papilot 0.3.0 → 0.5.0

package/src/server/changes.ts

@@ -0,0 +1,295 @@
+import { createHash, randomUUID } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { DATA, ENGINE } from './paths.ts';
+import { mergeInProgress, workingTree } from './manuscript.ts';
+import { ignorePattern } from '../commit.ts';
+
+// The manuscript's uncommitted changes as a PDF comparison: the last commit
+// against the working tree, rendered by the review engine like a task's round
+// and shown in its viewer. Each change can be staged or unstaged in the real
+// index, or reverted on disk; a revert can be undone. A commit then takes what
+// is staged, so one set of edits can become several commits.
+
+type Op = ['equal' | 'replace' | 'insert' | 'delete', number, number, number, number];
+export interface Unit { id: string; file: string; status: 'added' | 'deleted' | 'modified'; kind: string; whole_file: boolean; ops: Op[]; old_start: number; old_end: number; new_start: number; new_end: number; old_text: string; new_text: string; truncated: boolean }
+type Decision = 'pending' | 'accepted' | 'rejected' | 'commented';
+export type ChangeAction = 'stage' | 'unstage' | 'revert';
+interface Round { number: number; before: string; after: string; units: Unit[]; folder: string; warnings: string[]; decisions: Record<string, Decision> }
+interface Job { key: string; phase: 'build' | 'render'; status: 'running' | 'failed'; created: number; error?: string; details?: string[]; log?: string }
+interface Snapshot { before: string | null; after: string }
+interface Entry { mode: string; sha: string }
+interface Revert { id: string; files: { path: string; disk: Buffer | null; written: Buffer | null; index: Entry | null; indexAfter: Entry | null }[]; signatures: string[] }
+interface Comparison { rounds: Round[]; job: Job | null; next: number; undo: Revert | null; reverted: Set<string>; snapshot?: { at: number; value: Promise<Snapshot> }; current?: { key: string; units: Unit[] } }
+
+const conflict = (message: string) => Object.assign(new Error(message), { statusCode: 409 });
+
+async function engine() {
+  const load = (file: string) => import(pathToFileURL(path.join(ENGINE, file)).href);
+  const [{ Builder, BuildError }, { Repo }, { loadProject, isFigure }, { diffUnits, revertUnits, splitLines, textOf }, { opcodes }, { render }] = await Promise.all(
+    ['src/core/build.ts', 'src/core/git.ts', 'src/core/config.ts', 'src/core/changes.ts', 'src/core/diff.ts', 'src/core/publish.ts'].map(load));
+  return { Builder, BuildError, Repo, loadProject, isFigure, diffUnits, revertUnits, splitLines, textOf, opcodes, render } as {
+    Builder: any; BuildError: any; Repo: any; loadProject: (root: string) => any; isFigure: (project: any, file: string) => boolean;
+    diffUnits: (repo: any, before: string, after: string, isFigure: (file: string) => boolean) => Unit[];
+    revertUnits: (old: Buffer | null, next: Buffer | null, units: Unit[]) => Buffer | null;
+    splitLines: (text: string) => string[]; textOf: (data: Buffer | null) => string | null;
+    opcodes: (a: string[], b: string[]) => Op[]; render: (output: string, request: unknown) => Promise<void>;
+  };
+}
+
+// A change is the same change in a later comparison when it replaces the same
+// committed lines with the same text; reverting another change leaves both.
+export const signature = (unit: Unit) => createHash('sha256').update(JSON.stringify([unit.file, unit.status, unit.old_start, unit.old_end, unit.old_text, unit.new_text])).digest('hex').slice(0, 24);
+
+// Where a change sits in the committed file and in the working file, as line ranges.
+const headRange = (unit: Unit): [number, number] => [unit.ops[0][1], unit.ops[unit.ops.length - 1][2]];
+const workRange = (unit: Unit): [number, number] => [unit.ops[0][3], unit.ops[unit.ops.length - 1][4]];
+// Two line ranges meet when they overlap, or when one is empty and sits inside or at the edge of the other.
+const meets = ([a, b]: [number, number], [c, d]: [number, number]) => a === b || c === d ? a <= d && c <= b : a < d && c < b;
+
+// The index's lines with one change's working-tree lines staged: every
+// difference between the index and the working file inside the change.
+export function stageLines(index: string[], work: string[], range: [number, number], opcodes: (a: string[], b: string[]) => Op[]) {
+  const result = [...index];
+  for (const [tag, i, j, x, y] of opcodes(index, work).reverse()) if (tag !== 'equal' && meets([x, y], range)) result.splice(i, j - i, ...work.slice(x, y));
+  return result;
+}
+// The index's lines with one change unstaged: the committed lines back in its place.
+export function unstageLines(head: string[], index: string[], range: [number, number], opcodes: (a: string[], b: string[]) => Op[]) {
+  const result = [...index];
+  for (const [tag, i, j, x, y] of opcodes(head, index).reverse()) if (tag !== 'equal' && meets([i, j], range)) result.splice(x, y - x, ...head.slice(i, j));
+  return result;
+}
+// A change is staged when the index already has the working tree's text there.
+export const stagedLines = (index: string[], work: string[], range: [number, number], opcodes: (a: string[], b: string[]) => Op[]) =>
+  !opcodes(index, work).some(([tag, , , x, y]) => tag !== 'equal' && meets([x, y], range));
+
+// A path's index entry, if it has one.
