wiki-viewer 1.14.1 → 2.0.0

package/bin/wiki-viewer.js

@@ -26,13 +26,19 @@ function printUsage() {
   console.error("Usage: wiki-viewer [directory] [options]");
   console.error("       wiki-viewer <command> [args]");
   console.error("");
-  console.error("  directory            Directory to serve (optional — pick in browser if omitted)");
+  console.error("  directory            Directory to serve (optional — pick in browser if omitted).");
+  console.error("                       May also be an SSH target (user@host:/path) — mounted via");
+  console.error("                       sshfs and served live, no local clone.");
   console.error("");
   console.error("Options:");
   console.error("  -p, --port <port>   Port to listen on (default: 3000)");
   console.error("  -H, --host <host>   Host to bind to (default: localhost)");
   console.error("  --https             Enable HTTPS (self-signed cert, enables service workers)");
   console.error("  --no-auth           Run without authentication — no sign-in, no session check");
+  console.error("  --ssh-key <path>    Private key for the SSH target (default: ssh-agent / host keys)");
+  console.error("  --ssh-port <port>   SSH port for the target (default: 22)");
+  console.error("  --ssh-password      Prompt for an SSH password (or set WIKI_SSH_PASSWORD)");
+  console.error("  --ssh-readonly      Mount the SSH target read-only");
   console.error("  -v, --version       Print version");
   console.error("");
   console.error("  -e, --env <KEY=VALUE>  Set an app env var (repeatable; persisted with service install)");
@@ -55,6 +61,8 @@ function printUsage() {
   console.error("  wiki-viewer ~/notes");
   console.error("  wiki-viewer ~/notes --https");
   console.error("  wiki-viewer ~/notes -p 8080 -H 0.0.0.0");
+  console.error("  wiki-viewer me@server:/srv/docs");
+  console.error("  wiki-viewer me@server:/srv/docs --ssh-key ~/.ssh/id_ed25519 --ssh-readonly");
   console.error("  wiki-viewer service install ~/notes -H 0.0.0.0 -p 3003 --https");
   console.error("  wiki-viewer service install ~/notes --env GOOGLE_CLIENT_ID=... --env GOOGLE_CLIENT_SECRET=...");
   console.error("  wiki-viewer config set AUTH_ALLOWED_DOMAIN=example.com");
@@ -70,6 +78,10 @@ function parseServeArgs(args) {
   let userSpecifiedPort = false;
   let rootDir;
   let noAuth;
+  let sshKey;
+  let sshPort;
+  let sshPassword;
+  let sshReadOnly;
 
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
@@ -78,12 +90,151 @@ function parseServeArgs(args) {
     else if (a === "-e" || a === "--env") { i++; } // consumed by parseEnvFlags
     else if (a === "--https") useHttps = true;
     else if (a === "--no-auth") noAuth = true;
+    else if (a === "--ssh-key") sshKey = args[++i];
+    else if (a === "--ssh-port") sshPort = args[++i];
+    else if (a === "--ssh-password") sshPassword = true;
+    else if (a === "--ssh-readonly") sshReadOnly = true;
     else if (!a.startsWith("-") && rootDir === undefined) rootDir = a;
   }
 
-  return { rootDir, port, host, useHttps, userSpecifiedPort, noAuth: Boolean(noAuth) };
+  return { rootDir, port, host, useHttps, userSpecifiedPort, noAuth: Boolean(noAuth), sshKey, sshPort, sshPassword: Boolean(sshPassword), sshReadOnly: Boolean(sshReadOnly) };
 }
 
+// ── ssh (sshfs) targets ──────────────────────────────────────────────────────
+// Symmetry with the local-directory arg: `wiki-viewer user@host:/path` mounts a
+// remote directory over sshfs and serves it as ROOT_DIR — no local clone. The
+// mount is ephemeral (under ~/.wiki-viewer/mounts) and unmounted on exit. Auth:
+// ssh-agent/host keys by default, --ssh-key <path>, or --ssh-password.
+
+const mountsDir = path.join(configDir, "mounts");
+const FORBIDDEN_SSH = /[;|&$`<>(){}\n\r\0]/;
+let activeMount = null;
+
+function looksLikeSshTarget(s) {
+  if (!s || FORBIDDEN_SSH.test(s)) return false;
+  // [user@]host:/abs/path — host has no slash, remote path is absolute. An
+  // existing local path (e.g. a real dir literally named like this) wins.
+  return /^([\w.-]+@)?[\w.-]+:\/.+/.test(s) && !existsSync(s);
+}
+
+function parseSshTarget(s) {
+  if (!s || FORBIDDEN_SSH.test(s)) return null;
+  const colon = s.indexOf(":");
+  if (colon <= 0) return null;
+  const hostPart = s.slice(0, colon);
+  const remotePath = s.slice(colon + 1);
+  if (!remotePath.startsWith("/") || remotePath.includes("..")) return null;
+  let user;
+  let host = hostPart;
+  const at = hostPart.indexOf("@");
+  if (at >= 0) { user = hostPart.slice(0, at); host = hostPart.slice(at + 1); if (!user) return null; }
+  if (!host || !/^[a-zA-Z0-9.-]+$/.test(host)) return null;
+  if (user && !/^[a-zA-Z0-9._-]+$/.test(user)) return null;
+  return { user, host, remotePath };
+}
+
+// Mirror of src/lib/sshfs.ts buildSshfsArgs — kept in sync intentionally so the
+// bin stays dependency-light (no TS import at runtime).
+function buildSshfsArgs({ target, mountpoint, port, keyPath, password, readOnly }) {
+  const userPart = target.user ? `${target.user}@` : "";
+  const args = [`${userPart}${target.host}:${target.remotePath}`, mountpoint];
+  if (port && Number.isInteger(Number(port)) && Number(port) > 0 && Number(port) < 65536) {
+    args.push("-p", String(port));
+  }
+  const o = [
+    "reconnect", "ServerAliveInterval=15", "ServerAliveCountMax=3",
+    "compression=yes", "cache=yes", "kernel_cache",
+    "StrictHostKeyChecking=accept-new", "BatchMode=yes",
+  ];
+  if (readOnly) o.push("ro");
+  if (keyPath) { o.push(`IdentityFile=${keyPath}`, "IdentitiesOnly=yes"); }
+  if (password != null) {
+    const i = o.indexOf("BatchMode=yes"); if (i >= 0) o.splice(i, 1);
+    o.push("password_stdin", "PreferredAuthentications=password,keyboard-interactive", "PubkeyAuthentication=no", "NumberOfPasswordPrompts=1");
+  }
+  args.push("-o", o.join(","));
+  return args;
+}
+
+function isMountedSync(mp) {
+  try {
+    if (process.platform === "linux") {
+      const m = readFileSync("/proc/mounts", "utf8");
+      return m.split("\n").some((l) => { const p = l.split(" "); return p[1] === mp && /fuse/.test(p[2] || ""); });
+    }
+    const out = execFileSync("mount", [], { encoding: "utf8" });
+    return out.split("\n").some((l) => l.includes(` on ${mp} `));
+  } catch { return false; }
+}
+
+function unmountSync(mp) {
+  const tries = process.platform === "linux"
+    ? [["fusermount", ["-u", "-z", mp]], ["umount", [mp]]]
+    : [["umount", [mp]], ["diskutil", ["unmount", "force", mp]]];
+  for (const [bin, a] of tries) { try { execFileSync(bin, a, { stdio: "ignore" }); break; } catch { /* try next */ } }
+  try { rmSync(mp, { recursive: false, force: true }); } catch { /* best-effort */ }
+}
+
+function registerMountCleanup() {
+  const cleanup = () => { if (activeMount) { const mp = activeMount; activeMount = null; unmountSync(mp); } };
+  process.on("exit", cleanup);
+  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.on(sig, () => { cleanup(); process.exit(0); });
+  }
+}
+
+async function mountSshTarget({ targetStr, port, keyPath, password, readOnly }) {
+  const target = parseSshTarget(targetStr);
+  if (!target) {
+    console.error(`Error: invalid SSH target '${targetStr}'. Use the form user@host:/abs/path.`);
+    process.exit(1);
+  }
+  try { execFileSync("sshfs", ["--version"], { stdio: "ignore" }); }
+  catch {
+    console.error("Error: sshfs not found. Install sshfs + FUSE (e.g. `apt install sshfs`, `brew install macfuse sshfs`).");
+    process.exit(1);
+  }
+
+  mkdirSync(mountsDir, { recursive: true });
+  const mp = path.join(mountsDir, `cli-${process.pid}`);
+  // Reuse-or-clear a stale mountpoint from a previous crashed run.
+  if (isMountedSync(mp)) unmountSync(mp);
+  mkdirSync(mp, { recursive: true });
+
+  const args = buildSshfsArgs({ target, mountpoint: mp, port, keyPath, password, readOnly });
+  registerMountCleanup();
+  await new Promise((resolve, reject) => {
+    const child = spawn("sshfs", args, { stdio: ["pipe", "ignore", "pipe"] });
+    let err = "";
+    const t = setTimeout(() => { child.kill("SIGKILL"); reject(new Error("sshfs mount timed out after 25s")); }, 25_000);
+    child.stderr.on("data", (d) => { err += d.toString(); });
+    child.on("error", (e) => { clearTimeout(t); reject(e); });
+    child.on("close", (code) => { clearTimeout(t); code === 0 ? resolve() : reject(new Error(err.trim() || `sshfs exited ${code}`)); });
+    if (password != null) child.stdin.write(password + "\n");
+    child.stdin.end();
+  }).catch((e) => {
+    console.error(`Error: sshfs mount failed: ${e.message}`);
+    try { unmountSync(mp); } catch { /* ignore */ }
+    process.exit(1);
+  });
+
+  if (!isMountedSync(mp)) {
+    console.error("Error: sshfs reported success but the mount is not live.");
+    unmountSync(mp);
+    process.exit(1);
+  }
+  activeMount = mp;
+  return mp;
+}
+
+// One-shot line prompt (echoes input). Used for --ssh-password when the
+// WIKI_SSH_PASSWORD env var is not set.
+async function promptLine(text) {
+  const io = makePrompter();
+  const ans = await io.prompt(text);
+  io.close();
+  return ans;
+}
 // ── config file ────────────────────────────────────────────────────────────
 
