else can reach has nothing for fail2ban to do, and the previous step does no harm.\n\n## 11. Keep it patched\n\nSecurity updates for the operating system should install themselves:\n\n```sh norun\nsudo apt-get install -y unattended-upgrades\nsudo dpkg-reconfigure -plow unattended-upgrades\n```\n\nAnswer Yes. Ubuntu ships with this on, and the two commands confirm it.\n\nThe server itself is a package, and updating it is the install line again:\n\n```sh norun\nsudo BUN_INSTALL=/usr/local bun add -g ledge-server@latest\n```\n\nA connection between an app and a server that cannot understand each other is refused with a sentence naming which end to update, so a version that falls behind is reported rather than guessed at.\n\n## Where to go next\n\n- **Back it up.** The notes now live on one disk that belongs to one provider. [[Tutorial: Back Up Your Notes to S3]] puts an encrypted copy in a bucket every hour, with one `ledge backup setup`.\n- **Add your phone.** Its pairing screen hands you a line for this same `authorized_keys`, already restricted ([[Ledge on Your Phone]]).\n- **Install what your notes run.** `git`, a language, a cloud CLI: whatever a block on this machine needs, installed as your own account with `apt-get`.\n- **Reach other machines from it.** A note on the VPS can carry `host: prod`, and the VPS makes that ssh connection with a key in `/home/ledge/.ssh` ([[Run Code on Remote Hosts]]).\n';
+var _20_tutorial_set_up_a_ledge_server_default = '# Tutorial: Set Up a Ledge Server\n\nTurn a fresh Linux VPS into a Ledge server: an account for Ledge, the server package, a key that can do nothing but Ledge, and an sshd that ignores everyone else.\n\nThis builds on [[Keep Notes on a Remote Server]], which is the reference for every step here. The commands assume Debian or Ubuntu. Any Linux with glibc 2.29 or newer works, so substitute your package manager on anything else.\n\nTwo accounts appear throughout. `you@vps` is the account your provider gave you, which can `sudo`. `ledge@vps` is the account you create in step 1, which cannot.\n\n## 1. Create an account for Ledge\n\nOn the VPS, as your own account:\n\n```sh norun\nsudo adduser --disabled-password --gecos "" ledge\n```\n\nThe account has no password and no `sudo`. Everything Ledge does on this machine runs as this account: the server, the shells, and every block in every note. A key for it that is ever stolen cannot become root.\n\nIf your notes need `sudo`, that is a decision for later, made with `visudo` and as narrow as you can make it.\n\n`adduser` gives the account bash as its login shell, which is one of the two shells Ledge runs blocks in.\n\n## 2. Make a key on your Mac\n\nIn a terminal on your Mac:\n\n```sh norun\nssh-keygen -t ed25519 -f ~/.ssh/ledge -C ledge@laptop\ncat ~/.ssh/ledge.pub\n```\n\nLeave the key\'s passphrase empty, or use one your ssh agent already holds. Ledge\'s ssh runs with no terminal attached, so a passphrase it would have to type at a prompt never gets typed. This is about the key file only: signing in with the account\'s password is a choice on the form, and [[Keep Notes on a Remote Server]] covers it. This tutorial uses a key so that step 8 can turn passwords off.\n\nCopy the printed line, then put it on the VPS as the new account\'s only key. As your own account there, with the line pasted in place of the placeholder:\n\n```sh norun\nsudo install -d -m 700 -o ledge -g ledge /home/ledge/.ssh\necho \'ssh-ed25519 AAAA... ledge@laptop\' | sudo tee /home/ledge/.ssh/authorized_keys\nsudo chown ledge:ledge /home/ledge/.ssh/authorized_keys\nsudo chmod 600 /home/ledge/.ssh/authorized_keys\n```\n\nThe line goes in unrestricted for now. Step 7 restricts it, once you know the server works.\n\n## 3. Install the server\n\nStill on the VPS, as your own account, install the server into the new account\'s home:\n\n```sh norun\ncurl -fsSL https://ledge.sh/server.sh | sudo -iu ledge sh\n```\n\nThe installer runs as `ledge` and puts the server, with a Bun of its own, in `/home/ledge/.ledge/.server`. It refuses to run as root, because the server belongs to the account Ledge signs in to, and `sudo -iu ledge` is how your own account runs it as that one.\n\nNothing else needs installing and no service needs starting. Ledge starts the server over ssh when it connects, and the server exits a minute after the last device leaves, unless a block is still running.\n\n## 4. Check that ssh can find it\n\nFrom your Mac, as the new account, with the new key:\n\n```sh norun\nssh -i ~/.ssh/ledge ledge@vps \'PATH=$HOME/.ledge/.server/bin:$PATH command -v ledge\'\n```\n\nA path printed means the machine is ready. This is the same lookup Ledge makes when it connects.\n\nNothing printed means the installer ran as a different account. Run step 3 again exactly as written.\n\n## 5. Add the server in Ledge\n\nRun "Notes On\u2026" from the command palette, choose Add, and fill in the form:\n\n| Field | Value |\n| --- | --- |\n| Name | Whatever you want the connection bar to say |\n| SSH destination | `ledge@vps` |\n| Port | Blank |\n| Sign in with | A key |\n| Key | `~/.ssh/ledge` |\n\nLedge fetches the machine\'s host key and shows its fingerprint. Get the same fingerprint from the machine itself, in your terminal on the VPS:\n\n```sh norun\nssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub\n```\n\nChoose "It Matches, Add" when the two agree. Ledge pins the key and refuses any future connection from that address that presents a different one.\n\n## 6. Try it\n\nThe connection bar now names the server. Press \u2318N, and the note you create is a file on the VPS. Give it one block:\n\n````\n```sh\nhostname; whoami\n```\n````\n\n\u2318\u21A9 prints the VPS\'s hostname and `ledge`. The block ran on the server, as the account you made, and the note never left it.\n\n## 7. Restrict the key to Ledge\n\nEdit `/home/ledge/.ssh/authorized_keys` on the VPS and put a prefix in front of the key:\n\n```\nrestrict,command="PATH=$HOME/.ledge/.server/bin:$PATH ledge serve" ssh-ed25519 AAAA... ledge@laptop\n```\n\nThat key can now speak Ledge\'s protocol and nothing else: no shell, no port forwarding, no file copying. sshd runs the named command whatever the client asks for, so the terminal check in step 4 stops working for this key. That is expected. Your own account is the one for terminals.\n\nThe connection you already have keeps working. Ledge\'s next connection, at the next launch or after a drop, uses the restricted line.\n\n## 8. Turn off passwords in sshd\n\nA Ledge server runs whatever its notes say, so sshd should answer keys and nothing else. Create `/etc/ssh/sshd_config.d/10-ledge.conf`:\n\n```\nPasswordAuthentication no\nKbdInteractiveAuthentication no\nPermitRootLogin prohibit-password\n```\n\nThe `10-` matters. sshd keeps the first value it reads for a setting, and it reads this directory in name order. Cloud images ship a `50-cloud-init.conf` that turns passwords on, and a file named after it would lose.\n\nYour own account has to sign in with a key from now on. The provider usually installed one when it created the VPS, and this line from your Mac says whether it did:\n\n```sh norun\nssh -o PasswordAuthentication=no you@vps true\n```\n\nIf it asks for a password, put a key on that account first, with `ssh-copy-id`.