+function indexEntry(repo: any, file: string): Entry | null {
+  const [mode, sha] = repo.text(['ls-files', '-s', '-z', '--', file]).split(/\s+/);
+  return sha ? { mode, sha } : null;
+}
+const same = (a: Buffer | null, b: Buffer | null) => a === null || b === null ? a === b : a.equals(b);
+const readBytes = (file: string) => { try { return fs.readFileSync(file); } catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null; throw error; } };
+
+export class Changes {
+  private comparisons = new Map<string, Comparison>();
+  constructor(private dir = path.join(DATA, 'changes')) { fs.rmSync(dir, { recursive: true, force: true }); }
+
+  private comparison(projectId: string) {
+    let comparison = this.comparisons.get(projectId);
+    if (!comparison) this.comparisons.set(projectId, comparison = { rounds: [], job: null, next: 1, undo: null, reverted: new Set() });
+    return comparison;
+  }
+
+  // The last commit's tree and the working tree, read at most once a second.
+  private snapshot(projectId: string, root: string, fresh = false): Promise<Snapshot> {
+    const comparison = this.comparison(projectId);
+    if (!fresh && comparison.snapshot && Date.now() - comparison.snapshot.at < 1000) return comparison.snapshot.value;
+    const value = (async () => {
+      const { Repo } = await engine(), repo = new Repo(root);
+      return { before: repo.hasHead() ? repo.treeId('HEAD') : null, after: await workingTree(root) };
+    })();
+    comparison.snapshot = { at: Date.now(), value };
+    value.catch(() => { if (comparison.snapshot?.value === value) comparison.snapshot = undefined; });
+    return value;
+  }
+
+  // The changes between the two trees, leaving out untracked build output,
+  // which the Git panel offers to ignore.
+  private async units(projectId: string, root: string, snapshot: Snapshot) {
+    const comparison = this.comparison(projectId), key = `${snapshot.before}:${snapshot.after}`;
+    if (comparison.current?.key === key) return comparison.current.units;
+    const { Repo, loadProject, isFigure, diffUnits } = await engine(), project = loadProject(root);
+    const units = diffUnits(new Repo(root), snapshot.before!, snapshot.after, file => isFigure(project, file)).filter(unit => !(unit.status === 'added' && ignorePattern(unit.file)));
+    comparison.current = { key, units };
+    return units;
+  }
+
+  // Which of the current changes are staged, read from the index.
+  private async staged(root: string, snapshot: Snapshot, units: Unit[]) {
+    const { Repo, splitLines, textOf, opcodes } = await engine(), repo = new Repo(root);
+    const files = [...new Set(units.map(unit => unit.file))];
+    const work = repo.blobs(snapshot.after, files), index = repo.blobs('', files);
+    const staged = new Set<string>();
+    for (const unit of units) {
+      const ready = unit.whole_file ? same(index[unit.file], work[unit.file])
+        : index[unit.file] !== null && stagedLines(splitLines(textOf(index[unit.file]) ?? ''), splitLines(textOf(work[unit.file]) ?? ''), workRange(unit), opcodes);
+      if (ready) staged.add(unit.id);
+    }
+    return staged;
+  }
+
+  // Compile both trees once the working tree or the last commit changes, and
+  // render their comparison. The previous comparison stays readable meanwhile.
+  private schedule(projectId: string, root: string, snapshot: Snapshot) {
+    const comparison = this.comparison(projectId), latest = comparison.rounds.at(-1), key = `${snapshot.before}:${snapshot.after}`;
+    if (!snapshot.before || (latest && `${latest.before}:${latest.after}` === key) || comparison.job?.status === 'running' || comparison.job?.key === key) return;
+    const job: Job = { key, phase: 'build', status: 'running', created: Date.now() };
+    comparison.job = job;
+    void (async () => {
+      const { Builder, BuildError, Repo, loadProject, render } = await engine();
+      const project = loadProject(root), repo = new Repo(root), number = comparison.next++;
+      const units = await this.units(projectId, root, snapshot), folder = path.join(this.dir, projectId, String(number));
+      let warnings: string[] = [];
+      fs.rmSync(folder, { recursive: true, force: true }); fs.mkdirSync(folder, { recursive: true });
+      if (units.length) {
+        const builder = new Builder(project, repo);
+        const build = async (tree: string, what: string) => {
+          try { return await builder.build(tree, ['full']); }
+          catch (error) { throw error instanceof BuildError ? Object.assign(new Error(what), { details: (error as any).details, log: (error as any).log }) : error; }
+        };
+        const old = await build(snapshot.before!, 'The last commit could not be compiled.'), next = await build(snapshot.after, 'The working tree could not be compiled.');
+        job.phase = 'render';
+        await render(folder, { main: project.main, source_dir: project.source_dir, figures: project.figures, old, new: next, units });
+        warnings = next.warnings.filter((warning: string) => !old.warnings.includes(warning));
+      } else fs.writeFileSync(path.join(folder, 'round.json'), JSON.stringify({ units: {}, sections: [], loose: [] }));
+      comparison.rounds.push({ number, before: snapshot.before!, after: snapshot.after, units, folder, warnings, decisions: {} });
+      // The viewer may still show the round before; older ones go.
+      for (const old of comparison.rounds.splice(0, Math.max(0, comparison.rounds.length - 3))) fs.rmSync(old.folder, { recursive: true, force: true });
+      if (comparison.job === job) comparison.job = null;
+    })().catch(error => {
+      const detail = error as { message?: string; details?: string[]; log?: string };
+      Object.assign(job, { status: 'failed', error: detail.message || 'The comparison could not be built.', details: detail.details || [], ...(detail.log ? { log: detail.log } : {}) });
+    });
+  }
+
+  // What the viewer polls, in the review engine's page state shape: the
+  // latest comparison, and for the round it shows, which changes are staged
+  // (accepted), unstaged (pending), reverted (rejected) or edited since.