 function loadConfig() {
@@ -108,8 +259,11 @@ function saveConfig(cfg) {
 function resolveServeOptions(args) {
   const cli = parseServeArgs(args);
   const cfg = loadConfig();
+  const isSsh = cli.rootDir != null && looksLikeSshTarget(cli.rootDir);
   return {
-    rootDir: cli.rootDir ? path.resolve(cli.rootDir) : null,
+    rootDir: cli.rootDir && !isSsh ? path.resolve(cli.rootDir) : null,
+    sshTarget: isSsh ? cli.rootDir : null,
+    sshKey: cli.sshKey, sshPort: cli.sshPort, sshPassword: cli.sshPassword, sshReadOnly: cli.sshReadOnly,
     port: String(cli.port ?? "3000"),
     host: cli.host ?? "localhost",
     useHttps: Boolean(cli.useHttps),
@@ -133,8 +287,15 @@ function resolveRunOptions(args) {
   // A config-pinned port is explicit too (don't auto-bump to next free port).
   const userSpecifiedPort = cli.userSpecifiedPort || cfg.port != null;
 
+  const isSsh = rootDir != null && looksLikeSshTarget(rootDir);
   return {
-    rootDir: rootDir ? path.resolve(rootDir) : null,
+    rootDir: rootDir && !isSsh ? path.resolve(rootDir) : null,
+    sshTarget: isSsh ? rootDir : null,
+    // CLI flags win; otherwise fall back to persisted ssh settings (cfg.ssh).
+    sshKey: cli.sshKey ?? cfg.ssh?.key,
+    sshPort: cli.sshPort ?? cfg.ssh?.port,
+    sshPassword: cli.sshPassword,
+    sshReadOnly: cli.sshReadOnly || Boolean(cfg.ssh?.readOnly),
     port: String(port),
     host,
     useHttps: Boolean(useHttps),
@@ -279,7 +440,8 @@ function getNetworkAddress() {
 // ── start ──────────────────────────────────────────────────────────────────
 
 async function start(opts) {
-  const { rootDir: resolvedRoot, useHttps, configEnv = {} } = opts;
+  const { useHttps, configEnv = {} } = opts;
+  let resolvedRoot = opts.rootDir;
   let { port, host, userSpecifiedPort } = opts;
 
   if (!existsSync(serverJs)) {
@@ -288,6 +450,24 @@ async function start(opts) {
     process.exit(1);
   }
 
+  // SSH target: mount it over sshfs and serve the mount point as ROOT_DIR.
+  if (opts.sshTarget) {
+    let password = null;
+    if (opts.sshPassword) {
+      password = process.env.WIKI_SSH_PASSWORD
+        ?? await promptLine(`SSH password for ${opts.sshTarget}: `);
+    }
+    console.log(`🔗  Mounting ${opts.sshTarget} over SSH…`);
+    resolvedRoot = await mountSshTarget({
+      targetStr: opts.sshTarget,
+      port: opts.sshPort,
+      keyPath: opts.sshKey,
+      password,
+      readOnly: opts.sshReadOnly,
+    });
+    console.log(`   mounted at ${resolvedRoot}${opts.sshReadOnly ? " (read-only)" : ""}`);
+  }
+
   if (resolvedRoot) {
     console.log(`��  ${resolvedRoot}`);
   } else {
@@ -433,13 +613,25 @@ function serviceInstall(args) {
   const envFlags = parseEnvFlags(args);
   const existing = loadConfig();
   const mergedEnv = { ...(existing.env ?? {}), ...envFlags };
+  const cliIsSsh = cli.rootDir != null && looksLikeSshTarget(cli.rootDir);
   const cfg = {
-    rootDir: cli.rootDir != null ? path.resolve(cli.rootDir) : existing.rootDir ?? null,
+    rootDir: cli.rootDir != null
+      ? (cliIsSsh ? cli.rootDir : path.resolve(cli.rootDir))
+      : existing.rootDir ?? null,
     host: cli.host ?? existing.host ?? "localhost",
     port: cli.port ?? existing.port ?? "3000",
     https: cli.useHttps ?? existing.https ?? false,
+    // Persist ssh options so `service run` can remount on boot. Password auth is
+    // intentionally NOT persisted — services run non-interactively, so use
+    // ssh-agent or --ssh-key for a reboot-persistent SSH workspace.
+    ...(cliIsSsh
+      ? { ssh: { ...(cli.sshKey ? { key: cli.sshKey } : {}), ...(cli.sshPort ? { port: cli.sshPort } : {}), ...(cli.sshReadOnly ? { readOnly: true } : {}) } }
+      : existing.ssh ? { ssh: existing.ssh } : {}),
     ...(Object.keys(mergedEnv).length ? { env: mergedEnv } : {}),
   };
+  if (cliIsSsh && cli.sshPassword) {
+    console.log("⚠️   --ssh-password is ignored for services (non-interactive). Use ssh-agent or --ssh-key.\n");
+  }
   saveConfig(cfg);
   console.log(`Saved config to ${configPath}`);
   console.log(`  dir:   ${cfg.rootDir ?? "(choose in browser)"}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-viewer",
-  "version": "1.14.1",
+  "version": "2.0.0",
   "description": "Local file viewer and wiki — view markdown, HTML, PDFs, notebooks, office docs, and more from any directory",
   "license": "MIT",
   "type": "module",

package/.next/standalone/.github/workflows/publish.yml

@@ -1,37 +0,0 @@
-name: Publish to npm
-
-on:
-  release:
-    types: [created]
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-          registry-url: https://registry.npmjs.org
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Build
-        run: pnpm build
-
-      - name: Copy static assets into standalone
-        run: |
-          cp -r .next/static .next/standalone/.next/static
-          cp -r public .next/standalone/public
-
-      - name: Publish
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.next/standalone/.handoffs/archive/handoff-20260612-113332.md