\n\nThen check the configuration and reload, keeping your current terminal open until a second one has logged in:\n\n```sh norun\nsudo sshd -t && sudo systemctl reload ssh\n```\n\n## 9. Ban repeated guesses with fail2ban\n\nKeys-only sshd refuses every guess, but a box on the public internet still receives thousands of them a day, and each one costs a log line and a connection slot. fail2ban blocks an address after a few failures.\n\n```sh norun\nsudo apt-get install -y fail2ban\n```\n\nCreate `/etc/fail2ban/jail.local`:\n\n```ini\n[sshd]\nenabled = true\nbackend = systemd\nmaxretry = 5\nbantime = 1h\n```\n\n`backend = systemd` reads sshd\'s log from the journal. Debian 12, Ubuntu 24.04, and anything newer ship without a text `auth.log`, and fail2ban without this line fails to start on them.\n\n```sh norun\nsudo systemctl enable --now fail2ban\nsudo fail2ban-client status sshd\n```\n\nThe second command prints the jail\'s counts. Ledge never trips it: it connects with a key sshd accepts, and reconnects the same way.\n\n## 10. Close every other port\n\nOnly sshd needs to be reachable. Allow it, then turn the firewall on:\n\n```sh norun\nsudo apt-get install -y ufw\nsudo ufw allow 22/tcp\nsudo ufw enable\nsudo ufw status\n```\n\nUbuntu has `ufw` already, and the install line does nothing there.\n\nIf the VPS is on a tailnet or VPN, allow ssh from that interface alone and drop the public rule:\n\n```sh norun\nsudo ufw allow in on tailscale0 to any port 22\nsudo ufw delete allow 22/tcp\n```\n\nThen use the tailnet address as the SSH destination in Ledge. A server nobody else can reach has nothing for fail2ban to do, and the previous step does no harm.\n\n## 11. Keep it patched\n\nSecurity updates for the operating system should install themselves:\n\n```sh norun\nsudo apt-get install -y unattended-upgrades\nsudo dpkg-reconfigure -plow unattended-upgrades\n```\n\nAnswer Yes. Ubuntu ships with this on, and the two commands confirm it.\n\nThe server updates with the install line from step 3, run again:\n\n```sh norun\ncurl -fsSL https://ledge.sh/server.sh | sudo -iu ledge sh\n```\n\nA connection between an app and a server that cannot understand each other is refused with a sentence naming which end to update, so a version that falls behind is reported rather than guessed at.\n\n## Where to go next\n\n- **Back it up.** The notes now live on one disk that belongs to one provider. [[Tutorial: Back Up Your Notes to S3]] puts an encrypted copy in a bucket every hour, with one `ledge backup setup`.\n- **Add your phone.** Its pairing screen hands you a line for this same `authorized_keys`, already restricted ([[Ledge on Your Phone]]).\n- **Install what your notes run.** `git`, a language, a cloud CLI: whatever a block on this machine needs, installed as your own account with `apt-get`.\n- **Reach other machines from it.** A note on the VPS can carry `host: prod`, and the VPS makes that ssh connection with a key in `/home/ledge/.ssh` ([[Run Code on Remote Hosts]]).\n';
 
 // docs/user/21-tutorial-back-up-your-notes-to-s3.md
 var _21_tutorial_back_up_your_notes_to_s3_default = `# Tutorial: Back Up Your Notes to S3
@@ -7158,9 +7314,9 @@ It asks for the endpoint, the bucket, the access key ID, and the secret. Then it
 | Credentials | Writes the four values and a generated restic password to the \`backup\` profile, \`~/.config/ledge/profiles/backup.env\`, readable by this account alone ([[Profiles and Secrets]]). |
 | Repository | Creates the restic repository in the bucket. |
 | First backup | Backs up everything \`ledge backup paths\` lists: the app home, every folder attached from elsewhere on the machine, and the profiles. |
-| Password | Prints the password on its last line. |
+| Password | Prints the password, the one thing \`setup\` writes to stdout. |
 
-The password is what encrypts the backup, and it is the only key. Copy it somewhere that is not this machine, such as a password manager. A restore starts on a machine with nothing on it, and a password stored only inside the backup is a backup you cannot open.
+The password is what encrypts the backup, and it is the only key. Nothing can be restored without it. Copy it somewhere that is not this machine, such as a password manager.
 
 ## 3. Leave it running
 
@@ -7171,7 +7327,7 @@ On a Mac, the server is up while the app is open and for a minute after it close
 Nothing else needs installing: no timer, no unit file, no line in a crontab. One line is worth adding on a server where notes are written while no device is connected, by the \`ledge\` command or by an agent, since those do not start the server:
 
 \`\`\`sh norun
-0 * * * * /usr/local/bin/ledge backup now
+0 * * * * $HOME/.ledge/.server/bin/ledge backup now
 \`\`\`
 
 \`ledge backup now\` takes a backup at any time and is safe to run beside the schedule.
@@ -9571,7 +9727,7 @@ var RETIRED_DIRNAME = ".retired";
 var tmpCounter5 = 0;
 async function writePage(path, text) {
   tmpCounter5 += 1;
-  const tmp = join13(resolve9(DOCS_ROOT), `.${basename5(path)}.tmp-${process.pid}-${tmpCounter5}`);
+  const tmp = join13(resolve9(DOCS_ROOT), `.${basename6(path)}.tmp-${process.pid}-${tmpCounter5}`);
   try {
     await writeFile8(tmp, text, "utf8");
     await rename8(tmp, path);
@@ -9622,7 +9778,7 @@ async function syncDocs(pages = DOC_PAGES) {
 }
 
 // src/bun/layout.ts
-import { basename as basename6, join as join14 } from "path";
+import { basename as basename7, join as join14 } from "path";
 import { readFile as readFile10, rename as rename9, unlink as unlink8, writeFile as writeFile9 } from "fs/promises";
 var LAYOUT_PATH = join14(APP_HOME, ".layout.json");
 var ANONYMOUS = "_";
@@ -9652,7 +9808,7 @@ async function writeLayout(client, text) {
   const next = { ...base, [key(client)]: value };
   await ensureAppHome();
   tmpCounter6 += 1;
-  const tmp = join14(APP_HOME, `.${basename6(LAYOUT_PATH)}.tmp-${process.pid}-${tmpCounter6}`);
+  const tmp = join14(APP_HOME, `.${basename7(LAYOUT_PATH)}.tmp-${process.pid}-${tmpCounter6}`);
   try {
     await writeFile9(tmp, JSON.stringify(next), "utf8");
     await rename9(tmp, LAYOUT_PATH);
@@ -9708,9 +9864,9 @@ function sizeOf(path) {
 }
 var logPath = LOG_PATH;
 var prevPath = PREV_LOG_PATH;
-function logToFile(basename7) {
-  logPath = join15(LOG_DIR, `${basename7}.log`);
-  prevPath = join15(LOG_DIR, `${basename7}.previous.log`);
+function logToFile(basename) {
+  logPath = join15(LOG_DIR, `${basename}.log`);
+  prevPath = join15(LOG_DIR, `${basename}.previous.log`);
 }
 function rotate() {
   try {
@@ -9741,12 +9897,12 @@ function write(source, level, args) {
   append(formatLine(new Date, source, level, args));
 }
 var patched = false;
-function startLogging(basename7) {
+function startLogging(basename) {
   if (patched)
     return;
   patched = true;
-  if (basename7)
-    logToFile(basename7);
+  if (basename)
+    logToFile(basename);
   rotate();
   const levels = [
     ["log", "info"],
@@ -9780,13 +9936,13 @@ function relevantChange(filename) {
   if (filename === null)
     return true;
   const segments = filename.split("/");
-  if (segments.slice(0, -1).some((s2) => s2.startsWith(".")))