+  async state(projectId: string, root: string, csrf: string, number?: number) {
+    const comparison = this.comparison(projectId), snapshot = await this.snapshot(projectId, root);
+    this.schedule(projectId, root, snapshot);
+    const latest = comparison.rounds.at(-1) ?? null, round = comparison.rounds.find(item => item.number === number) ?? latest;
+    let decisionLock: string | null = mergeInProgress(root) ? 'Finish or abort the merge in the Git panel before staging or reverting changes.' : null;
+    if (round && snapshot.before && round.before === snapshot.before) {
+      const units = await this.units(projectId, root, snapshot), staged = await this.staged(root, snapshot, units);
+      const current = new Map(units.map(unit => [signature(unit), unit]));
+      round.decisions = Object.fromEntries(round.units.map(unit => {
+        const key = signature(unit), found = current.get(key);
+        return [unit.id, found ? (staged.has(found.id) ? 'accepted' : 'pending') : comparison.reverted.has(key) ? 'rejected' : 'commented'];
+      }));
+    } else if (round) decisionLock ??= 'The last commit changed. The comparison is being updated.';
+    const job = comparison.job, decisions = round?.decisions ?? {}, values = Object.values(decisions);
+    const building = job?.status === 'running' && (!latest || job.key !== `${latest.before}:${latest.after}`);
+    const undo = comparison.undo && round ? round.units.filter(unit => comparison.undo!.signatures.includes(signature(unit))).map(unit => unit.id) : [];
+    return {
+      csrf, task: 'changes', title: 'Uncommitted changes', closed: false, decisionLock, commentLock: null,
+      state: !snapshot.before ? 'build_failed' : building || (!latest && job?.status !== 'failed') ? 'building' : job?.status === 'failed' ? 'build_failed' : values.includes('pending') ? 'reviewing' : 'done',
+      latest: latest?.number ?? null, round: round?.number ?? null, revision: round?.after ?? null,
+      decisions, comments: {},
+      undo: comparison.undo ? { id: comparison.undo.id, kind: 'reject', changes: undo } : null,
+      job: !snapshot.before ? { id: 'changes', status: 'failed', phase: 'build', created: 0, ahead: 0, error: 'This repository has no commits yet. Commit once to compare later changes in the PDF.' }
+        : job ? { id: job.key, status: job.status === 'running' ? 'running' : 'failed', phase: job.phase, created: job.created, ahead: 0, ...(job.error ? { error: job.error, details: job.details, log: job.log } : {}) } : null,
+    };
+  }
+
+  detail(projectId: string, number: number) {
+    const round = this.comparison(projectId).rounds.find(item => item.number === number);
+    if (!round) throw Object.assign(new Error('This comparison is out of date. Refresh the page.'), { statusCode: 404 });
+    let render: { units: Record<string, object>; sections: unknown[]; loose: unknown[] } = { units: {}, sections: [], loose: [] };
+    try { render = JSON.parse(fs.readFileSync(path.join(round.folder, 'round.json'), 'utf8')); } catch { /* An empty comparison has no render. */ }
+    return {
+      task: 'changes', round: round.number, before: round.before, after: round.after,
+      units: round.units.map(unit => ({ ...unit, ...render.units[unit.id] })), sections: render.sections, loose: render.loose,
+      warnings: round.warnings, files: `/review/${projectId}/changes/files/${round.number}/`,
+    };
+  }
+
+  file(projectId: string, number: number, name: string) {
+    const round = this.comparison(projectId).rounds.find(item => item.number === number);
+    const file = round && /^[\w.-]+\.(svg|png)$/.test(name) ? path.join(round.folder, name) : '';
+    if (!file || !fs.existsSync(file)) throw Object.assign(new Error('No such file.'), { statusCode: 404 });
+    return file;
+  }
+
+  // The chosen changes of a round the viewer shows, found again among the
+  // changes on disk now. Each must still be there exactly as shown.
+  private async chosen(projectId: string, root: string, number: number, ids: string[]) {
+    const comparison = this.comparison(projectId), round = comparison.rounds.find(item => item.number === number);
+    if (!round) throw conflict('This comparison is out of date. Wait for it to update.');
+    const snapshot = await this.snapshot(projectId, root, true);
+    if (round.before !== snapshot.before) throw conflict('The last commit changed. Wait for the comparison to update.');
+    if (mergeInProgress(root)) throw conflict('Finish or abort the merge in the Git panel before staging or reverting changes.');
+    const current = new Map((await this.units(projectId, root, snapshot)).map(unit => [signature(unit), unit]));
+    const units = ids.map(id => {
+      const shown = round.units.find(unit => unit.id === id);
+      const found = shown && current.get(signature(shown));
+      if (!found) throw conflict(shown ? `${shown.file} changed since this comparison. Wait for it to update.` : 'Select a change from this comparison.');
+      return found;
+    });
+    if (!units.length) throw new Error('Select at least one change.');
+    return { comparison, snapshot, units };
+  }
+
+  // Stage or unstage writes the index only; revert writes the files too, and
+  // keeps what it replaced for undo.