@@ -1,98 +0,0 @@
-# Handoff: Git-backed read-only workspaces (feature complete + perf optimization shipped)
-
-- **Written:** 2026-06-12 11:33:32 UTC
-- **From session:** unknown (pi agent, not Claude Code CLI; no .jsonl pointer)
-- **Working dir:** /home/sil/wiki-viewer
-- **Resume raw transcript (fallback only):** n/a (pi session, no --resume id captured)
-
-## Goal
-
-Let teams browse docs that live in a remote git repo (GitHub/GitLab/Bitbucket/Gitea/GHE)
-with the full wiki-viewer UI, instead of reading raw files on the host. Scope was locked
-early: **read-only**, **private repos via HTTPS PAT**, **manual refresh** (no webhook/cron).
-"Done" = admin pastes a repo URL, server clones it, it shows up as a normal workspace that
-is read-only, with a Refresh button. Plus a perf path for repos whose docs sit in a subdir.
-
-This work is **shipped and complete**. Both commits pushed to origin/main. There is no
-pending task. This handoff exists to orient a fresh agent if the feature is extended.
-
-## Current state
-
-DONE and pushed. Two commits on `main`:
-
-- `750f1e6` feat: git-backed read-only workspaces (backend spine + UI + tests)
-- `52edf40` perf(git): optional subpath via sparse checkout
-
-Working tree clean. `pnpm test` = 371 pass / 0 fail. `pnpm exec tsc --noEmit` clean.
-`pnpm build` succeeds (only the unrelated Better Auth base-URL warning, expected without env).
-
-What works end-to-end:
-
-- Add a git workspace via the directory picker "From Git" tab (URL, branch, subdir, username, token, name).
-- Server clones to `~/.wiki-viewer/repos/<wsId>/`, registers a `readOnly: true` workspace.
-- Optional subdir does a blobless partial clone + cone sparse-checkout; rootDir points at the subdir.
-- Every fs-mutating route rejects writes on a read-only workspace with 403 WORKSPACE_READ_ONLY.
-- Manual Refresh button in the switcher runs `git pull --ff-only`, shows synced time + last error.
-- PAT stored 0600 in `~/.wiki-viewer/git-secrets.json`, never in config.json, never logged, never in any API response.
-
-Nothing is half-built or untested in this feature.
-
-## Next action (do this first)
-
-Nothing pending. If asked to extend, the most likely next features (all explicitly deferred,
-not bugs) are listed under "Open questions". Start by reading the two key lib files below to
-rebuild the mental model, then `pnpm test` to confirm green baseline before any change.
-
-## Then
-
-Only if extending. Each item is a fresh mini-feature, use `/feature`:
-
-1. Config UI for `git.allowedHosts` / `git.allowInsecureHttp` (currently config.json only, no UI). Verify: admin can restrict clone hosts from settings.
-2. Write-back (commit + push or PR flow). This is the big scope cliff deliberately not built. Would require lifting read-only on a write path + conflict/precondition handling. Verify: edit in a git workspace reaches upstream.
-3. Auto-refresh (webhook or cron). Deferred by design; manual-only shipped. Verify: clone updates without a manual click.
-
-## Key files
-
-- `src/lib/git.ts` — git binary wrapper. `cloneRepo` (askpass auth so token never in argv/.git/config), `validateRemoteUrl` (https-only scheme gate + host allowlist + metachar reject), `validateSubpath`, `pullRepo` (ff-only), `headSha`, `currentBranch`, `assertGitAvailable`. Clone args: whole-repo `["clone","--depth","1","--single-branch","--no-tags",url,dest]`; subpath adds `--filter=blob:none --sparse` then `sparse-checkout set --cone <subpath>`.
-- `src/lib/git-secrets.ts` — PAT store, 0600 file, genTokenRef/setToken/getToken/deleteToken. Frozen, do not modify.
-- `src/lib/workspaces.ts` — `Workspace.readOnly` + `git{remoteUrl,branch,tokenRef,username,subpath,cloneRoot,lastPulledAt,lastSha,lastError}`. `createGitWorkspace`, `refreshGitWorkspace`, `removeWorkspace` (deletes cloneRoot, path.relative guard), `sanitizeWorkspace` (strips tokenRef from all responses).
-- `src/lib/workspace-context.ts` — `resolveWorkspaceForUser/Agent(req, intent)`. `intent:"write"` + `ws.readOnly` → 403 WORKSPACE_READ_ONLY. This is the single read-only chokepoint; every write route passes "write".
-- `src/lib/config.ts` — `reposDir()`, `WorkspaceGitEntry` (mirror of WorkspaceGit), `git.allowedHosts`/`git.allowInsecureHttp` config keys.
-- `src/app/api/system/workspaces/route.ts` — POST branches to createGitWorkspace when body.remoteUrl present; masks tokenRef.
-- `src/app/api/system/workspaces/[id]/refresh/route.ts` — admin+CSRF, calls refreshGitWorkspace.
-- `src/components/dir-picker.tsx` — "Local folder" / "From Git" mode toggle + the From Git form.
-- `src/app/page.tsx` — workspace switcher: read-only badge, Refresh button (handleRefreshWorkspace ~line 862, switcher render ~line 2015), timeAgo helper (~line 107).
-- `src/tests/proof/git.test.ts`, `git-secrets.test.ts`, `git-workspace.test.ts`, `readonly-enforcement.test.ts`, `git-sparse.test.ts` — full coverage.
-
-## Decisions & rationale
-
-- **Full clone, not API/lazy fetch.** Keeps reads as native fs (fast) and viewer/search/agent paths unchanged + provider-agnostic. API-based reads would be per-host and slow. See the read-perf discussion in session.
-- **Read-only is a policy, not a tech limit.** The clone is a writable dir, but edits there would be silently lost on `git pull --ff-only` (divergence) and never reach upstream. Read-only protects the user from edits with nowhere to go. Lift it only when write-back exists.
-- **Subpath uses sparse cone + blobless,** the only change that improves setup time without sacrificing read perf. `rootDir = cloneRoot/subpath` so `.git` sits outside rootDir (cleaner isolation). `cloneRoot` stored separately so refresh/remove target the real clone, not the subdir.
-- **Generalized beyond GitHub** because read-only clone+pull is provider-agnostic; only auth differs and HTTPS-token auth is uniform. Cheap to support all hosts.
-- **`--no-tags` on whole-repo, blobless only on subpath.** Depth-1 already fetches only tip blobs, so blobless adds negotiation cost for no gain on a full clone.
-
-## Gotchas & landmines
-
-- **`.git/` is already excluded** in indexer (SKIP_DIRS), fs/ls (SKIP_NAMES), and raw-fs (isDeniedRelPath). Do NOT re-add exclusions; subpath clones keep .git outside rootDir anyway.
-- **Local-protocol clones (`file://` or local path) IGNORE `--filter`** (git prints "filtering not recognized by server, ignoring"). Tests use local fixtures so they assert END STATE (only subpath files in rootDir), not transfer savings. Real https hosts get the blobless benefit.
-- **`agent-workspace-scope.test.ts` has a pre-existing flaky teardown race** (async agents.json write lands after the test's `rm`, ENOENT unhandledRejection). NOT caused by this feature; surfaced once under parallel load, then passed consistently. If the full suite flakes on exactly that file, it is this known race, not the git code.
-- **Symlink subpath attack is blocked twice:** git's `sparse-checkout set --cone` refuses a non-directory, AND createGitWorkspace does lstat + realpath-under-cloneRoot. Test `git-sparse.test.ts` covers it. The error message can be either "not a directory" (git) or "not found" (our guard) so the test regex accepts both.
-- **removeWorkspace delete guard** uses `path.relative(managed, cloneDir)` not raw `startsWith`, to stop a tampered config cloneRoot from deleting outside reposDir. Keep that if you touch cleanup.
-- **pnpm only.** `kysely` pinned 0.28.5 via overrides, do not bump. No em-dashes in any copy/comments (user rule). No AI attribution in commits.
-- Tests run from repo root: `pnpm exec tsx --import ./src/tests/proof/preload.ts --test src/tests/proof/<name>.test.ts`. preload.ts overrides HOME to a temp dir so tests never touch real ~/.wiki-viewer.
-
-## Open questions / waiting on
-
-None blocking. Deferred-by-design (not bugs): write-back/push, auto-refresh (webhook/cron),
-GHE-host config UI. All would be net-new features needing `/feature`, not continuations.
-
-## Mental model
-
-A git-backed workspace IS a normal workspace whose `rootDir` happens to be a server-managed
-clone. That single insight is why the feature is small: the entire read path (browser, editor
-view, search, agent reads) is untouched, because it just sees files on disk. Only two things
-are new: the clone/pull/secret orchestration (lib/git\*.ts + createGitWorkspace), and a
-read-only write gate centralized in one place (workspace-context resolver `intent` param).
-Everything else is wiring. When extending, ask "is this a read concern (already works) or a
-write concern (must go through the read-only gate)?" before touching anything.