+  if (segments.slice(0, -1).some((s) => s.startsWith(".")))
     return false;
   return /\.md(\.|$)/i.test(segments[segments.length - 1]);
 }
 var watchers = new Map;
-function syncWatchers(roots2, onChange) {
-  const want = new Set(roots2);
+function syncWatchers(roots, onChange) {
+  const want = new Set(roots);
   for (const [root, w] of watchers) {
     if (want.has(root))
       continue;
@@ -9846,14 +10002,14 @@ function bundledBun(execPath) {
   return /(^|\/)bun$/.test(execPath) ? execPath : "";
 }
 function runnerFor(id, lang, code, interpreters, bunPath, remote = false) {
-  const key2 = (lang ?? "").toLowerCase();
-  const interpreter = interpreters[key2];
+  const key = (lang ?? "").toLowerCase();
+  const interpreter = interpreters[key];
   if (!interpreter) {
-    const path2 = `/tmp/ledge-run-${id}.sh`;
-    const command = remote ? remoteWrite(code, path2, `source ${path2}`) : `source ${path2}`;
-    return { kind: "shell", path: path2, contents: code, command, remote };
+    const path = `/tmp/ledge-run-${id}.sh`;
+    const command = remote ? remoteWrite(code, path, `source ${path}`) : `source ${path}`;
+    return { kind: "shell", path, contents: code, command, remote };
   }
-  const ext = EXT[key2] ?? (key2.replace(/[^a-z0-9]/g, "") || "txt");
+  const ext = EXT[key] ?? (key.replace(/[^a-z0-9]/g, "") || "txt");
   const path = `/tmp/ledge-run-${id}.${ext}`;
   const contents = ext === "php" && !/^\s*<\?/.test(code) ? `<?php
 ${code}` : code;
@@ -9877,8 +10033,8 @@ function hostGlobMatches(pattern, host) {
   const rx = pattern.split("*").map(escapeRegex).join(".*");
   return new RegExp(`^${rx}$`).test(host);
 }
-function escapeRegex(s2) {
-  return s2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
 // src/bun/remoteSpawn.ts
@@ -9899,11 +10055,11 @@ function buildRemoteSpawn(host, kind, params, warn) {
   const parts = [];
   if (params?.cwd)
     parts.push(remoteCd(params.cwd));
-  for (const [key2, value] of Object.entries(params?.env ?? {})) {
-    if (isEnvName(key2) && typeof value === "string") {
-      parts.push(`export ${key2}=${shellQuote(value)}`);
+  for (const [key, value] of Object.entries(params?.env ?? {})) {
+    if (isEnvName(key) && typeof value === "string") {
+      parts.push(`export ${key}=${shellQuote(value)}`);
     } else {
-      warn(`ignoring unusable env entry "${key2}"`);
+      warn(`ignoring unusable env entry "${key}"`);
     }
   }
   if (kind === "inline") {
@@ -9921,6 +10077,97 @@ function remoteCd(cwd) {
   return `cd -- ${target} 2>/dev/null || printf 'ledge: cwd %s not found here; starting in %s\\n' ${shellQuote(cwd)} "$PWD"`;
 }
 
+// src/bun/loginEnv.ts
+import { homedir as homedir6 } from "os";
+var LOGIN_ENV_TIMEOUT_MS = 5000;
+var RESOLVING_VAR = "LEDGE_RESOLVING_ENVIRONMENT";
+var DROPPED = new Set(["PWD", "OLDPWD", "SHLVL", "_", RESOLVING_VAR]);
+function envCommand(nonce) {
+  return `printf '%s' '${nonce}<'; /usr/bin/env -0; printf '%s' '>${nonce}'`;
+}
+function parseEnvOutput(output, nonce) {
+  const start = output.indexOf(`${nonce}<`);
+  if (start < 0)
+    return null;
+  const from = start + nonce.length + 1;
+  const end = output.lastIndexOf(`>${nonce}`);
+  if (end < from)
+    return null;
+  const env = {};
+  for (const entry of output.slice(from, end).split("\x00")) {
+    const eq = entry.indexOf("=");
+    if (eq > 0)
+      env[entry.slice(0, eq)] = entry.slice(eq + 1);
+  }
+  return env;
+}
+function cleanLoginEnv(env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (!DROPPED.has(key))
+      out[key] = value;
+  }
+  if (out["PATH"] !== undefined)
+    out["PATH"] = dedupePath(out["PATH"]);
+  return out;
+}
+function dedupePath(path) {
+  const seen = new Set;
+  return path.split(":").filter((dir) => {
+    if (dir === "" || seen.has(dir))
+      return false;
+    seen.add(dir);
+    return true;
+  }).join(":");
+}
+async function resolveLoginEnv(shellPath, base, opts = {}) {
+  const fallback = definedOnly(base);
+  if (opts.skip ?? Boolean(process.env["LEDGE_SKIP_LOGIN_ENV"]))
+    return fallback;
+  const warn = opts.warn ?? ((msg) => console.warn("[loginEnv]", msg));
+  const timeoutMs = opts.timeoutMs ?? LOGIN_ENV_TIMEOUT_MS;
+  const nonce = `ledge-env-${crypto.randomUUID()}`;
+  let proc;
+  try {
+    proc = Bun.spawn({
+      cmd: [shellPath, "-l", "-c", envCommand(nonce)],
+      env: { ...fallback, [RESOLVING_VAR]: "1" },
+      cwd: opts.cwd ?? homedir6(),
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "ignore"
+    });
+  } catch (err) {
+    warn(`could not start ${shellPath} to read the login environment (${err}); using the app's own`);
+    return fallback;
+  }
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(null), timeoutMs);
+  });
+  const output = await Promise.race([new Response(proc.stdout).text(), timedOut]);
+  clearTimeout(timer);
+  if (output === null) {
+    proc.kill("SIGKILL");
+    warn(`${shellPath} -l took over ${timeoutMs} ms to start; using the app's own environment`);
+    return fallback;
+  }
+  const env = parseEnvOutput(output, nonce);
+  if (!env) {
+    warn(`${shellPath} -l printed no environment; using the app's own`);
+    return fallback;
+  }
+  return cleanLoginEnv(env);
+}
+function definedOnly(env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== undefined)
+      out[key] = value;
+  }
+  return out;
+}
+
 // src/bun/server.ts
 import { readFileSync, statSync as statSync2 } from "fs";
 function holdRunEvent(held, ev, cap) {
@@ -9994,12 +10241,18 @@ var fromB64 = (b64) => new Uint8Array(Buffer.from(b64, "base64"));
 async function createServer(deps) {
   const { push } = deps;
   const settings = await loadSettings();
+  const loginEnv = resolveLoginEnv(settings.shell.path, process.env);
   await loadWorkspaces();
-  await ensureDefault();
+  const first = await ensureDefault();
+  if (first) {
+    await createNote(first, WELCOME_DOC).catch((err) => console.warn("[server] could not write the welcome note", err));
+  }
   await syncDocs();
   await loadVault();
-  const shellEnv = { ...process.env, TERM: "xterm-256color" };
+  const shellEnv = { ...await loginEnv, TERM: "xterm-256color" };
   const sessionParams = new Map;
+  const spawnKeys = new Map;
+  const sentStale = new Map;
   const sessionFacts = new Map;
   const spawnDeps = {
     readFile: (path) => {
@@ -10030,14 +10283,23 @@ async function createServer(deps) {
     }
     return requested;
   }
-  function spawnShell(sessionId, host, kind) {
