wiki-viewer 1.4.2 → 1.4.3

package/.next/standalone/.next/static/chunks/0uv7ozzpiyp2_.js

@@ -0,0 +1 @@
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,419564,e=>{"use strict";var t=e.i(44501),s=e.i(101685),r=e.i(199075);e.s(["default",0,function({initialPasswordAuth:e,initialGoogle:n}){let[i,a]=(0,s.useState)("signin"),[o,l]=(0,s.useState)(""),[d,c]=(0,s.useState)(""),[u,m]=(0,s.useState)(""),[g,x]=(0,s.useState)(null),[p,f]=(0,s.useState)(!1),[h,b]=(0,s.useState)(n),[j,y]=(0,s.useState)(e),[w,v]=(0,s.useState)("/");async function N(e){e.preventDefault(),x(null),f(!0);try{if("signup"===i){let e=await r.authClient.signUp.email({email:o,password:d,name:u,callbackURL:w});e.error?x(e.error.message??"Sign-up failed"):window.location.href=w}else{let e=await r.authClient.signIn.email({email:o,password:d,callbackURL:w});if(e.error){let t=e.error.status;429===t?x("Too many sign-in attempts. Wait a minute and try again."):x(e.error.message??"Sign-in failed")}else window.location.href=w}}catch(e){x(e instanceof Error?e.message:"Unexpected error")}finally{f(!1)}}async function C(){x(null),f(!0);try{await r.authClient.signIn.social({provider:"google",callbackURL:w})}catch(e){x(e instanceof Error?e.message:"Google sign-in failed"),f(!1)}}return(0,s.useEffect)(()=>{fetch("/api/system/auth-config",{credentials:"include"}).then(e=>e.json()).then(e=>{e&&"object"==typeof e&&(b(!!e.google),y(!1!==e.passwordAuth))}).catch(()=>{});let e=new URLSearchParams(window.location.search).get("next");e&&e.startsWith("/")&&v(e)},[]),(0,t.jsx)("div",{className:"min-h-screen flex items-center justify-center bg-background",children:(0,t.jsxs)("div",{className:"w-full max-w-sm rounded-lg border border-border bg-card p-8 shadow-sm",children:[(0,t.jsx)("h1",{className:"mb-6 text-xl font-semibold text-foreground",children:"Sign in to wiki-viewer"}),h&&(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)("button",{type:"button",onClick:C,disabled:p,className:"flex w-full items-center justify-center gap-2 rounded-md border border-border px-4 py-2 text-sm font-medium hover:bg-accent disabled:opacity-50",children:[(0,t.jsxs)("svg",{viewBox:"0 0 24 24",className:"h-4 w-4","aria-hidden":"true",children:[(0,t.jsx)("path",{fill:"#4285F4",d:"M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"}),(0,t.jsx)("path",{fill:"#34A853",d:"M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"}),(0,t.jsx)("path",{fill:"#FBBC05",d:"M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l3.66-2.84z"}),(0,t.jsx)("path",{fill:"#EA4335",d:"M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"})]}),"Continue with Google"]}),j&&(0,t.jsxs)("div",{className:"my-4 flex items-center gap-3",children:[(0,t.jsx)("hr",{className:"flex-1 border-border"}),(0,t.jsx)("span",{className:"text-xs text-muted-foreground",children:"or"}),(0,t.jsx)("hr",{className:"flex-1 border-border"})]})]}),!j&&!h&&(0,t.jsx)("p",{className:"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive",children:"No sign-in method is configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET, or enable email/password auth."}),j&&(0,t.jsxs)("form",{onSubmit:N,className:"space-y-4",children:["signup"===i&&(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"mb-1 block text-sm font-medium text-foreground",htmlFor:"name",children:"Name"}),(0,t.jsx)("input",{id:"name",type:"text",autoComplete:"name",value:u,onChange:e=>m(e.target.value),required:!0,className:"w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"mb-1 block text-sm font-medium text-foreground",htmlFor:"email",children:"Email"}),(0,t.jsx)("input",{id:"email",type:"email",autoComplete:"email",value:o,onChange:e=>l(e.target.value),required:!0,className:"w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"})]}),(0,t.jsxs)("div",{children:[(0,t.jsx)("label",{className:"mb-1 block text-sm font-medium text-foreground",htmlFor:"password",children:"Password"}),(0,t.jsx)("input",{id:"password",type:"password",autoComplete:"signup"===i?"new-password":"current-password",value:d,onChange:e=>c(e.target.value),required:!0,minLength:8,className:"w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"})]}),g&&(0,t.jsx)("p",{className:"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive",children:g}),(0,t.jsx)("button",{type:"submit",disabled:p,className:"w-full rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50",children:p?"signup"===i?"Creating account...":"Signing in...":"signup"===i?"Create account":"Sign in"})]}),j&&(0,t.jsxs)("p",{className:"mt-4 text-center text-sm text-muted-foreground",children:["signin"===i?"No account?":"Already have an account?"," ",(0,t.jsx)("button",{type:"button",onClick:()=>{a("signin"===i?"signup":"signin"),x(null)},className:"font-medium text-foreground underline-offset-4 hover:underline",children:"signin"===i?"Sign up":"Sign in"})]})]})})}])}]);