package/.next/standalone/.handoffs/archive/handoff-20260612-141032.md

@@ -1,73 +0,0 @@
-# Handoff: Sub-folder git repo detection + branch badge + pull refresh
-
-- **Written:** 2026-06-12 14:10:32 UTC
-- **From session:** unknown (Pi agent, not Claude Code CLI)
-- **Working dir:** /home/sil/wiki-viewer
-- **Resume raw transcript (fallback only):** n/a (Pi session, no --resume id captured)
-
-## Goal
-
-Let users see git status for sub-folder git repos inside a normal workspace. When expanding a directory in the file tree sidebar, auto-detect any subdirectory that is a git repo root, show branch name + dirty indicator as an inline badge next to the folder name, and provide a pull-to-refresh button.
-
-"Done" = expand a folder in the sidebar, see `main` or `master` next to repo folders, click the refresh icon and see it pull latest + reload tree.
-
-## Current state
-
-Shipped and committed at `310cb72`. Working tree clean. `pnpm test` = 371 pass / 0 fail. `pnpm exec tsc --noEmit` clean.
-
-What works end-to-end:
-
-- `GET /api/wiki?dir=...` returns `git: {branch, dirty}` for each subdirectory that is a git repo root.
-- File tree sidebar shows `GitBranch icon branch [* if dirty] [↩ button]` inline.
-- Clicking ↩ calls `POST /api/wiki/git-pull` with `{path}`, runs `git pull --ff-only`, shows toast on success/fail, refreshes parent listing.
-- Reuses `detectGitRepo` in both listing and pull endpoint for consistent validation.
-- Pull endpoint uses `resolveWorkspaceForUser(request, "write")` — blocked on read-only workspaces.
-- Node-app entries also get git detection (review fix).
-- Follows existing patterns: CSRF, safeWorkspacePath, wsFetch, showError/showSuccess.
-
-## Next action (do this first)
-
-Nothing pending. If asked to extend, read the four changed files below to rebuild mental model, then `pnpm test` to confirm green baseline.
-
-## Then
-
-Possible extensions (all net-new, not continuations):
-
-1. **`.gitignore`-aware file listing** — hide ignored files from the tree. Requires running `git ls-files` in the sub-repo and filtering against `fetchDir` results.
-2. **Modification badges in tree** — `M`/`?`/`D` next to files when inside a detected git repo. Requires `git status --porcelain` on the sub-repo.
-3. **Git log / history panel** — show recent commits when clicking the branch badge.
-4. **Write-back (commit + push)** — big scope cliff. Would lift read-only and add commit UI.
-
-## Key files
-
-- `src/lib/git.ts` — added `detectGitRepo(dirPath)` at end of file. Returns `{branch, dirty}` or `null`. Uses `stat(.git)` then `rev-parse --show-toplevel` to confirm repo root, then `currentBranch()` + `status --porcelain`. Also added `GitRepoInfo` interface.
-- `src/app/api/wiki/route.ts` — GET handler extended to call `detectGitRepo` for each directory entry. Also restructured to apply git detection uniformly for all directory types (dir, app, node-app).
-- `src/app/api/wiki/git-pull/route.ts` — NEW file, POST endpoint. CSRF-protected, uses `resolveWorkspaceForUser(request, "write")`, validates path via `safeWorkspacePath`, reuses `detectGitRepo` for repo validation, runs `pullRepo` then returns `{branch, sha}`.
-- `src/app/page.tsx` — `TreeNode.git?` field; `fetchDir` passes through git from API; `pullingRepo` state + `handleGitPull` callback (after reloadDir definition); git badge + refresh button in `renderNodes` between node name and agent presence dot.
-
-## Decisions & rationale
-
-- **Auto-detect, not opt-in.** Scanning for `.git` on directory expand is cheap (one stat per subdirectory). Extra git commands only run for directories WITH `.git`. Zero config burden.
-- **Inline badge in tree row**, not status bar or tooltip. Always visible, no extra clicks. Same pattern as VSCode explorer.
-- **Reuse `detectGitRepo` in pull endpoint.** Ensures same validation (toplevel check, not just `.git` existence) prevents pulling on non-root repos or submodules.
-- **Pull on read-only workspaces blocked.** `resolveWorkspaceForUser(request, "write")` in git-pull endpoint prevents mutating a read-only git-backed workspace by pulling inside it.
-- **Node-app entries included.** Review flagged the early-return gap; restructured to detect git before type-specific branching. Node-app folders that are also git repos get the badge.
-- **Parent directory reloaded after pull.** Simpler and more accurate than trying to predict new dirty state.
-- **No rate limiting.** Frontend guard prevents concurrent pulls per path. Server-side throttle deferred until abuse surfaces.
-
-## Gotchas & landmines
-
-- **`reloadDir` defined before `handleGitPull`** in page.tsx. The callback depends on `reloadDir` being declared first. If you move callbacks around, keep this ordering.
-- **Submodules**: `.git` is a file (not dir) in submodule checkouts. `detectGitRepo` handles this because `stat()` works on both files and dirs. The `rev-parse --show-toplevel` check also handles this correctly.
-- **Symlink `.git`**: `stat` follows symlinks by default, so detection works. But `rev-parse --show-toplevel` resolves realpath, so comparison against symlinked dirPath would fail. This is acceptable — symlinked `.git` pointing outside the workspace is an unusual case.
-- **Nested git repos**: If a git repo has submodules, the submodule dirs are git repos too but `rev-parse --show-toplevel` returns the submodule root, not the superproject root. They each get their own badge, which is correct.
-- **pnpm only.** `kysely` pinned 0.28.5 via overrides, do not bump. No em-dashes in copy/comments (user rule). No AI attribution in commits.
-- **Tests run from repo root.** `pnpm exec tsx --import ./src/tests/proof/preload.ts --test src/tests/proof/<name>.test.ts`. preload.ts overrides HOME to temp dir.
-
-## Open questions / waiting on
-
-None. Feature is complete and committed.
-
-## Mental model
-
-A sub-folder git repo inside a workspace is just a normal directory with a `.git` file/dir. The whole feature is three layers: (1) detection — one stat + a couple git commands per directory on expand, (2) display — branch badge inline in the existing tree row, (3) refresh — pull endpoint reusing existing `pullRepo` from the git-backed workspace feature. The detection and pull share the same validation helper. No new auth concepts, no new workspace types, no new state management patterns. When extending, focus on "is this a read concern (already works) or a write concern (must gate through workspace read-only policy)?"