+  function spawnShell(sessionId, host, kind, persistent = true) {
+    if (persistent) {
+      const born = spawnKeys.get(sessionId) ?? new Map;
+      born.set(kind === "terminal" ? "terminal" : `inline:${host}`, {
+        host,
+        key: spawnKeyOf(sessionParams.get(sessionId), host)
+      });
+      spawnKeys.set(sessionId, born);
+      queueMicrotask(() => refreshStale(sessionId));
+    }
     if (host !== LOCAL_HOST) {
       const remote = buildRemoteSpawn(host, kind, sessionParams.get(sessionId), (msg) => console.warn("[session]", msg));
       return new PtyProcess({
         executable: remote.executable,
         args: remote.args,
         env: shellEnv,
-        cwd: homedir6(),
+        cwd: homedir7(),
         interruptViaChar: true
       });
     }
@@ -10053,7 +10315,7 @@ async function createServer(deps) {
       cwd
     });
   }
-  const inlinePool = new InlinePool((sessionId, host) => spawnShell(sessionId, host, "inline"), NONCE);
+  const inlinePool = new InlinePool((sessionId, host, persistent) => spawnShell(sessionId, host, "inline", persistent), NONCE);
   const terms = new Map;
   let nextTermRunId = 1;
   function termFor(sessionId, requestedHost) {
@@ -10078,6 +10340,28 @@ async function createServer(deps) {
     }
     return t;
   }
+  function staleFor(sessionId) {
+    const born = spawnKeys.get(sessionId);
+    if (!born)
+      return false;
+    const params = sessionParams.get(sessionId);
+    const live = inlinePool.primaryHosts(sessionId).map((host) => `inline:${host}`);
+    if (terms.get(sessionId)?.term.exited === false)
+      live.push("terminal");
+    for (const at of live) {
+      const was = born.get(at);
+      if (was && was.key !== spawnKeyOf(params, was.host))
+        return true;
+    }
+    return false;
+  }
+  function refreshStale(sessionId) {
+    const stale = staleFor(sessionId);
+    if (stale === (sentStale.get(sessionId) ?? false))
+      return;
+    sentStale.set(sessionId, stale);
+    push.all.sessionStale({ sessionId, stale });
+  }
   function flushPaste(t, now = Date.now()) {
     const out = takePaste(t, now);
     if (out !== null)
@@ -10114,6 +10398,8 @@ async function createServer(deps) {
     terms.delete(sessionId);
     sessionParams.delete(sessionId);
     sessionFacts.delete(sessionId);
+    spawnKeys.delete(sessionId);
+    sentStale.delete(sessionId);
   }
   function refreshWatchers() {
     syncWatchers(availableRoots(), (root) => push.all.notesChanged({ root }));
@@ -10124,13 +10410,13 @@ async function createServer(deps) {
       return;
     openRequestWatcherStarted = true;
     try {
-      const requestName = basename7(OPEN_REQUEST_PATH);
+      const requestName = basename8(OPEN_REQUEST_PATH);
       watch2(APP_HOME, (_event, filename) => {
         if (filename !== requestName)
           return;
-        takeOpenRequest().then((open2) => {
-          if (open2 !== null)
-            push.all.openExternal(open2);
+        takeOpenRequest().then((open) => {
+          if (open !== null)
+            push.all.openExternal(open);
         });
       });
     } catch (err) {
@@ -10188,6 +10474,7 @@ async function createServer(deps) {
     "noteFromTemplate",
     "noteLock",
     "noteMove",
+    "noteMoveToWorkspace",
     "noteRemoveLock",
     "noteRetitle",
     "noteStash",
@@ -10269,6 +10556,12 @@ async function createServer(deps) {
       await refuseLockedFrom(device, path);
       return { note: await moveNote(path, folder) };
     },
+    noteMoveToWorkspace: async ({ path, root }) => {
+      await refuseLockedFrom(device, path);
+      const crossing = root !== rootContaining(path);
+      const backlinks = crossing ? new Set((await backlinksTo(path)).backlinks.map((b) => b.path)).size : 0;
+      return { note: await moveNote(path, null, root), backlinks };
+    },
     folderRename: ({ root, folder, name }) => renameFolder(root, folder, name),
     folderDelete: ({ root, folder }) => deleteFolder(root, folder),
     noteRetitle: async ({ path, text }) => ({ note: await retitleNote(path, text) }),
@@ -10446,10 +10739,13 @@ async function createServer(deps) {
         sessionFacts.set(sessionId, { note: resolve10(notePath), workspace: root });
       else
         sessionFacts.delete(sessionId);
+      refreshStale(sessionId);
       return { ok: true };
     },
     sessionRestart: ({ sessionId }) => {
       inlinePool.restartSession(sessionId, sendRunEvent);
+      spawnKeys.delete(sessionId);
+      refreshStale(sessionId);
       wake();
       const t = terms.get(sessionId);
       if (t) {
@@ -10493,9 +10789,9 @@ async function createServer(deps) {
       return { ok: true };
     },
     openRequestTake: async () => {
-      const open2 = await takeOpenRequest();
+      const open = await takeOpenRequest();
       startOpenRequestWatcher();
-      return { open: open2 };
+      return { open };
     },
     logAppend: async ({ level, text }) => {
       write("view", level, [text.slice(0, LOG_TEXT_CAP)]);
@@ -10559,6 +10855,9 @@ async function createServer(deps) {
         terms.delete(sessionId);
       }
     }
+    for (const [sessionId, stale] of sentStale)
+      if (stale)
+        refreshStale(sessionId);
     if (awake)
       lastBusyAt = now;
     pace(now - lastBusyAt < DRAIN_SETTLE_MS ? DRAIN_FAST_MS : DRAIN_IDLE_MS);
@@ -10617,6 +10916,7 @@ var REQUEST_METHODS = [
   "noteWrite",
   "noteCreate",
   "noteMove",
+  "noteMoveToWorkspace",
   "folderRename",
   "folderDelete",
   "noteRetitle",
@@ -10698,6 +10998,7 @@ var PUSH_MESSAGES = [
   "terminalBusy",
   "terminalExit",
   "terminalDetached",
+  "sessionStale",
   "presence",
   "notesChanged",
   "openExternal",
@@ -10776,10 +11077,10 @@ function restoreBinary(payload, path, bytes) {
 }
 function walk(payload, path) {
   let at = payload;
-  for (const key2 of path) {
+  for (const key of path) {
     if (typeof at !== "object" || at === null)
       return null;
-    at = at[key2];
+    at = at[key];
   }
   return { value: at };
 }
@@ -10954,8 +11255,8 @@ function names(v) {
   return v.filter((n) => typeof n === "string").slice(0, MAX_DECLARED_NAMES);
 }
 var MAX_DECLARED_NAMES = 512;
-function opt(key2, v) {
-  return typeof v === "string" ? { [key2]: v } : {};
+function opt(key, v) {
+  return typeof v === "string" ? { [key]: v } : {};
 }
 function bin(v) {
   return isId(v) ? { bin: v } : {};
@@ -11002,15 +11303,15 @@ function concat2(a, b) {
   out.set(b, a.length);
   return out;
 }