package/.next/standalone/.next/static/chunks/135c~rq_ux73w.js

@@ -0,0 +1 @@
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,824627,t=>{"use strict";var e=function(t,r){return(e=Object.setPrototypeOf||({__proto__:[]})instanceof Array&&function(t,e){t.__proto__=e}||function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])})(t,r)},r=function(){return(r=Object.assign||function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t}).apply(this,arguments)};"function"==typeof SuppressedError&&SuppressedError,t.s(["__assign",()=>r,"__awaiter",0,function(t,e,r,n){return new(r||(r=Promise))(function(o,c){function s(t){try{i(n.next(t))}catch(t){c(t)}}function a(t){try{i(n.throw(t))}catch(t){c(t)}}function i(t){var e;t.done?o(t.value):((e=t.value)instanceof r?e:new r(function(t){t(e)})).then(s,a)}i((n=n.apply(t,e||[])).next())})},"__extends",0,function(t,r){if("function"!=typeof r&&null!==r)throw TypeError("Class extends value "+String(r)+" is not a constructor or null");function n(){this.constructor=t}e(t,r),t.prototype=null===r?Object.create(r):(n.prototype=r.prototype,new n)},"__generator",0,function(t,e){var r,n,o,c={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]},s=Object.create(("function"==typeof Iterator?Iterator:Object).prototype);return s.next=a(0),s.throw=a(1),s.return=a(2),"function"==typeof Symbol&&(s[Symbol.iterator]=function(){return this}),s;function a(a){return function(i){var l=[a,i];if(r)throw TypeError("Generator is already executing.");for(;s&&(s=0,l[0]&&(c=0)),c;)try{if(r=1,n&&(o=2&l[0]?n.return:l[0]?n.throw||((o=n.return)&&o.call(n),0):n.next)&&!(o=o.call(n,l[1])).done)return o;switch(n=0,o&&(l=[2&l[0],o.value]),l[0]){case 0:case 1:o=l;break;case 4:return c.label++,{value:l[1],done:!1};case 5:c.label++,n=l[1],l=[0];continue;case 7:l=c.ops.pop(),c.trys.pop();continue;default:if(!(o=(o=c.trys).length>0&&o[o.length-1])&&(6===l[0]||2===l[0])){c=0;continue}if(3===l[0]&&(!o||l[1]>o[0]&&l[1]<o[3])){c.label=l[1];break}if(6===l[0]&&c.label<o[1]){c.label=o[1],o=l;break}if(o&&c.label<o[2]){c.label=o[2],c.ops.push(l);break}o[2]&&c.ops.pop(),c.trys.pop();continue}l=e.call(t,c)}catch(t){l=[6,t],n=0}finally{r=o=0}if(5&l[0])throw l[1];return{value:l[0]?l[1]:void 0,done:!0}}}},"__rest",0,function(t,e){var r={};for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&0>e.indexOf(n)&&(r[n]=t[n]);if(null!=t&&"function"==typeof Object.getOwnPropertySymbols)for(var o=0,n=Object.getOwnPropertySymbols(t);o<n.length;o++)0>e.indexOf(n[o])&&Object.prototype.propertyIsEnumerable.call(t,n[o])&&(r[n[o]]=t[n[o]]);return r},"__spreadArray",0,function(t,e,r){if(r||2==arguments.length)for(var n,o=0,c=e.length;o<c;o++)!n&&o in e||(n||(n=Array.prototype.slice.call(e,0,o)),n[o]=e[o]);return t.concat(n||Array.prototype.slice.call(e))}])},890793,t=>{t.v(e=>Promise.all(["static/chunks/14n5cp8rr-k_b.js","static/chunks/0~fvcxnmv6g_x.js","static/chunks/1674m~gp3w-8h.js","static/chunks/0~ikzdp3hga8n.js","static/chunks/0q0.5-57agpll.js","static/chunks/0q_xpywc4mr6r.js","static/chunks/0rldt2m_ic3fr.js","static/chunks/105.j2~dvdym3.js","static/chunks/0l4qtf8hgz.11.js"].map(e=>t.l(e))).then(()=>e(229414)))},410052,t=>{t.v(e=>Promise.all(["static/chunks/0pc3jws56z~cg.js","static/chunks/144e01xuvhx~x.js","static/chunks/0vp2gi~fq70je.js"].map(e=>t.l(e))).then(()=>e(116818)))},355350,t=>{t.v(e=>Promise.all(["static/chunks/0pc3jws56z~cg.js","static/chunks/09-jtayuhrq~b.js","static/chunks/144e01xuvhx~x.js"].map(e=>t.l(e))).then(()=>e(203010)))},432302,t=>{t.v(e=>Promise.all(["static/chunks/0pc3jws56z~cg.js","static/chunks/0qvlcjvhvpaey.js"].map(e=>t.l(e))).then(()=>e(924659)))}]);

package/.next/standalone/docs/agent-fs-plan.md

@@ -62,9 +62,10 @@ All routes reuse `checkAuth` + `enforceScope` + `withFileMutex` + `safeRootPath`
 ### 2.2 Write (`PUT .../file/<path>`)
 