package/.next/standalone/.next/server/chunks/[root-of-the-server]__0-.y6im._.js

@@ -1,3 +0,0 @@
-module.exports=[402662,e=>{"use strict";var t=e.i(702414);e.s(["checkOrigin",0,function(e){let r=e.method.toUpperCase();if("GET"===r||"HEAD"===r||"OPTIONS"===r)return null;let a=e.headers.get("origin"),s=e.headers.get("referer");if(!a&&!s)return null;let n=function(e){let t=Array.from(new Set(["localhost","127.0.0.1",e.split(":")[0],...(process.env.WIKI_OWNER_HOSTS??"").split(",").map(e=>e.trim()).filter(Boolean)])),r=["",":3000",":3003"];e.includes(":")&&r.push(":"+e.split(":")[1]);let a=new Set;for(let e of t)for(let t of["http","https"])for(let s of r)a.add(`${t}://${e}${s}`);return a}(e.headers.get("host")??"");if(a)return n.has(a)?null:t.NextResponse.json({error:"FORBIDDEN",message:"Bad origin"},{status:403});if(s){try{let{protocol:e,host:t}=new URL(s);if(n.has(`${e}//${t}`))return null}catch{}return t.NextResponse.json({error:"FORBIDDEN",message:"Bad referer"},{status:403})}return null}])},365026,e=>{"use strict";var t=e.i(364564),r=e.i(102095),a=e.i(691091),s=e.i(475331),n=e.i(490301),i=e.i(670943),o=e.i(690324),l=e.i(243133),u=e.i(404870),d=e.i(420180),p=e.i(867883),c=e.i(336708),h=e.i(682278),v=e.i(157569),f=e.i(844146),m=e.i(193695);e.i(105888);var R=e.i(530564),_=e.i(912714),w=e.i(750227),g=e.i(702414),E=e.i(402662),x=e.i(660038),y=e.i(359211);async function N(e){let t=(0,E.checkOrigin)(e);if(t)return t;let r=await (0,x.resolveWorkspaceForUser)(e,"write");if(!r.ok)return g.NextResponse.json({error:r.code},{status:r.status});let{rootDir:a}=r,s=(await e.json()).path;if(!s||"string"!=typeof s||/[<>:"|?*]/.test(s)||s.endsWith("/"))return g.NextResponse.json({error:"Invalid file path"},{status:400});let n=(0,y.safeWorkspacePath)(a,s);if(!n)return g.NextResponse.json({error:"Invalid path"},{status:400});try{return await (0,_.stat)(n),g.NextResponse.json({error:"File already exists",path:s},{status:409})}catch(e){if("ENOENT"!==e.code)return g.NextResponse.json({error:"Failed to create file"},{status:500})}try{return await (0,_.mkdir)(w.default.dirname(n),{recursive:!0}),await (0,_.writeFile)(n,"","utf-8"),g.NextResponse.json({ok:!0,path:s})}catch{return g.NextResponse.json({error:"Failed to create file"},{status:500})}}e.s(["POST",0,N],316516);var C=e.i(316516);let P=new t.AppRouteRouteModule({definition:{kind:r.RouteKind.APP_ROUTE,page:"/api/wiki/new-file/route",pathname:"/api/wiki/new-file",filename:"route",bundlePath:""},distDir:".next",relativeProjectDir:"",resolvedPagePath:"[project]/src/app/api/wiki/new-file/route.ts",nextConfigOutput:"standalone",userland:C,...{}}),{workAsyncStorage:k,workUnitAsyncStorage:A,serverHooks:j}=P;async function O(e,t,a){a.requestMeta&&(0,s.setRequestMeta)(e,a.requestMeta),P.isDev&&(0,s.addRequestMeta)(e,"devRequestTimingInternalsEnd",process.hrtime.bigint());let _="/api/wiki/new-file/route";_=_.replace(/\/index$/,"")||"/";let w=await P.prepare(e,t,{srcPage:_,multiZoneDraftMode:!1});if(!w)return t.statusCode=400,t.end("Bad Request"),null==a.waitUntil||a.waitUntil.call(a,Promise.resolve()),null;let{buildId:g,params:E,nextConfig:x,parsedUrl:y,isDraftMode:N,prerenderManifest:C,routerServerContext:k,isOnDemandRevalidate:A,revalidateOnlyGenerated:j,resolvedPathname:O,clientReferenceManifest:T,serverActionsManifest:b}=w,S=(0,o.normalizeAppPath)(_),q=!!(C.dynamicRoutes[S]||C.routes[O]),I=async()=>((null==k?void 0:k.render404)?await k.render404(e,t,y,!1):t.end("This page could not be found"),null);if(q&&!N){let e=!!C.routes[O],t=C.dynamicRoutes[S];if(t&&!1===t.fallback&&!e){if(x.adapterPath)return await I();throw new m.NoFallbackError}}let D=null;!q||P.isDev||N||(D="/index"===(D=O)?"/":D);let H=!0===P.isDev||!q,U=q&&!H;b&&T&&(0,i.setManifestsSingleton)({page:_,clientReferenceManifest:T,serverActionsManifest:b});let F=e.method||"GET",M=(0,n.getTracer)(),$=M.getActiveScopeSpan(),B=!!(null==k?void 0:k.isWrappedByNextServer),K=!!(0,s.getRequestMeta)(e,"minimalMode"),W=(0,s.getRequestMeta)(e,"incrementalCache")||await P.getIncrementalCache(e,x,C,K);null==W||W.resetRequestCache(),globalThis.__incrementalCache=W;let z={params:E,previewProps:C.preview,renderOpts:{experimental:{authInterrupts:!!x.experimental.authInterrupts},cacheComponents:!!x.cacheComponents,supportsDynamicResponse:H,incrementalCache:W,cacheLifeProfiles:x.cacheLife,waitUntil:a.waitUntil,onClose:e=>{t.on("close",e)},onAfterTaskError:void 0,onInstrumentationRequestError:(t,r,a,s)=>P.onRequestError(e,t,a,s,k)},sharedContext:{buildId:g}},L=new l.NodeNextRequest(e),G=new l.NodeNextResponse(t),V=u.NextRequestAdapter.fromNodeNextRequest(L,(0,u.signalFromNodeResponse)(t));try{let s,i=async e=>P.handle(V,z).finally(()=>{if(!e)return;e.setAttributes({"http.status_code":t.statusCode,"next.rsc":!1});let r=M.getRootSpanAttributes();if(!r)return;if(r.get("next.span_type")!==d.BaseServerSpan.handleRequest)return void console.warn(`Unexpected root span type '${r.get("next.span_type")}'. Please report this Next.js issue https://github.com/vercel/next.js`);let a=r.get("next.route");if(a){let t=`${F} ${a}`;e.setAttributes({"next.route":a,"http.route":a,"next.span_name":t}),e.updateName(t),s&&s!==e&&(s.setAttribute("http.route",a),s.updateName(t))}else e.updateName(`${F} ${_}`)}),o=async s=>{var n,o;let l=async({previousCacheEntry:r})=>{try{if(!K&&A&&j&&!r)return t.statusCode=404,t.setHeader("x-nextjs-cache","REVALIDATED"),t.end("This page could not be found"),null;let n=await i(s);e.fetchMetrics=z.renderOpts.fetchMetrics;let o=z.renderOpts.pendingWaitUntil;o&&a.waitUntil&&(a.waitUntil(o),o=void 0);let l=z.renderOpts.collectedTags;if(!q)return await (0,c.sendResponse)(L,G,n,z.renderOpts.pendingWaitUntil),null;{let e=await n.blob(),t=(0,h.toNodeOutgoingHttpHeaders)(n.headers);l&&(t[f.NEXT_CACHE_TAGS_HEADER]=l),!t["content-type"]&&e.type&&(t["content-type"]=e.type);let r=void 0!==z.renderOpts.collectedRevalidate&&!(z.renderOpts.collectedRevalidate>=f.INFINITE_CACHE)&&z.renderOpts.collectedRevalidate,a=void 0===z.renderOpts.collectedExpire||z.renderOpts.collectedExpire>=f.INFINITE_CACHE?void 0:z.renderOpts.collectedExpire;return{value:{kind:R.CachedRouteKind.APP_ROUTE,status:n.status,body:Buffer.from(await e.arrayBuffer()),headers:t},cacheControl:{revalidate:r,expire:a}}}}catch(t){throw(null==r?void 0:r.isStale)&&await P.onRequestError(e,t,{routerKind:"App Router",routePath:_,routeType:"route",revalidateReason:(0,p.getRevalidateReason)({isStaticGeneration:U,isOnDemandRevalidate:A})},!1,k),t}},u=await P.handleResponse({req:e,nextConfig:x,cacheKey:D,routeKind:r.RouteKind.APP_ROUTE,isFallback:!1,prerenderManifest:C,isRoutePPREnabled:!1,isOnDemandRevalidate:A,revalidateOnlyGenerated:j,responseGenerator:l,waitUntil:a.waitUntil,isMinimalMode:K});if(!q)return null;if((null==u||null==(n=u.value)?void 0:n.kind)!==R.CachedRouteKind.APP_ROUTE)throw Object.defineProperty(Error(`Invariant: app-route received invalid cache entry ${null==u||null==(o=u.value)?void 0:o.kind}`),"__NEXT_ERROR_CODE",{value:"E701",enumerable:!1,configurable:!0});K||t.setHeader("x-nextjs-cache",A?"REVALIDATED":u.isMiss?"MISS":u.isStale?"STALE":"HIT"),N&&t.setHeader("Cache-Control","private, no-cache, no-store, max-age=0, must-revalidate");let d=(0,h.fromNodeOutgoingHttpHeaders)(u.value.headers);return K&&q||d.delete(f.NEXT_CACHE_TAGS_HEADER),!u.cacheControl||t.getHeader("Cache-Control")||d.get("Cache-Control")||d.set("Cache-Control",(0,v.getCacheControlHeader)(u.cacheControl)),await (0,c.sendResponse)(L,G,new Response(u.value.body,{headers:d,status:u.value.status||200})),null};B&&$?await o($):(s=M.getActiveScopeSpan(),await M.withPropagatedContext(e.headers,()=>M.trace(d.BaseServerSpan.handleRequest,{spanName:`${F} ${_}`,kind:n.SpanKind.SERVER,attributes:{"http.method":F,"http.target":e.url}},o),void 0,!B))}catch(t){if(t instanceof m.NoFallbackError||await P.onRequestError(e,t,{routerKind:"App Router",routePath:S,routeType:"route",revalidateReason:(0,p.getRevalidateReason)({isStaticGeneration:U,isOnDemandRevalidate:A})},!1,k),q)throw t;return await (0,c.sendResponse)(L,G,new Response(null,{status:500})),null}}e.s(["handler",0,O,"patchFetch",0,function(){return(0,a.patchFetch)({workAsyncStorage:k,workUnitAsyncStorage:A})},"routeModule",0,P,"serverHooks",0,j,"workAsyncStorage",0,k,"workUnitAsyncStorage",0,A],365026)},168315,e=>{e.v(t=>Promise.all(["server/chunks/0sag_@better-auth_memory-adapter_dist_index_mjs_0pvj6im._.js"].map(t=>e.l(t))).then(()=>t(862112)))},317691,e=>{e.v(t=>Promise.all(["server/chunks/0dhv_better-auth_dist_adapters_kysely-adapter_index_mjs_0t4t4z8._.js"].map(t=>e.l(t))).then(()=>t(833412)))},580632,e=>{e.v(e=>Promise.resolve().then(()=>e(270406)))},947559,e=>{e.v(t=>Promise.all(["server/chunks/0ugq_@better-auth_kysely-adapter_dist_bun-sqlite-dialect-DzNwOpKv_mjs_0z1z6m4._.js"].map(t=>e.l(t))).then(()=>t(495181)))},715018,e=>{e.v(t=>Promise.all(["server/chunks/0ugq_@better-auth_kysely-adapter_dist_node-sqlite-dialect_mjs_0qqlvhl._.js"].map(t=>e.l(t))).then(()=>t(698370)))},146843,e=>{e.v(t=>Promise.all(["server/chunks/0ugq_@better-auth_kysely-adapter_dist_d1-sqlite-dialect-C2B7YsIT_mjs_0wynrz3._.js"].map(t=>e.l(t))).then(()=>t(143740)))},84040,e=>{e.v(t=>Promise.all(["server/chunks/0p91_next_0h94sj1._.js"].map(t=>e.l(t))).then(()=>t(815068)))},427669,e=>{e.v(e=>Promise.resolve().then(()=>e(177730)))},687903,e=>{e.v(e=>Promise.resolve().then(()=>e(912714)))},754121,e=>{e.v(t=>Promise.all(["server/chunks/[root-of-the-server]__0d7zxm_._.js","server/chunks/src_lib_search_0ymmp0c._.js"].map(t=>e.l(t))).then(()=>t(437856)))}];
-
-//# sourceMappingURL=%5Broot-of-the-server%5D__0-.y6im._.js.map