+  async act(projectId: string, root: string, csrf: string, action: ChangeAction, number: number, ids: string[]) {
+    const { comparison, snapshot, units } = await this.chosen(projectId, root, number, ids);
+    const { Repo, splitLines, textOf, opcodes, revertUnits } = await engine(), repo = new Repo(root);
+    const files = [...new Set(units.map(unit => unit.file))];
+    const head = repo.blobs(snapshot.before, files), work = repo.blobs(snapshot.after, files), index = repo.blobs('', files);
+    const lines = (data: Buffer | null) => splitLines(textOf(data) ?? '');
+    const entry = (file: string) => indexEntry(repo, file);
+    const writeIndex = (file: string, text: string[]) => {
+      const mode = entry(file)?.mode || repo.mode(snapshot.before, file) || '100644';
+      repo.run(['update-index', '--add', '--cacheinfo', `${mode},${repo.hashObject(Buffer.from(text.join('')))},${file}`]);
+    };
+    const unstage = (file: string, part: Unit[]) => {
+      if (part.some(unit => unit.whole_file)) { repo.run(['reset', '-q', 'HEAD', '--', file]); return; }
+      if (index[file] === null) return;
+      let next = lines(index[file]);
+      for (const unit of part) next = unstageLines(lines(head[file]), next, headRange(unit), opcodes);
+      if (next.join('') !== lines(index[file]).join('')) writeIndex(file, next);
+    };
+    const revert: Revert = { id: randomUUID(), files: [], signatures: units.map(signature) };
+    for (const file of files) {
+      const part = units.filter(unit => unit.file === file), whole = part.some(unit => unit.whole_file);
+      if (action === 'stage') {
+        if (whole) repo.run(['add', '-A', '--', file]);
+        else {
+          let next = index[file] === null ? lines(head[file]) : lines(index[file]);
+          for (const unit of part) next = stageLines(next, lines(work[file]), workRange(unit), opcodes);
+          writeIndex(file, next);
+        }
+      } else if (action === 'unstage') unstage(file, part);
+      else {
+        const absolute = path.join(root, file), disk = readBytes(absolute), before = entry(file);
+        if (!same(disk, work[file])) throw conflict(`${file} changed on disk since this comparison. Wait for it to update.`);
+        const stat = fs.lstatSync(absolute, { throwIfNoEntry: false });
+        if (stat && !stat.isFile()) throw new Error(`${file} is not a regular file, so it cannot be reverted here.`);
+        if (head[file] === null) { repo.run(['rm', '--cached', '-q', '--ignore-unmatch', '--', file]); fs.rmSync(absolute, { force: true }); }
+        else if (whole) repo.run(['checkout', 'HEAD', '--', file]);
+        else { fs.writeFileSync(absolute, revertUnits(head[file], work[file], part)!); unstage(file, part); }
+        revert.files.push({ path: file, disk, written: readBytes(absolute), index: before, indexAfter: entry(file) });
+      }
+    }
+    if (action === 'revert') { comparison.undo = revert; revert.signatures.forEach(key => comparison.reverted.add(key)); }
+    comparison.snapshot = undefined;
+    return this.state(projectId, root, csrf, number);
+  }
+
+  // Undo puts back what the last revert replaced, unless a file changed since.
+  async undo(projectId: string, root: string, csrf: string, id: string) {
+    const comparison = this.comparison(projectId), revert = comparison.undo;
+    if (!revert || revert.id !== id) throw conflict('There is no revert to undo.');
+    const { Repo } = await engine(), repo = new Repo(root);
+    for (const file of revert.files) if (!same(readBytes(path.join(root, file.path)), file.written)) throw conflict(`${file.path} changed after the revert, so it was not restored.`);
+    for (const file of revert.files) {
+      const absolute = path.join(root, file.path);
+      if (file.disk === null) fs.rmSync(absolute, { force: true });
+      else { fs.mkdirSync(path.dirname(absolute), { recursive: true }); fs.writeFileSync(absolute, file.disk); }
+      const now = indexEntry(repo, file.path);
+      if (now?.sha === file.indexAfter?.sha && now?.mode === file.indexAfter?.mode) {
+        if (file.index) repo.run(['update-index', '--add', '--cacheinfo', `${file.index.mode},${file.index.sha},${file.path}`]);
+        else if (now) repo.run(['update-index', '--force-remove', '--', file.path]);
+      }
+    }
+    comparison.undo = null;
+    revert.signatures.forEach(key => comparison.reverted.delete(key));
+    comparison.snapshot = undefined;
+    const latest = comparison.rounds.at(-1);
+    return { ...(await this.state(projectId, root, csrf)), restored: latest ? latest.units.filter(unit => revert.signatures.includes(signature(unit))).map(unit => unit.id) : [] };
+  }
+}

package/src/server/frontend.ts

@@ -6,7 +6,7 @@ import path from 'node:path';
 export async function registerFrontend(app: FastifyInstance, root: string) {
   // Resolve assets at request time, so a frontend build can be deployed without
   // restarting the server or interrupting active Codex turns.