-function writeMessage(write2, msg, kind, method) {
+function writeMessage(write, msg, kind, method) {
   const path = binaryPath(kind, method);
   const body = msg.t === "req" ? msg.p : msg.t === "res" ? msg.r : msg.t === "push" ? msg.p : null;
   const hoisted = path && body !== null ? hoistBinary(body, path) : null;
   if (!hoisted)
-    return write2(encodeControl(msg));
-  const bin2 = nextBinaryId();
-  write2(encodeBinary(bin2, hoisted.bytes));
-  write2(encodeControl(msg.t === "req" ? { ...msg, p: hoisted.payload, bin: bin2 } : msg.t === "res" ? { ...msg, r: hoisted.payload, bin: bin2 } : { ...msg, p: hoisted.payload, bin: bin2 }));
+    return write(encodeControl(msg));
+  const bin = nextBinaryId();
+  write(encodeBinary(bin, hoisted.bytes));
+  write(encodeControl(msg.t === "req" ? { ...msg, p: hoisted.payload, bin } : msg.t === "res" ? { ...msg, r: hoisted.payload, bin } : { ...msg, p: hoisted.payload, bin }));
 }
 var binaryId = 0;
 function nextBinaryId() {
@@ -11020,19 +11321,19 @@ function nextBinaryId() {
 
 class BinaryHolder {
   held = null;
-  hold(frame2) {
+  hold(frame) {
     if (this.held)
       throw new WireError("the peer sent two binary frames with no control frame between them");
-    this.held = { id: frame2.id, bytes: frame2.bytes };
+    this.held = { id: frame.id, bytes: frame.bytes };
   }
   claim(msg, kind, method) {
-    const bin2 = msg.t === "req" || msg.t === "res" || msg.t === "push" ? msg.bin : undefined;
+    const bin = msg.t === "req" || msg.t === "res" || msg.t === "push" ? msg.bin : undefined;
     const body = msg.t === "req" ? msg.p : msg.t === "res" ? msg.r : msg.t === "push" ? msg.p : null;
-    if (bin2 === undefined)
+    if (bin === undefined)
       return body;
     const held = this.held;
     this.held = null;
-    if (!held || held.id !== bin2)
+    if (!held || held.id !== bin)
       throw new WireError("the peer claimed a binary frame that did not arrive");
     const path = binaryPath(kind, method);
     if (!path)
@@ -11114,7 +11415,7 @@ function serverConnection(duplex, opts) {
   const silentMs = opts.silentMs ?? SILENT_MS2;
   let heardFromClient = false;
   let stopWatching = null;
-  const decoder2 = new FrameDecoder;
+  const decoder = new FrameDecoder;
   const incoming = new BinaryHolder;
   let handlers = null;
   let greeted = false;
@@ -11122,10 +11423,10 @@ function serverConnection(duplex, opts) {
   let peerDevice = "";
   let peerLabel = "";
   let peerHold = 0;
-  let open2 = true;
+  let open = true;
   const waiting = [];
   let settle;
-  const closed = new Promise((resolve11) => settle = resolve11);
+  const closed = new Promise((resolve) => settle = resolve);
   function raw(bytes) {
     try {
       duplex.write(bytes);
@@ -11135,7 +11436,7 @@ function serverConnection(duplex, opts) {
     }
   }
   function send(msg, method = "") {
-    if (!open2)
+    if (!open)
       return;
     if (msg.t !== "push" || msg.m !== "terminalOutput")
       flushOutput();
@@ -11145,11 +11446,11 @@ function serverConnection(duplex, opts) {
       raw(encodeControl(msg));
   }
   function close(why, back = false) {
-    if (!open2)
+    if (!open)
       return;
     if (why !== undefined)
       send({ t: "bye", why, ...back ? { back: true } : {} });
-    open2 = false;
+    open = false;
     stopWatching?.();
     stopWatching = null;
     stopCoalescing();
@@ -11188,7 +11489,7 @@ function serverConnection(duplex, opts) {
     heldBytes = 0;
   }
   function pushOutput(p) {
-    if (!open2)
+    if (!open)
       return;
     const bytes = fromBase64(p.dataB64);
     if (bytes.length === 0)
@@ -11256,18 +11557,18 @@ function serverConnection(duplex, opts) {
     heardFromClient = true;
     let frames;
     try {
-      frames = decoder2.push(chunk);
+      frames = decoder.push(chunk);
     } catch (err) {
       console.error("[wire]", err instanceof Error ? err.message : err);
       return close(err instanceof WireError ? err.message : "unreadable frame");
     }
-    for (const frame2 of frames) {
+    for (const frame of frames) {
       try {
-        if (frame2.type === 1) {
-          incoming.hold(frame2);
+        if (frame.type === 1) {
+          incoming.hold(frame);
           continue;
         }
-        handle(parseControl(frame2.text));
+        handle(parseControl(frame.text));
         if (!incoming.idle())
           throw new WireError("the peer sent bytes that no control frame claimed");
       } catch (err) {
@@ -11277,7 +11578,7 @@ function serverConnection(duplex, opts) {
     }
   };
   duplex.onClose = () => {
-    open2 = false;
+    open = false;
     stopWatching?.();
     stopWatching = null;
     stopCoalescing();
@@ -11448,13 +11749,13 @@ function createOpLog(opts) {
     }
   }
   return {
-    run(key2, exec) {
-      const hit = seen.get(key2);
+    run(key, exec) {
+      const hit = seen.get(key);
       if (hit)
         return hit.result;
       const result = exec();
       result.catch(() => {});
-      seen.set(key2, { at: now(), result });
+      seen.set(key, { at: now(), result });
       evict();
       return result;
     },
@@ -11463,7 +11764,7 @@ function createOpLog(opts) {
 }
 
 // src/shared/version.ts
-var BUILD_VERSION = "0.0.3";
+var BUILD_VERSION = "0.1.1";
 
 // src/bun/daemon.ts
 var SOCKET_PATH = join16(APP_HOME, ".server.sock");
@@ -11494,10 +11795,10 @@ async function startDaemon(opts = {}) {
   const ops = createOpLog();
   const instance = crypto.randomUUID();
   const server = await createServer({ push });
-  let idleTimer2 = null;
+  let idleTimer = null;
   let heldUntil = 0;
   let settleDone;
-  const done = new Promise((resolve11) => settleDone = resolve11);
+  const done = new Promise((resolve) => settleDone = resolve);
   let stopped = false;
   const listener = Bun.listen({
     unix: socketPath,
@@ -11542,9 +11843,9 @@ async function startDaemon(opts = {}) {
     console.error("[daemon] could not write the pid file:", err);
   }
   function accept(io) {
-    if (idleTimer2) {
-      clearTimeout(idleTimer2);
-      idleTimer2 = null;
+    if (idleTimer) {
+      clearTimeout(idleTimer);
+      idleTimer = null;
     }
     const greet = () => {
       const id = conn.client();
@@ -11574,15 +11875,15 @@ async function startDaemon(opts = {}) {
   }
   let leaving = false;
   function armIdleExit() {
-    if (stopped || idleTimer2 || leaving || idleMs <= 0)
+    if (stopped || idleTimer || leaving || idleMs <= 0)
       return;