package/.next/standalone/.next/server/chunks/[root-of-the-server]__0-3_t2y._.js

@@ -1,3 +0,0 @@
-module.exports=[402662,e=>{"use strict";var t=e.i(702414);e.s(["checkOrigin",0,function(e){let r=e.method.toUpperCase();if("GET"===r||"HEAD"===r||"OPTIONS"===r)return null;let s=e.headers.get("origin"),n=e.headers.get("referer");if(!s&&!n)return null;let a=function(e){let t=Array.from(new Set(["localhost","127.0.0.1",e.split(":")[0],...(process.env.WIKI_OWNER_HOSTS??"").split(",").map(e=>e.trim()).filter(Boolean)])),r=["",":3000",":3003"];e.includes(":")&&r.push(":"+e.split(":")[1]);let s=new Set;for(let e of t)for(let t of["http","https"])for(let n of r)s.add(`${t}://${e}${n}`);return s}(e.headers.get("host")??"");if(s)return a.has(s)?null:t.NextResponse.json({error:"FORBIDDEN",message:"Bad origin"},{status:403});if(n){try{let{protocol:e,host:t}=new URL(n);if(a.has(`${e}//${t}`))return null}catch{}return t.NextResponse.json({error:"FORBIDDEN",message:"Bad referer"},{status:403})}return null}])},761095,(e,t,r)=>{t.exports=e.x("node:net",()=>require("node:net"))},345212,e=>{"use strict";var t=e.i(874533),r=e.i(902157),s=e.i(761095),n=e.i(750227);let a=new Map;function i(e,t){return new Promise(r=>{let n=(0,s.createConnection)(e,t);n.setTimeout(800),n.on("connect",()=>{n.destroy(),r(!0)}),n.on("error",()=>{n.destroy(),r(!1)}),n.on("timeout",()=>{n.destroy(),r(!1)})})}async function o(e,t=3e4){let r=Date.now()+t;for(;Date.now()<r;){let[t,r]=await Promise.all([i(e,"127.0.0.1"),i(e,"::1")]);if(t||r)return!0;await new Promise(e=>setTimeout(e,400))}return!1}function l(e){let t=n.default.join(e,"package.json");if(!(0,r.existsSync)(t))return null;try{return JSON.parse((0,r.readFileSync)(t,"utf-8"))}catch{return null}}function u(e,t){return t.start?"start":t.preview&&(0,r.existsSync)(n.default.join(e,"dist"))?"preview":t.dev?"dev":null}async function p(e,i,p){let c=a.get(e);if(c&&"stopped"!==c.status&&"error"!==c.status)return{port:c.port};let d=await new Promise((e,t)=>{let r=(0,s.createServer)();r.listen(0,"127.0.0.1",()=>{let t=r.address(),s="object"==typeof t&&t?t.port:0;r.close(()=>e(s))}),r.on("error",t)}),h=(0,r.existsSync)(n.default.join(i,"pnpm-lock.yaml"))?"pnpm":(0,r.existsSync)(n.default.join(i,"yarn.lock"))?"yarn":"npm",f=function(e,t,r){let s=l(e);if(!s)return null;let n=s.scripts??{},a=Object.keys({...s.dependencies,...s.devDependencies}).some(e=>"vite"===e||e.includes("vite")),i=(e,r=[])=>({bin:t,args:["run",e,...r.length?["--",...r]:[]],isVite:a});if(r&&n[r])return i(r);let o=u(e,n);return o?i(o):s.main?{bin:"node",args:[s.main],isVite:!1}:null}(i,h,p);if(!f)throw Error("No runnable script found in package.json (need start, preview, or dev)");let v={port:d,process:null,status:"installing",logs:[]};a.set(e,v);let g=e=>{v.logs.push(e),v.logs.length>200&&v.logs.shift()};if(!(0,r.existsSync)(n.default.join(i,"node_modules")))try{g(`[wiki-viewer] Running ${h} install…`),await new Promise((e,r)=>{let s=(0,t.spawn)(h,["install"],{cwd:i,stdio:"pipe"});s.on("exit",t=>0===t?e():r(Error(`${h} install failed (exit ${t})`))),s.on("error",r)})}catch(e){return v.status="error",v.error=String(e),{port:d}}v.status="starting",g(`[wiki-viewer] Starting on port ${d}: ${f.bin} ${f.args.join(" ")}`);let m=f.isVite?["--port",String(d)]:[],w=(0,t.spawn)(f.bin,[...f.args,...m],{cwd:i,stdio:"pipe",env:{...process.env,PORT:String(d),VITE_PORT:String(d)}});v.process=w;let R=e=>{for(let t of e.toString().split("\n"))t.trim()&&g(t)};return w.stdout?.on("data",R),w.stderr?.on("data",R),w.on("exit",t=>{let r=a.get(e);r?.process===w&&(r.status=0===t||null===t?"stopped":"error",r.error=t?`Process exited with code ${t}`:void 0)}),o(d).then(t=>{let r=a.get(e);r?.process===w&&(r.status=t?"running":"error",t||(r.error="Port never became reachable (30 s timeout)"))}),{port:d}}e.s(["getScripts",0,function(e){let t=l(e);if(!t)return{scripts:[],defaultScript:null};let r=t.scripts??{};return{scripts:Object.keys(r),defaultScript:u(e,r)}},"getStatus",0,function(e){let t=a.get(e);return t?{status:t.status,port:t.port||void 0,error:t.error,logs:t.logs}:{status:"stopped",logs:[]}},"resolveByPrefix",0,function(e){for(let t=e.length;t>0;t--){let r=e.slice(0,t).join("/"),s=a.get(r);if(s&&"running"===s.status&&s.port){let n="/"+e.slice(t).join("/");return{relPath:r,port:s.port,rest:n}}}return null},"startApp",0,p,"stopApp",0,function(e){let t=a.get(e);if(t?.process){try{t.process.kill("SIGTERM")}catch{}t.status="stopped"}}])},80520,e=>{"use strict";var t=e.i(364564),r=e.i(102095),s=e.i(691091),n=e.i(475331),a=e.i(490301),i=e.i(670943),o=e.i(690324),l=e.i(243133),u=e.i(404870),p=e.i(420180),c=e.i(867883),d=e.i(336708),h=e.i(682278),f=e.i(157569),v=e.i(844146),g=e.i(193695);e.i(105888);var m=e.i(530564),w=e.i(702414),R=e.i(402662),_=e.i(660038),y=e.i(359211),x=e.i(345212);async function E(e){let t=await (0,_.resolveWorkspaceForUser)(e);if(!t.ok)return w.NextResponse.json({error:t.code},{status:t.status});let{searchParams:r}=new URL(e.url),s=r.get("path")??"",n=(0,x.getStatus)(s),a=(0,y.safeWorkspacePath)(t.rootDir,s),i=a?(0,x.getScripts)(a):{scripts:[],defaultScript:null};return w.NextResponse.json({...n,...i})}async function S(e){let t=(0,R.checkOrigin)(e);if(t)return t;let r=await (0,_.resolveWorkspaceForUser)(e,"write");if(!r.ok)return w.NextResponse.json({error:r.code},{status:r.status});let{rootDir:s}=r,n=await e.json(),a=n.path;if(!a||"string"!=typeof a)return w.NextResponse.json({error:"Missing path"},{status:400});let i=(0,y.safeWorkspacePath)(s,a);if(!i)return w.NextResponse.json({error:"Invalid path"},{status:400});try{let e=await (0,x.startApp)(a,i,n.script);return w.NextResponse.json(e)}catch(e){return w.NextResponse.json({error:String(e)},{status:500})}}async function k(e){let t=(0,R.checkOrigin)(e);if(t)return t;let r=await (0,_.resolveWorkspaceForUser)(e,"write");if(!r.ok)return w.NextResponse.json({error:r.code},{status:r.status});let s=(await e.json()).path;return s&&"string"==typeof s?((0,x.stopApp)(s),w.NextResponse.json({ok:!0})):w.NextResponse.json({error:"Missing path"},{status:400})}e.s(["DELETE",0,k,"GET",0,E,"POST",0,S],41743);var j=e.i(41743);let P=new t.AppRouteRouteModule({definition:{kind:r.RouteKind.APP_ROUTE,page:"/api/wiki/app/route",pathname:"/api/wiki/app",filename:"route",bundlePath:""},distDir:".next",relativeProjectDir:"",resolvedPagePath:"[project]/src/app/api/wiki/app/route.ts",nextConfigOutput:"standalone",userland:j,...