-  await app.register(staticFiles, { root, prefix: '/', wildcard: true, cacheControl: false });
+  await app.register(staticFiles, { root, prefix: '/', wildcard: true, cacheControl: false, dotfiles: 'deny' });
   app.setNotFoundHandler((request, reply) => {
     const pathname = new URL(request.url, 'http://localhost').pathname;
     if (/^\/(api|review|assets)(\/|$)/.test(pathname)) return reply.code(404).send({ error: 'Not found' });

package/src/server/main.ts

@@ -1,234 +1,31 @@
-import Fastify from 'fastify';
-import { registerFrontend } from './frontend.ts';
-import compress from '@fastify/compress';
 import fs from 'node:fs';
 import path from 'node:path';
-import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { randomBytes } from 'node:crypto';
 import { Store } from './store.ts';
 import { Workspace } from './workspace.ts';
-import { ROOT, DATA, PORT, PUBLIC_ORIGIN, OWNER, VERSION } from './paths.ts';
-import { reviewClient, allowedReviewRoute, rewriteReviewHtml, rewriteReviewJson, confirmedReviewResponse, annotateReviewState } from './review.ts';
-import { authorize } from './security.ts';
-import { fullPaperPdf } from './pdf.ts';
-import { Manuscripts, annotationTask, gitAbortMerge, gitCommit, gitDiff, gitFinishMerge, gitIgnore, gitRemote, gitStatus } from './manuscript.ts';
-import { findSkill, listedSkill, loadSkills } from './skills.ts';
-import type { AgentId } from '../shared.ts';
+import { Accounts } from './accounts.ts';
+import { ROOT, DATA, PORT, PUBLIC_ORIGIN, OWNER, VERSION, ACCOUNT_ORIGIN, ACCOUNT_PORT } from './paths.ts';
+import { accountHsts, accountProblem } from './security.ts';
+import { Manuscripts } from './manuscript.ts';
+import { Changes } from './changes.ts';
+import { buildApp, gitQueue } from './app.ts';
 
+const problem = accountProblem(ACCOUNT_ORIGIN, ACCOUNT_PORT, PORT, PUBLIC_ORIGIN);
+if (problem) { console.error(problem); process.exit(1); }
 const store = new Store(path.join(DATA, 'papilot.sqlite'));
 const workspace = new Workspace(store);
-const manuscripts = new Manuscripts();
-const app = Fastify({ logger: false, bodyLimit: 1024 * 1024 });
-const csrf = randomBytes(32).toString('base64url');
-const equals = (a: string, b: string) => { const x = Buffer.from(a), y = Buffer.from(b); return x.length === y.length && timingSafeEqual(x, y); };
-await app.register(compress);
-app.addHook('onRequest', async (request, reply) => {
-  reply.header('X-Content-Type-Options', 'nosniff').header('Referrer-Policy', 'same-origin').header('X-Frame-Options', 'SAMEORIGIN').header('Cache-Control', 'no-store');
-  const denied = authorize(request.headers, request.raw.socket.remoteAddress, PORT, PUBLIC_ORIGIN, OWNER);
-  if (denied) return reply.code(403).send({ error: denied });
-  if (request.method === 'POST' && !request.url.startsWith('/review/') && !equals(String(request.headers['x-papilot-token'] || ''), csrf)) return reply.code(403).send({ error: 'This page has expired. Refresh it and try again.' });
-});
-app.setErrorHandler((error, _request, reply) => { reply.code((error as any).statusCode || 400).send({ error: (error as Error).message }); });
-app.get('/api/health', () => ({ ok: true, name: 'Papilot', version: VERSION }));
-app.get('/api/state', () => ({ ...workspace.snapshot(), csrf }));
-app.get('/api/events', (request, reply) => {
-  reply.hijack();
-  reply.raw.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache, no-transform', Connection: 'keep-alive', 'X-Accel-Buffering': 'no' });
-  reply.raw.write('event: change\ndata: {}\n\n');
-  let timer: NodeJS.Timeout | undefined;
-  const change = () => { timer ??= setTimeout(() => { timer = undefined; reply.raw.write('event: change\ndata: {}\n\n'); }, 400); };
-  workspace.on('change', change);
-  const heartbeat = setInterval(() => reply.raw.write(': heartbeat\n\n'), 15000);
-  reply.raw.on('close', () => { clearInterval(heartbeat); if (timer) clearTimeout(timer); workspace.off('change', change); });
-});
-app.post('/api/reconnect', async () => { await workspace.connect(); return workspace.runtime; });
-// Codex names reasoning efforts with short lowercase words (low, medium, xhigh).
-const agent = (value: unknown): AgentId => value === 'claude' || value === 'antigravity' ? value : 'codex';
-const effort = (value: unknown) => typeof value === 'string' && /^[a-z]{1,16}$/.test(value) ? value : undefined;
-const string = (value: unknown, name: string, max = 20000) => { if (typeof value !== 'string' || !value.trim() || value.length > max) throw new Error(`${name} is required and must be no longer than ${max} characters.`); return value.trim(); };
-app.post('/api/projects', async request => { const b = request.body as any; return workspace.addProject(string(b.path, 'Repository path', 4000), b.name ? string(b.name, 'Paper name', 120) : undefined); });
-app.post<{ Params: { id: string } }>('/api/projects/:id/rename', request => workspace.renameProject(request.params.id, string((request.body as any).name, 'Paper name', 120)));
-// A skill's name: what the author typed after "/".
-const skillName = (value: unknown) => typeof value === 'string' && /^[a-z0-9][a-z0-9-]{0,47}$/.test(value) ? value : undefined;
-// Text the author may leave empty when a skill or review feedback says enough.