     const held = server.sessionsOpen() ? heldUntil - Date.now() : 0;
     const wait = Math.max(idleMs, held);
     if (wait !== idleMs) {
       console.error(`[daemon] holding sessions for ${wait >= 1e4 ? `${Math.round(wait / 1000)}s` : `${wait}ms`}`);
     }
-    idleTimer2 = setTimeout(async () => {
-      idleTimer2 = null;
+    idleTimer = setTimeout(async () => {
+      idleTimer = null;
       if (clients.size > 0)
         return;
       if (server.running())
@@ -11626,8 +11927,8 @@ async function startDaemon(opts = {}) {
     if (stopped)
       return;
     stopped = true;
-    if (idleTimer2)
-      clearTimeout(idleTimer2);
+    if (idleTimer)
+      clearTimeout(idleTimer);
     for (const conn of accepted) {
       if (clients.get(conn.client()) === conn)
         conn.close("this server is shutting down", true);
@@ -11685,9 +11986,9 @@ async function tryConnect(socketPath) {
       socket: {
         data: (_s, chunk) => io?.feed(new Uint8Array(chunk)),
         drain: () => out?.drain(),
-        end: (s2) => {
+        end: (s) => {
           io?.finish();
-          s2.end();
+          s.end();
         },
         close: () => io?.finish(),
         error: () => io?.finish()
@@ -11726,7 +12027,7 @@ function daemonPid(pidPath = PID_PATH) {
 
 // src/bun/backupCli.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 import { join as join19 } from "path";
 
 // src/bun/ask.ts
@@ -11734,7 +12035,7 @@ var reader = null;
 var pending = "";
 async function readLine() {
   reader ??= Bun.stdin.stream().getReader();
-  const decoder2 = new TextDecoder;
+  const decoder = new TextDecoder;
   for (;; ) {
     const nl = pending.indexOf(`
 `);
@@ -11749,7 +12050,7 @@ async function readLine() {
       pending = "";
       return line;
     }
-    pending += decoder2.decode(value, { stream: true });
+    pending += decoder.decode(value, { stream: true });
   }
 }
 async function readHidden() {
@@ -11791,9 +12092,9 @@ async function ask(question, o = {}) {
 // src/bun/backup.ts
 import { join as join17 } from "path";
 function backupSet(input) {
-  const { appHome, profilesDir, roots: roots2, secrets } = input;
+  const { appHome, profilesDir, roots, secrets } = input;
   const include = [appHome];
-  for (const root of roots2)
+  for (const root of roots)
     if (!isInside(appHome, root))
       include.push(root);
   if (secrets && !include.some((p) => isInside(p, profilesDir)))
@@ -11832,9 +12133,9 @@ function backupProfileText(vars) {
     `# RESTIC_PASSWORD is the only key to the backup. Keep a copy somewhere else.`,
     ``
   ];
-  for (const [key2, value] of Object.entries(vars)) {
+  for (const [key, value] of Object.entries(vars)) {
     const quoted = value !== value.trim() || /^["']/.test(value) ? `"${value.replace(/["\\]/g, "\\$&")}"` : value;
-    lines.push(`${key2}=${quoted}`);
+    lines.push(`${key}=${quoted}`);
   }
   lines.push(``);
   return lines.join(`
@@ -11893,7 +12194,7 @@ function parseState(text) {
     return {
       ...EMPTY_STATE,
       ...raw,
-      skipped: Array.isArray(raw.skipped) ? raw.skipped.filter((s2) => typeof s2?.root === "string" && typeof s2?.since === "string") : []
+      skipped: Array.isArray(raw.skipped) ? raw.skipped.filter((s) => typeof s?.root === "string" && typeof s?.since === "string") : []
     };
   } catch {
     return EMPTY_STATE;
@@ -11901,7 +12202,7 @@ function parseState(text) {
 }
 function recordRun(prev, o) {
   const at = o.at.toISOString();
-  const since = new Map(prev.skipped.map((s2) => [s2.root, s2.since]));
+  const since = new Map(prev.skipped.map((s) => [s.root, s.since]));
   return {
     version: 1,
     lastRun: at,
@@ -12008,16 +12309,16 @@ function parseBackupOutput(stdout) {
 function parseSnapshots(stdout) {
   try {
     const raw = JSON.parse(stdout);
-    return raw.filter((s2) => typeof s2.short_id === "string" && typeof s2.time === "string").map((s2) => ({ short_id: s2.short_id, time: s2.time, hostname: s2.hostname ?? "", paths: s2.paths ?? [] }));
+    return raw.filter((s) => typeof s.short_id === "string" && typeof s.time === "string").map((s) => ({ short_id: s.short_id, time: s.time, hostname: s.hostname ?? "", paths: s.paths ?? [] }));
   } catch {
     return [];
   }
 }
-function statusLines(s2) {
+function statusLines(s) {
   const lines = [];
-  lines.push(`repository   ${s2.repository ?? "none: run `ledge backup setup`"}`);
-  lines.push(`restic       ${"path" in s2.restic ? `${s2.restic.version} at ${s2.restic.path}` : s2.restic.missing}`);
-  const { state, now } = s2;
+  lines.push(`repository   ${s.repository ?? "none: run `ledge backup setup`"}`);
+  lines.push(`restic       ${"path" in s.restic ? `${s.restic.version} at ${s.restic.path}` : s.restic.missing}`);
+  const { state, now } = s;
   if (!state.lastRun)
     lines.push(`last backup  never`);
   else if (state.lastOk === state.lastRun)
@@ -12026,17 +12327,17 @@ function statusLines(s2) {
     lines.push(`last backup  ${ago(state.lastRun, now)}, FAILED: ${state.lastError ?? "unknown"}`);
     lines.push(`last good    ${state.lastOk ? ago(state.lastOk, now) : "never"}`);
   }
-  if (s2.repository) {
-    lines.push(s2.daemonUp ? `next backup  ${nextDue(state, now).getTime() <= now.getTime() ? "due now" : `in ${duration(nextDue(state, now).getTime() - now.getTime())}`} (the server is running)` : `next backup  when the server next runs, and hourly while it does`);
+  if (s.repository) {
+    lines.push(s.daemonUp ? `next backup  ${nextDue(state, now).getTime() <= now.getTime() ? "due now" : `in ${duration(nextDue(state, now).getTime() - now.getTime())}`} (the server is running)` : `next backup  when the server next runs, and hourly while it does`);
   }
   for (const k of state.skipped)
     lines.push(`SKIPPED      ${k.root} (not on disk since ${ago(k.since, now)})`);
   return lines;
 }
-function ago(iso2, now) {
-  const ms = now.getTime() - Date.parse(iso2);
+function ago(iso, now) {
+  const ms = now.getTime() - Date.parse(iso);
   if (!Number.isFinite(ms))
-    return iso2;
+    return iso;
   if (ms < 60000)
     return "just now";
   return `${duration(ms)} ago`;
@@ -12086,16 +12387,16 @@ function fetchedResticPath(version = RESTIC_VERSION) {
 async function findRestic(opts = {}) {
   const onPath = Bun.which("restic", { PATH: process.env["PATH"] ?? "" });
   if (onPath) {
-    const version2 = await versionOf(onPath);
-    if (version2 && versionAtLeast(version2, RESTIC_MIN_VERSION))
-      return { path: onPath, version: version2 };