{}}),{workAsyncStorage:N,workUnitAsyncStorage:b,serverHooks:C}=P;async function T(e,t,s){s.requestMeta&&(0,n.setRequestMeta)(e,s.requestMeta),P.isDev&&(0,n.addRequestMeta)(e,"devRequestTimingInternalsEnd",process.hrtime.bigint());let w="/api/wiki/app/route";w=w.replace(/\/index$/,"")||"/";let R=await P.prepare(e,t,{srcPage:w,multiZoneDraftMode:!1});if(!R)return t.statusCode=400,t.end("Bad Request"),null==s.waitUntil||s.waitUntil.call(s,Promise.resolve()),null;let{buildId:_,params:y,nextConfig:x,parsedUrl:E,isDraftMode:S,prerenderManifest:k,routerServerContext:j,isOnDemandRevalidate:N,revalidateOnlyGenerated:b,resolvedPathname:C,clientReferenceManifest:T,serverActionsManifest:A}=R,O=(0,o.normalizeAppPath)(w),q=!!(k.dynamicRoutes[O]||k.routes[C]),I=async()=>((null==j?void 0:j.render404)?await j.render404(e,t,E,!1):t.end("This page could not be found"),null);if(q&&!S){let e=!!k.routes[C],t=k.dynamicRoutes[O];if(t&&!1===t.fallback&&!e){if(x.adapterPath)return await I();throw new g.NoFallbackError}}let D=null;!q||P.isDev||S||(D="/index"===(D=C)?"/":D);let U=!0===P.isDev||!q,$=q&&!U;A&&T&&(0,i.setManifestsSingleton)({page:w,clientReferenceManifest:T,serverActionsManifest:A});let H=e.method||"GET",M=(0,a.getTracer)(),F=M.getActiveScopeSpan(),B=!!(null==j?void 0:j.isWrappedByNextServer),K=!!(0,n.getRequestMeta)(e,"minimalMode"),W=(0,n.getRequestMeta)(e,"incrementalCache")||await P.getIncrementalCache(e,x,k,K);null==W||W.resetRequestCache(),globalThis.__incrementalCache=W;let L={params:y,previewProps:k.preview,renderOpts:{experimental:{authInterrupts:!!x.experimental.authInterrupts},cacheComponents:!!x.cacheComponents,supportsDynamicResponse:U,incrementalCache:W,cacheLifeProfiles:x.cacheLife,waitUntil:s.waitUntil,onClose:e=>{t.on("close",e)},onAfterTaskError:void 0,onInstrumentationRequestError:(t,r,s,n)=>P.onRequestError(e,t,s,n,j)},sharedContext:{buildId:_}},z=new l.NodeNextRequest(e),V=new l.NodeNextResponse(t),G=u.NextRequestAdapter.fromNodeNextRequest(z,(0,u.signalFromNodeResponse)(t));try{let n,i=async e=>P.handle(G,L).finally(()=>{if(!e)return;e.setAttributes({"http.status_code":t.statusCode,"next.rsc":!1});let r=M.getRootSpanAttributes();if(!r)return;if(r.get("next.span_type")!==p.BaseServerSpan.handleRequest)return void console.warn(`Unexpected root span type '${r.get("next.span_type")}'. Please report this Next.js issue https://github.com/vercel/next.js`);let s=r.get("next.route");if(s){let t=`${H} ${s}`;e.setAttributes({"next.route":s,"http.route":s,"next.span_name":t}),e.updateName(t),n&&n!==e&&(n.setAttribute("http.route",s),n.updateName(t))}else e.updateName(`${H} ${w}`)}),o=async n=>{var a,o;let l=async({previousCacheEntry:r})=>{try{if(!K&&N&&b&&!r)return t.statusCode=404,t.setHeader("x-nextjs-cache","REVALIDATED"),t.end("This page could not be found"),null;let a=await i(n);e.fetchMetrics=L.renderOpts.fetchMetrics;let o=L.renderOpts.pendingWaitUntil;o&&s.waitUntil&&(s.waitUntil(o),o=void 0);let l=L.renderOpts.collectedTags;if(!q)return await (0,d.sendResponse)(z,V,a,L.renderOpts.pendingWaitUntil),null;{let e=await a.blob(),t=(0,h.toNodeOutgoingHttpHeaders)(a.headers);l&&(t[v.NEXT_CACHE_TAGS_HEADER]=l),!t["content-type"]&&e.type&&(t["content-type"]=e.type);let r=void 0!==L.renderOpts.collectedRevalidate&&!(L.renderOpts.collectedRevalidate>=v.INFINITE_CACHE)&&L.renderOpts.collectedRevalidate,s=void 0===L.renderOpts.collectedExpire||L.renderOpts.collectedExpire>=v.INFINITE_CACHE?void 0:L.renderOpts.collectedExpire;return{value:{kind:m.CachedRouteKind.APP_ROUTE,status:a.status,body:Buffer.from(await e.arrayBuffer()),headers:t},cacheControl:{revalidate:r,expire:s}}}}catch(t){throw(null==r?void 0:r.isStale)&&await P.onRequestError(e,t,{routerKind:"App Router",routePath:w,routeType:"route",revalidateReason:(0,c.getRevalidateReason)({isStaticGeneration:$,isOnDemandRevalidate:N})},!1,j),t}},u=await P.handleResponse({req:e,nextConfig:x,cacheKey:D,routeKind:r.RouteKind.APP_ROUTE,isFallback:!1,prerenderManifest:k,isRoutePPREnabled:!1,isOnDemandRevalidate:N,revalidateOnlyGenerated:b,responseGenerator:l,waitUntil:s.waitUntil,isMinimalMode:K});if(!q)return null;if((null==u||null==(a=u.value)?void 0:a.kind)!==m.CachedRouteKind.APP_ROUTE)throw Object.defineProperty(Error(`Invariant: app-route received invalid cache entry ${null==u||null==(o=u.value)?void 0:o.kind}`),"__NEXT_ERROR_CODE",{value:"E701",enumerable:!1,configurable:!0});K||t.setHeader("x-nextjs-cache",N?"REVALIDATED":u.isMiss?"MISS":u.isStale?"STALE":"HIT"),S&&t.setHeader("Cache-Control","private, no-cache, no-store, max-age=0, must-revalidate");let p=(0,h.fromNodeOutgoingHttpHeaders)(u.value.headers);return K&&q||p.delete(v.NEXT_CACHE_TAGS_HEADER),!u.cacheControl||t.getHeader("Cache-Control")||p.get("Cache-Control")||p.set("Cache-Control",(0,f.getCacheControlHeader)(u.cacheControl)),await (0,d.sendResponse)(z,V,new Response(u.value.body,{headers:p,status:u.value.status||200})),null};B&&F?await o(F):(n=M.getActiveScopeSpan(),await M.withPropagatedContext(e.headers,()=>M.trace(p.BaseServerSpan.handleRequest,{spanName:`${H} ${w}`,kind:a.SpanKind.SERVER,attributes:{"http.method":H,"http.target":e.url}},o),void 0,!B))}catch(t){if(t instanceof g.NoFallbackError||await P.onRequestError(e,t,{routerKind:"App Router",routePath:O,routeType:"route",revalidateReason:(0,c.getRevalidateReason)({isStaticGeneration:$,isOnDemandRevalidate:N})},!1,j),q)throw t;return await (0,d.sendResponse)(z,V,new Response(null,{status:500})),null}}e.s(["handler",0,T,"patchFetch",0,function(){return(0,s.patchFetch)({workAsyncStorage:N,workUnitAsyncStorage:b})},"routeModule",0,P,"serverHooks",0,C,"workAsyncStorage",0,N,"workUnitAsyncStorage",0,b],80520)},168315,e=>{e.v(t=>Promise.all(["server/chunks/0sag_@better-auth_memory-adapter_dist_index_mjs_0pvj6im._.js"].map(t=>e.l(t))).then(()=>t(862112)))},317691,e=>{e.v(t=>Promise.all(["server/chunks/0dhv_better-auth_dist_adapters_kysely-adapter_index_mjs_0t4t4z8._.js"].map(t=>e.l(t))).then(()=>t(833412)))},580632,e=>{e.v(e=>Promise.resolve().then(()=>e(270406)))},947559,e=>{e.v(t=>Promise.all(["server/chunks/0ugq_@better-auth_kysely-adapter_dist_bun-sqlite-dialect-DzNwOpKv_mjs_0z1z6m4._.js"].map(t=>e.l(t))).then(()=>t(495181)))},715018,e=>{e.v(t=>Promise.all(["server/chunks/0ugq_@better-auth_kysely-adapter_dist_node-sqlite-dialect_mjs_0qqlvhl._.js"].map(t=>e.l(t))).then(()=>t(698370)))},146843,e=>{e.v(t=>Promise.all(["server/chunks/0ugq_@better-auth_kysely-adapter_dist_d1-sqlite-dialect-C2B7YsIT_mjs_0wynrz3._.js"].map(t=>e.l(t))).then(()=>t(143740)))},84040,e=>{e.v(t=>Promise.all(["server/chunks/0p91_next_0h94sj1._.js"].map(t=>e.l(t))).then(()=>t(815068)))},427669,e=>{e.v(e=>Promise.resolve().then(()=>e(177730)))},687903,e=>{e.v(e=>Promise.resolve().then(()=>e(912714)))},754121,e=>{e.v(t=>Promise.all(["server/chunks/[root-of-the-server]__0d7zxm_._.js","server/chunks/src_lib_search_0ymmp0c._.js"].map(t=>e.l(t))).then(()=>t(437856)))}];
-
-//# sourceMappingURL=%5Broot-of-the-server%5D__0-3_t2y._.js.map