-const optional = (value: unknown, name: string) => value === undefined || value === '' ? '' : string(value, name);
-app.get<{ Params: { id: string } }>('/api/projects/:id/skills', request => ({ skills: loadSkills(store.project(request.params.id).path).map(listedSkill) }));
-app.post('/api/tasks', async request => {
-  const b = request.body as any, skill = skillName(b.skill);
-  return workspace.createTask({ id: string(b.id, 'Task ID', 64), projectId: string(b.projectId, 'Paper ID', 64), title: string(b.title, 'Task title', 120), instructions: skill ? optional(b.instructions, 'Instructions') : string(b.instructions, 'Instructions'), skill, agent: agent(b.agent), model: typeof b.model === 'string' ? b.model : undefined, effort: effort(b.effort) });
-});
-app.get<{ Params: { id: string } }>('/api/tasks/:id/items', request => { store.task(request.params.id); return { items: store.items(request.params.id) }; });
-app.get<{ Params: { id: string }; Querystring: { round?: string; version?: string; download?: string } }>('/api/tasks/:id/pdf', async (request, reply) => {
-  const task = store.task(request.params.id), project = store.project(task.projectId);
-  const round = request.query.round === undefined ? task.review?.round : Number(request.query.round);
-  const side = request.query.version || 'after';
-  if (!round || !Number.isSafeInteger(round) || round < 1 || (side !== 'before' && side !== 'after')) return reply.code(400).send({ error: 'Select an existing review round and either the before or after PDF.' });
-  const pdf = await fullPaperPdf(project.path, task.name, round, side);
-  const filename = `papilot-${task.name}-r${round}-${side}.pdf`;
-  return reply.type('application/pdf').header('Content-Disposition', `${request.query.download === '1' ? 'attachment' : 'inline'}; filename="${filename}"`).sendFile(path.basename(pdf), path.dirname(pdf), { cacheControl: false });
-});
-app.post<{ Params: { id: string } }>('/api/tasks/:id/messages', async request => {
-  const b = request.body as any, task = store.task(request.params.id), feedback = b.feedback === true, name = skillName(b.skill);
-  const skill = name ? findSkill(store.project(task.projectId).path, name) : undefined;
-  const text = feedback || skill ? optional(b.text, 'Revision instructions') : string(b.text, 'Revision instructions');
-  return workspace.enqueue(task.id, text, string(b.requestKey, 'Request ID', 100), true, { skill, feedback });
-});
-// Commits what the author accepted from this task, with the message they confirmed.
-app.post<{ Params: { id: string } }>('/api/tasks/:id/commit', request => {
-  const task = store.task(request.params.id), b = request.body as any;
-  return serialGit(task.projectId, () => workspace.commitTask(task.id, string(b.message, 'Commit message', 5000), b.push === true));
-});
-app.post<{ Params: { id: string } }>('/api/tasks/:id/rename', request => workspace.renameTask(request.params.id, string((request.body as any).title, 'Task title', 120)));
-app.post<{ Params: { id: string } }>('/api/tasks/:id/interrupt', request => workspace.interrupt(request.params.id).then(() => ({ ok: true })));
-app.post<{ Params: { id: string } }>('/api/tasks/:id/delete', request => {
-  if ((request.body as any)?.confirm !== true) throw new Error('Confirm permanent task deletion before continuing.');
-  return workspace.deleteTask(request.params.id);
-});
-app.post<{ Params: { id: string } }>('/api/tasks/:id/reconcile', request => workspace.reconcile(request.params.id));
-app.post<{ Params: { id: string } }>('/api/tasks/:id/publish', request => {
-  const task = store.task(request.params.id); if (['running', 'waiting_input', 'building'].includes(task.status)) throw new Error('This task is busy. Wait for it to finish or pause it first.');
-  void workspace.publish(task.id); return { ok: true };
-});
-// The manuscript preview compiles each paper's working tree and reports its Git status.
-app.get<{ Params: { id: string } }>('/api/projects/:id/manuscript', async request => ({ ...(await manuscripts.state(request.params.id, store.project(request.params.id).path)), annotations: store.annotations(request.params.id).filter(note => !note.taskId) }));
-app.get<{ Params: { id: string } }>('/api/projects/:id/git', request => gitStatus(store.project(request.params.id).path));
-// Git writes to one repository run one at a time; each returns the new status.
-const gitQueue = new Map<string, Promise<unknown>>();
-function serialGit<T>(projectId: string, work: () => Promise<T>) {
-  const run = (gitQueue.get(projectId) || Promise.resolve()).catch(() => {}).then(work);
-  gitQueue.set(projectId, run);
-  return run.finally(() => { if (gitQueue.get(projectId) === run) gitQueue.delete(projectId); });
-}
-app.get<{ Params: { id: string }; Querystring: { path?: string } }>('/api/projects/:id/git/diff', request => gitDiff(store.project(request.params.id).path, string(request.query.path, 'File path', 4096)));
-app.post<{ Params: { id: string } }>('/api/projects/:id/git/commit', request => {
-  const project = store.project(request.params.id), b = request.body as any;
-  const message = string(b.message, 'Commit message', 5000), paths = Array.isArray(b.paths) ? b.paths.filter((p: unknown) => typeof p === 'string').slice(0, 5000) : [];
-  return serialGit(project.id, () => workspace.exclusiveCommit(project.id, async () => ({ commit: await gitCommit(project.path, message, paths), git: await gitStatus(project.path) })));
-});
-const paths = (value: unknown): string[] => Array.isArray(value) ? value.filter((p: unknown): p is string => typeof p === 'string').slice(0, 5000) : [];
-// An agent writes a commit message for the chosen files; nothing is written.
-app.post<{ Params: { id: string } }>('/api/projects/:id/git/message', request => {
-  const b = request.body as any;
-  return workspace.commitMessage(store.project(request.params.id).id, paths(b.paths), { agent: b.agent === undefined ? undefined : agent(b.agent), model: typeof b.model === 'string' ? b.model : undefined });
-});
-// A merge in progress is resolved by an agent, committed, or abandoned.
-app.post<{ Params: { id: string } }>('/api/projects/:id/git/resolve', request => {
-  const project = store.project(request.params.id), b = request.body as any;
-  return serialGit(project.id, () => workspace.resolveConflicts(project.id, { agent: b.agent === undefined ? undefined : agent(b.agent), model: typeof b.model === 'string' ? b.model : undefined }));
-});
-app.post<{ Params: { id: string } }>('/api/projects/:id/git/finish', request => {
-  const project = store.project(request.params.id);
-  return serialGit(project.id, () => workspace.exclusiveCommit(project.id, async () => ({ commit: await gitFinishMerge(project.path), git: await gitStatus(project.path) })));
-});
-app.post<{ Params: { id: string } }>('/api/projects/:id/git/abort', request => {
-  const project = store.project(request.params.id);
-  return serialGit(project.id, async () => { await gitAbortMerge(project.path); return { git: await gitStatus(project.path) }; });
-});
-// Chosen untracked build files go into .gitignore by kind.