-    opts.log?.(`[backup] ${onPath} is restic ${version2 ?? "of an unknown version"}; ${RESTIC_MIN_VERSION} or newer is needed`);
+    const version = await versionOf(onPath);
+    if (version && versionAtLeast(version, RESTIC_MIN_VERSION))
+      return { path: onPath, version };
+    opts.log?.(`[backup] ${onPath} is restic ${version ?? "of an unknown version"}; ${RESTIC_MIN_VERSION} or newer is needed`);
   }
   const fetched = fetchedResticPath();
   if (existsSync2(fetched)) {
-    const version2 = await versionOf(fetched);
-    if (version2)
-      return { path: fetched, version: version2 };
+    const version = await versionOf(fetched);
+    if (version)
+      return { path: fetched, version };
   }
   if (!opts.fetch) {
     return { missing: onPath ? `restic on the PATH is too old and none has been fetched: run \`ledge backup setup\`` : "restic is not installed: run `ledge backup setup`" };
@@ -12442,14 +12743,14 @@ async function paths(args) {
 async function setup(args) {
   const existing = args.includes("--existing");
   const fromEnv = args.includes("--from-env");
-  const replace2 = args.includes("--replace");
+  const replace = args.includes("--replace");
   const repoFlag = valueOf(args, "--repository");
   if (!fromEnv && !process.stdin.isTTY) {
     say("ledge backup setup asks questions, and stdin is not a terminal. Pass --from-env with the variables set instead.");
     return 2;
   }
   const already = configured();
-  if (already && !replace2) {
+  if (already && !replace) {
     say(`Backups are already set up here, to ${already.repository}. \`ledge backup status\` shows how they are going; \`ledge backup setup --replace\` starts over.`);
     return 1;
   }
@@ -12564,10 +12865,11 @@ That repository already has backups in it. Run setup again with --existing and i
   say(`The repository and its credentials are in ${PROFILE_PATH}, the "${BACKUP_PROFILE}" profile.`);
   if (generated) {
     say("");
-    say("This is the password that encrypts the backup. Keep a copy somewhere that is not this machine:");
-    say("a restore starts on a machine with nothing on it, and a password stored only here is a backup you cannot open.");
-    say("");
+    process.stderr.write("SAVE THIS PASSWORD: ");
     out(generated);
+    say("");
+    say("It is the only key to the backup, and nothing can be restored without it.");
+    say("Keep a copy somewhere that is not this machine, such as a password manager.");
   }
   return 0;
 }
@@ -12607,8 +12909,8 @@ async function snapshots() {
     say("no snapshots yet");
     return 1;
   }
-  for (const s2 of r.snapshots)
-    out(`${s2.short_id}  ${snapshotTime(s2.time)}  ${s2.hostname}  ${s2.paths.length} path${s2.paths.length === 1 ? "" : "s"}`);
+  for (const s of r.snapshots)
+    out(`${s.short_id}  ${snapshotTime(s.time)}  ${s.hostname}  ${s.paths.length} path${s.paths.length === 1 ? "" : "s"}`);
   return 0;
 }
 function snapshotTime(time) {
@@ -12630,7 +12932,7 @@ async function restore(args) {
   const to = valueOf(args, "--to");
   if (inPlace && to)
     return usage("--in-place restores to the original paths; --to names another folder. One or the other.");
-  const target = inPlace ? "/" : to ?? join19(homedir7(), `ledge-restore-${stamp(new Date)}`);
+  const target = inPlace ? "/" : to ?? join19(homedir8(), `ledge-restore-${stamp(new Date)}`);
   const include = args.filter((a, i) => !a.startsWith("--") && args[i - 1] !== "--snapshot" && args[i - 1] !== "--to");
   if (inPlace && daemonRunning()) {
     say(`This machine's Ledge server is running, and an in-place restore writes under it. Quit Ledge, or stop the daemon (kill $(cat ${PID_PATH})), and run this again.`);
@@ -13112,14 +13414,14 @@ function getTotalBits(segs, version) {
   }
   return result;
 }
-function toUtf8ByteArray(str2) {
-  str2 = encodeURI(str2);
+function toUtf8ByteArray(str) {
+  str = encodeURI(str);
   const result = [];
-  for (let i = 0;i < str2.length; i++) {
-    if (str2.charAt(i) !== "%") {
-      result.push(str2.charCodeAt(i));
+  for (let i = 0;i < str.length; i++) {
+    if (str.charAt(i) !== "%") {
+      result.push(str.charCodeAt(i));
     } else {
-      result.push(Number.parseInt(str2.substring(i + 1, i + 3), 16));
+      result.push(Number.parseInt(str.substring(i + 1, i + 3), 16));
       i += 2;
     }
   }
@@ -13339,7 +13641,7 @@ var KEYGEN_PATH = "/usr/bin/ssh-keygen";
 var HOST_KEY_DIR = "/etc/ssh";
 var FLAGS = ["user", "host", "port", "keys"];
 function parsePairArgs(args) {
-  const out2 = {};
+  const out = {};
   for (let i = 0;i < args.length; i++) {
     const arg = args[i];
     const eq = arg.indexOf("=");
@@ -13350,9 +13652,9 @@ function parsePairArgs(args) {
     const value = eq < 0 ? args[++i] : arg.slice(eq + 1);
     if (value === undefined || value === "")
       return { error: `--${flag} needs a value.` };
-    out2[flag] = value;
+    out[flag] = value;
   }
-  return out2;
+  return out;
 }
 function sshServerAddress(sshConnection) {
   const parts = (sshConnection ?? "").trim().split(/\s+/);
@@ -13402,14 +13704,14 @@ var NOTES = {
   name: "this machine's name"
 };
 function addressCandidates(inputs) {
-  const out2 = [];
+  const out = [];
   const seen = new Set;
   const add = (host, source, note) => {
-    const key2 = host.toLowerCase();
-    if (host === "" || seen.has(key2))
+    const key = host.toLowerCase();
+    if (host === "" || seen.has(key))
       return;
-    seen.add(key2);
-    out2.push({ host, source, note });
+    seen.add(key);
+    out.push({ host, source, note });
   };
   if (inputs.tailnet?.name)
     add(inputs.tailnet.name, "tailnet", NOTES.tailnetName);
@@ -13437,18 +13739,18 @@ function addressCandidates(inputs) {
     if (addressKind(i.address) === "private")
       add(i.address, "interface", NOTES.private(i.name));
   add(inputs.hostname, "name", NOTES.name);
-  return out2;
+  return out;
 }
 function tailscaleSelf(json) {
-  let status2;
+  let status;
   try {
-    status2 = JSON.parse(json);
+    status = JSON.parse(json);
   } catch {
     return null;
   }
-  if (typeof status2 !== "object" || status2 === null)
+  if (typeof status !== "object" || status === null)
     return null;
-  const { BackendState, Self } = status2;
+  const { BackendState, Self } = status;
   if (BackendState !== "Running" || typeof Self !== "object" || Self === null)
     return null;
   const name = typeof Self.DNSName === "string" ? Self.DNSName.replace(/\.$/, "") : "";