package/.next/standalone/.next/server/chunks/[root-of-the-server]__0-kjkzt._.js

@@ -1,3 +0,0 @@
-module.exports=[224361,(e,s,r)=>{s.exports=e.x("util",()=>require("util"))},688947,(e,s,r)=>{s.exports=e.x("stream",()=>require("stream"))},427699,(e,s,r)=>{s.exports=e.x("events",()=>require("events"))},81111,(e,s,r)=>{s.exports=e.x("node:stream",()=>require("node:stream"))},500874,(e,s,r)=>{s.exports=e.x("buffer",()=>require("buffer"))},168315,e=>{e.v(s=>Promise.all(["server/chunks/0sag_@better-auth_memory-adapter_dist_index_mjs_0pvj6im._.js"].map(s=>e.l(s))).then(()=>s(862112)))},317691,e=>{e.v(s=>Promise.all(["server/chunks/0dhv_better-auth_dist_adapters_kysely-adapter_index_mjs_0t4t4z8._.js"].map(s=>e.l(s))).then(()=>s(833412)))},580632,e=>{e.v(e=>Promise.resolve().then(()=>e(270406)))},947559,e=>{e.v(s=>Promise.all(["server/chunks/0ugq_@better-auth_kysely-adapter_dist_bun-sqlite-dialect-DzNwOpKv_mjs_0z1z6m4._.js"].map(s=>e.l(s))).then(()=>s(495181)))},715018,e=>{e.v(s=>Promise.all(["server/chunks/0ugq_@better-auth_kysely-adapter_dist_node-sqlite-dialect_mjs_0qqlvhl._.js"].map(s=>e.l(s))).then(()=>s(698370)))},146843,e=>{e.v(s=>Promise.all(["server/chunks/0ugq_@better-auth_kysely-adapter_dist_d1-sqlite-dialect-C2B7YsIT_mjs_0wynrz3._.js"].map(s=>e.l(s))).then(()=>s(143740)))},84040,e=>{e.v(s=>Promise.all(["server/chunks/0p91_next_0h94sj1._.js"].map(s=>e.l(s))).then(()=>s(815068)))},427669,e=>{e.v(e=>Promise.resolve().then(()=>e(177730)))},687903,e=>{e.v(e=>Promise.resolve().then(()=>e(912714)))},754121,e=>{e.v(s=>Promise.all(["server/chunks/[root-of-the-server]__068ni_k._.js","server/chunks/src_lib_search_0ymmp0c._.js"].map(s=>e.l(s))).then(()=>s(437856)))}];
-
-//# sourceMappingURL=%5Broot-of-the-server%5D__0-kjkzt._.js.map