-app.post<{ Params: { id: string } }>('/api/projects/:id/git/ignore', request => {
-  const project = store.project(request.params.id);
-  return serialGit(project.id, async () => ({ git: await gitIgnore(project.path, paths((request.body as any).paths)) }));
-});
-app.post<{ Params: { id: string; action: string } }>('/api/projects/:id/git/:action', request => {
-  const project = store.project(request.params.id), action = request.params.action;
-  if (action !== 'fetch' && action !== 'pull' && action !== 'merge' && action !== 'push') throw Object.assign(new Error('Unknown Git action.'), { statusCode: 404 });
-  return serialGit(project.id, async () => { await gitRemote(project.path, action); return { git: await gitStatus(project.path) }; });
-});
-app.post<{ Params: { id: string } }>('/api/projects/:id/manuscript', async request => ({ ...(await manuscripts.state(request.params.id, store.project(request.params.id).path, true)), annotations: store.annotations(request.params.id).filter(note => !note.taskId) }));
-// Notes marked on the manuscript PDF become one agent task when sent.
-app.post<{ Params: { id: string } }>('/api/projects/:id/annotations', async request => {
-  const project = store.project(request.params.id), b = request.body as any;
-  const isRect = (value: unknown): value is [number, number, number, number] => Array.isArray(value) && value.length === 4 && value.every(v => typeof v === 'number' && v >= 0 && v <= 1) && value[2] > value[0] && value[3] > value[1];
-  if (!isRect(b.rect)) throw new Error('Select text or mark a region on the page first.');
-  const rects = Array.isArray(b.rects) ? b.rects.slice(0, 80).filter(isRect) : [];
-  const comment = string(b.comment, 'Note', 4000), key = string(b.key, 'Preview key', 64), page = Number(b.page);
-  const selected = typeof b.quote === 'string' ? b.quote.slice(0, 2000) : '';
-  const { quote, source } = await manuscripts.locate(project.id, key, page, b.rect, rects, selected);
-  return store.saveAnnotation({ id: randomUUID(), projectId: project.id, key, page, rect: b.rect, ...(rects.length ? { rects } : {}), comment, quote, source, createdAt: Date.now() });
-});
-app.post<{ Params: { id: string; note: string } }>('/api/projects/:id/annotations/:note/delete', request => { store.deleteAnnotation(store.project(request.params.id).id, request.params.note); return { ok: true }; });
-app.post<{ Params: { id: string } }>('/api/projects/:id/annotations/send', async request => {
-  const project = store.project(request.params.id), b = request.body as any, id = string(b.id, 'Task ID', 64);
-  const existing = store.tasks().find(task => task.id === id);
-  if (existing) return existing;
-  const notes = store.annotations(project.id).filter(note => !note.taskId);
-  if (!notes.length) throw new Error('Mark a region on the PDF and add a note first.');
-  const { title, instructions } = annotationTask(notes);
-  const task = await workspace.createTask({ id, projectId: project.id, title, instructions, agent: agent(b.agent), model: typeof b.model === 'string' ? b.model : undefined, effort: effort(b.effort) });
-  for (const note of notes) store.saveAnnotation({ ...note, taskId: task.id });
-  return task;
-});
-// Exact word places for the PDF view's selection layer; immutable per build key.
-app.get<{ Params: { id: string }; Querystring: { key?: string; page?: string } }>('/api/projects/:id/manuscript/words', async (request, reply) => {
-  const project = store.project(request.params.id);
-  const words = await manuscripts.words(project.id, String(request.query.key || ''), Number(request.query.page));
-  return reply.header('Cache-Control', 'private, max-age=31536000, immutable').send(words);
-});
-app.get<{ Params: { id: string }; Querystring: { key?: string; download?: string } }>('/api/projects/:id/manuscript.pdf', (request, reply) => {
-  const project = store.project(request.params.id), pdf = manuscripts.pdf(project.id, String(request.query.key || ''));
-  const name = (project.name.replace(/[^\w.-]+/g, '-').replace(/^-+|-+$/g, '') || 'manuscript') + '.pdf';
-  // Each key names one immutable build, so the viewer can cache and range-read it.