@@ -13598,14 +13900,14 @@ function othersNote(others) {
 function pairReport({ code, keys, note, columns }) {
   const link = pairingLink(code);
   const width = terminalQRWidth(link);
-  const out2 = [];
+  const out = [];
   if (columns !== undefined && columns < width) {
-    out2.push(`This terminal is ${columns} columns wide, and the code needs ${width}. Widen it and run pair again.`);
+    out.push(`This terminal is ${columns} columns wide, and the code needs ${width}. Widen it and run pair again.`);
   } else {
-    out2.push(...terminalQR(link));
+    out.push(...terminalQR(link));
   }
-  out2.push("", "Scan the code with Ledge on your phone, or paste the link below into the Mac app's Add Server form. It names this server and its host keys, and holds no password or key.", "", `  Account    ${code.user}`, `  Host       ${code.host}${note === "" ? "" : ` (${note})`}`, `  Port       ${code.port === PORT_UNSET ? DEFAULT_PORT : code.port}`, ...keys.map((k, i) => `  ${i === 0 ? "Host keys" : "         "}  ${k.fingerprint} (${k.keyType})`), "", link);
-  return `${out2.join(`
+  out.push("", "Scan the code with Ledge on your phone, or paste the link below into the Mac app's Add Server form. It names this server and its host keys, and holds no password or key.", "", `  Account    ${code.user}`, `  Host       ${code.host}${note === "" ? "" : ` (${note})`}`, `  Port       ${code.port === PORT_UNSET ? DEFAULT_PORT : code.port}`, ...keys.map((k, i) => `  ${i === 0 ? "Host keys" : "         "}  ${k.fingerprint} (${k.keyType})`), "", link);
+  return `${out.join(`
 `)}
 `;
 }
@@ -13623,7 +13925,7 @@ async function serve2() {
   const upstream = await connectToDaemon();
   const mine = stdioDuplex();
   let over;
-  const done = new Promise((resolve11) => over = resolve11);
+  const done = new Promise((resolve) => over = resolve);
   let ended = false;
   const end = () => {
     if (ended)
@@ -13640,7 +13942,7 @@ async function serve2() {
   mine.onClose = end;
   console.error(`[serve] ledge ${BUILD_VERSION} attached to ${SOCKET_PATH}`);
   await done;
-  await new Promise((resolve11) => process.stdout.write("", () => resolve11()));
+  await new Promise((resolve) => process.stdout.write("", () => resolve()));
 }
 async function daemon(autostart = false) {
   const idleMs = autostart ? IDLE_EXIT_MS : IDLE_EXIT_NEVER;
@@ -13656,9 +13958,9 @@ async function daemon(autostart = false) {
   backups.stop();
 }
 async function pair(argv) {
-  const fail2 = (message, status2 = 1) => {
+  const fail = (message, status = 1) => {
     console.error(message);
-    return status2;
+    return status;
   };
   if (argv.includes("--help") || argv.includes("-h")) {
     process.stdout.write(`${PAIR_USAGE}
@@ -13667,12 +13969,12 @@ async function pair(argv) {
   }
   const args = parsePairArgs(argv.slice(3));
   if ("error" in args)
-    return fail2(`${args.error}
+    return fail(`${args.error}
 ${PAIR_USAGE}`, 2);
   if (existsSync3("/.dockerenv") || existsSync3("/run/.containerenv")) {
     const refusal = containerRefusal(args);
     if (refusal)
-      return fail2(refusal);
+      return fail(refusal);
   }
   const candidates = args.host === undefined ? await gatherCandidates() : [];
   const interactive = args.host === undefined && args.keys !== "-" && process.stdin.isTTY && process.stdout.isTTY;
@@ -13683,7 +13985,7 @@ ${PAIR_USAGE}`, 2);
   }
   const address = pairAddress(args, process.env.SSH_CONNECTION, candidates, answer);
   if ("error" in address)
-    return fail2(address.error, 2);
+    return fail(address.error, 2);
   if (!interactive)
     process.stderr.write(othersNote(candidates.filter((c) => c.host !== address.host)));
   let keyText = "";
@@ -13693,7 +13995,7 @@ ${PAIR_USAGE}`, 2);
     try {
       keyText = readFileSync4(args.keys, "utf8");
     } catch {
-      return fail2(`Could not read ${args.keys}.`);
+      return fail(`Could not read ${args.keys}.`);
     }
   } else {
     const files = existsSync3(HOST_KEY_DIR) ? readdirSync(HOST_KEY_DIR).filter((f) => /^ssh_host_\w+_key\.pub$/.test(f)) : [];
@@ -13704,7 +14006,7 @@ ${PAIR_USAGE}`, 2);
       } catch {}
     }
     if (keyText.trim() === "") {
-      return fail2(`There are no sshd host keys in ${HOST_KEY_DIR}. If sshd keeps them elsewhere, pass the .pub file with --keys.`);
+      return fail(`There are no sshd host keys in ${HOST_KEY_DIR}. If sshd keeps them elsewhere, pass the .pub file with --keys.`);
     }
   }
   let described;
@@ -13715,18 +14017,18 @@ ${PAIR_USAGE}`, 2);
     described = await new Response(p.stdout).text();
     await p.exited;
   } catch (err) {
-    return fail2(`Could not run ssh-keygen (${err instanceof Error ? err.message : String(err)}).`);
+    return fail(`Could not run ssh-keygen (${err instanceof Error ? err.message : String(err)}).`);
   }
   const keys = phoneHostKeys(described);
   if (keys.length === 0) {
     if (!described.includes("SHA256:"))
-      return fail2(`${args.keys === "-" ? "stdin" : args.keys ?? HOST_KEY_DIR} holds no public host keys.`);
-    return fail2(`None of these host keys is Ed25519 or ECDSA, and those are the kinds Ledge on a phone can check.
+      return fail(`${args.keys === "-" ? "stdin" : args.keys ?? HOST_KEY_DIR} holds no public host keys.`);
+    return fail(`None of these host keys is Ed25519 or ECDSA, and those are the kinds Ledge on a phone can check.
 ` + "`sudo ssh-keygen -A` creates the missing default keys. Restart sshd after it.");
   }
   const code = pairCode(args.user ?? userInfo().username, address, keys);
   if ("error" in code)
-    return fail2(code.error);
+    return fail(code.error);
   const columns = process.stdout.isTTY ? process.stdout.columns : undefined;
   process.stdout.write(pairReport({ code, keys, note: address.note, columns }));
   return 0;
@@ -13743,13 +14045,13 @@ async function gatherCandidates() {
 }
 var LOOKUP_MS = 1500;
 function dmi() {
-  const out2 = {};
+  const out = {};
   for (const field of DMI_FIELDS) {
     try {
-      out2[field] = readFileSync4(join20(DMI_DIR, field), "utf8");
+      out[field] = readFileSync4(join20(DMI_DIR, field), "utf8");
     } catch {}
   }
-  return out2;
+  return out;
 }
 async function tailnetSelf() {
   const path = TAILSCALE_PATHS.find((p) => existsSync3(p));
@@ -13820,8 +14122,8 @@ async function main(argv) {
 if (import.meta.main)
   await main(process.argv);
 export {
-  serve2 as serve,
-  pair,
+  daemon,
   main,
-  daemon
+  pair,
+  serve2 as serve
 };