-  return reply.type('application/pdf').header('Content-Disposition', `${request.query.download === '1' ? 'attachment' : 'inline'}; filename="${name}"`).header('Cache-Control', 'private, max-age=31536000, immutable').sendFile(path.basename(pdf), path.dirname(pdf), { cacheControl: false });
-});
-app.post<{ Params: { id: string } }>('/api/requests/:id', request => { workspace.answer(request.params.id, request.body as any); return { ok: true }; });
-
-app.route<{ Params: { projectId: string; '*': string } }>({
-  method: ['GET', 'POST'], url: '/review/:projectId/*', handler: async (request, reply) => {
-    const project = store.project(request.params.projectId);
-    const route = '/' + request.params['*'];
-    if (route.includes('..') || !allowedReviewRoute(route, request.method)) return reply.code(404).send({ error: 'Review resource not found.' });
-    const client = await reviewClient(project.path);
-    if (request.method === 'POST') {
-      if (!equals(String(request.headers['x-review-token'] || ''), client.token)) return reply.code(403).send({ error: 'This review page has expired. Refresh it and try again.' });
-    }
-    const reviewTask = request.method === 'POST' ? store.tasks().find(t => t.projectId === project.id && t.name === route.split('/')[3]) : undefined;
-    const writesFiles = route.endsWith('/undo') || (route.endsWith('/decide') && (request.body as any)?.action !== 'comment');
-    if (request.method === 'POST' && writesFiles) string((request.body as any)?.id, 'Review action ID', 80);
-    const forward = async () => {
-      const search = new URL(request.url, 'http://localhost').search;
-      const response = await fetch(client.url + route + search, {
-        method: request.method, headers: { 'Content-Type': 'application/json', 'X-Review-Token': client.token },
-        ...(request.method === 'POST' ? { body: JSON.stringify(request.body) } : {}),
-        signal: AbortSignal.timeout(120000), redirect: 'error',
-      });
-      reply.code(response.status);
-      const type = response.headers.get('content-type') || 'application/octet-stream';
-      const prefix = `/review/${project.id}`;
-      if (type.includes('application/json')) {
-        const value = await response.json();
-        if (reviewTask && writesFiles && !confirmedReviewResponse(response.status, value, reviewTask.name)) throw new Error('The review engine could not confirm this action. Select Check status before continuing.');
-        if (!response.ok && request.method === 'POST' && (value as any).error) {
-          const task = store.tasks().find(t => t.projectId === project.id && t.name === route.split('/')[3]);
-          if (task) store.updateTask(task.id, { error: 'Review action failed: ' + (value as any).error });
-        }
-        if (response.ok && request.method === 'POST') {
-          const task = store.tasks().find(t => t.projectId === project.id && t.name === route.split('/')[3]);
-          if (task) {
-            store.updateTask(task.id, { error: null });
-            await workspace.refresh(task.id);
-          }
-        }
-        return rewriteReviewJson(value, prefix);
-      }
-      if (reviewTask && writesFiles) throw new Error('The review engine returned an unexpected response. Select Check status before continuing.');
-      reply.type(type);
-      if (type.includes('text/html')) return rewriteReviewHtml(await response.text(), prefix);
-      const cache = response.headers.get('cache-control'); if (cache && route.startsWith('/files/')) reply.header('Cache-Control', cache);
-      if (route.startsWith('/assets/')) reply.header('Cache-Control', 'private, max-age=31536000, immutable');
-      return Buffer.from(await response.arrayBuffer());
-    };
-    if (request.method === 'POST' && !reviewTask) throw new Error('This review task does not belong to this workspace.');
-    const result = await (reviewTask ? workspace.reviewWrite(reviewTask.id, writesFiles, forward, writesFiles ? { route, body: request.body as Record<string, unknown> } : undefined) : forward());
-    return annotateReviewState(result, store.tasks().filter(task => task.projectId === project.id));
-  },
-});
-
-if (fs.existsSync(path.join(ROOT, 'dist/index.html'))) {
-  await registerFrontend(app, path.join(ROOT, 'dist'));
-} else app.get('/', (_request, reply) => reply.type('text/plain').send('Papilot: run npm run build, then restart the server.'));
+const accounts = new Accounts(store, ACCOUNT_ORIGIN || null);
+const shared = {
+  store, workspace, accounts, manuscripts: new Manuscripts(), changes: new Changes(), csrf: randomBytes(32).toString('base64url'), serialGit: gitQueue(),
+  dist: fs.existsSync(path.join(ROOT, 'dist/index.html')) ? path.join(ROOT, 'dist') : null, version: VERSION,
+};
+const apps = [await buildApp({ ...shared, listener: { kind: 'local', port: PORT, publicOrigin: PUBLIC_ORIGIN, owner: OWNER } })];
+if (ACCOUNT_ORIGIN) apps.push(await buildApp({ ...shared, listener: { kind: 'account', origin: ACCOUNT_ORIGIN, hsts: accountHsts(ACCOUNT_ORIGIN, PUBLIC_ORIGIN) } }));
 
-await app.listen({ host: '127.0.0.1', port: PORT });
+await apps[0].listen({ host: '127.0.0.1', port: PORT });
+if (apps[1]) await apps[1].listen({ host: '127.0.0.1', port: ACCOUNT_PORT });
 store.recover();
-console.log(`Papilot is running at http://127.0.0.1:${PORT}${PUBLIC_ORIGIN ? `\nRemote: ${PUBLIC_ORIGIN}` : ''}`);
+console.log(`Papilot is running at http://127.0.0.1:${PORT}${PUBLIC_ORIGIN ? `\nRemote: ${PUBLIC_ORIGIN}` : ''}${ACCOUNT_ORIGIN ? `\nSign-in for invited people: ${ACCOUNT_ORIGIN} (forwarded to 127.0.0.1:${ACCOUNT_PORT})` : ''}`);
 void workspace.connect();
 // Recompute cached feedback counts, including decisions from before this restart.
 for (const task of store.tasks()) {
@@ -237,9 +34,11 @@ for (const task of store.tasks()) {
     void workspace.refresh(task.id);
   } else if (task.review?.round && task.status !== 'deleting') void workspace.refresh(task.id);
 }
+// Expired invites and sessions are removed as they lapse.
+setInterval(() => accounts.purge(), 3600000).unref();
 let shuttingDown = false;
 for (const signal of ['SIGINT', 'SIGTERM']) process.on(signal, () => {
   if (shuttingDown) return; shuttingDown = true; workspace.close();
-  void app.close().finally(() => { store.close(); process.exit(0); });
+  void Promise.all(apps.map(app => app.close())).finally(() => { store.close(); process.exit(0); });
   setTimeout(() => process.exit(0), 2500).unref();
 });