 - Atomic: write temp in **same dir** → `fsync` → `rename`. (`fsync` dir optional but documented.)
-- Preserve mode of existing file. Do **not** create parent dirs unless body/flag explicitly opts in.
-- `If-Match: <sha256>` → 412 on mismatch. **Required by default for all writes** (see R4); explicit `?force=true` bypasses and is audited.
-- Response: `{path, sha256, size, mtime}`.
+- Preserve mode of existing file. Do **not** create parent dirs unless `?mkdirs=true`.
+- **Create = implicit.** `PUT` to a non-existent path creates the file (write-with-no-prior). Omit `If-Match` for a create; send `If-Match: <sha256>` only when overwriting. A create where the file already exists (no `If-Match`) → 412, so creates can't silently clobber.
+- `If-Match: <sha256>` → 412 on mismatch. **Required by default for overwrites** (see R4); explicit `?force=true` bypasses and is audited.
+- Response: `{path, sha256, size, mtime, created: bool}`.
 
 ### 2.3 Listing (`GET .../ls`)
 
@@ -82,6 +83,12 @@ All routes reuse `checkAuth` + `enforceScope` + `withFileMutex` + `safeRootPath`
 - Checks: source `read`+`mutate`, dest `mutate`.
 - For `.md`: moves the `.proof/<path>.json` sidecar too. Lock ordering: single operation lock, or lock source+dest in **sorted key order** to avoid deadlock.
 
+### 2.6 Delete (`DELETE .../file/<path>`)
+
+- Requires the `delete` scope op (see §3.5) and `If-Match: <sha256>` — the agent must have read the current file first, so it cannot blind-delete. This `If-Match` requirement **is** the confirmation for v1.
+- `.md`: also deletes the sidecar (R3).
+- Directory delete is opt-in and explicit: `?recursive=true`; without it, deleting a non-empty dir is refused. (No human approval queue in v1 — deferred.)
+
 ---
 
 ## 3. Tier 2 — Collab (unchanged)
@@ -90,14 +97,61 @@ Markdown block-ops (`block.replace/insertAfter/insertBefore/delete/append/prepen
 
 ---
 
+## 3.5 Working mode vs Collaborating mode (THE central distinction)
+
+The whole design hinges on the agent knowing **when a file is being actively co-edited by a human** (use the reviewable Tier-2 path) versus **when it's just a file to work on** (use fast raw Tier-1). Today nothing tells the agent this; a wrong guess clobbers a human's pending suggestions. We make the mode **discoverable, documented, and enforced** — three layers so the agent cannot miss it.
+
+### The signal: `X-Collab-State` header (on every read, both tiers)
+
+Every `GET fs/file/<path>` and every Tier-2 snapshot read returns:
+
+```
+X-Collab-State: active | tracked | untracked | not-markdown
+X-Collab-Snapshot: /api/agent/files/<path>.md      # present when state != not-markdown
+```
+
+| State          | Meaning                                                                                                                                                                                                                                      | Agent should…                                                                                                                                             |
+| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `active`       | `.md` that is **live**: either has review artifacts (pending suggestions / unresolved comments / unreverted proof-spans) **OR has a current human edit lease** (someone has the doc open in the editor). A human is collaborating right now. | **Use Tier-2 block-ops.** Your edits become reviewable suggestions. A raw `PUT` is rejected unless `If-Collab-Match` matches (see R6).                    |
+| `tracked`      | `.md` with a sidecar, no artifacts, no lease.                                                                                                                                                                                                | **Prefer Tier-2 for any semantic/prose edit** so provenance accrues. Raw only for mechanical/whole-file ops (e.g. reformat, regenerate). Not a free pass. |
+| `untracked`    | `.md`, no sidecar, no lease — nobody has collaborated.                                                                                                                                                                                       | Raw ok. A reviewable (Tier-2) edit creates a sidecar so future edits are tracked.                                                                         |
+| `not-markdown` | Any non-`.md` file.                                                                                                                                                                                                                          | **Tier-1 raw only** (Tier-2 doesn't apply).                                                                                                               |
+
+**Definition of `active` (two sources, OR'd):**
+
+1. **Artifacts:** `pendingSuggestions > 0` OR `unresolvedComments > 0` OR `proofSpanCount > 0` (from sidecar — cheap, already in memory on read).
+2. **Human edit lease:** a short-TTL presence marker (default 90s, heartbeat ~30s) set when a human opens the doc in the editor and refreshed while it stays open. **This closes the false-negative GPT-5.5 caught:** a human who opens a doc but hasn't typed a suggestion yet still reads `active`, so the agent won't blind-write into a live session. Lease lives in-memory (or the existing SQLite), keyed by `(path)`, set by a lightweight `POST /api/wiki/presence` ping the editor already can issue alongside its chokidar SSE connection. No lease + no artifacts → not active.
+
+### Layer 2 — documented (manifest + skill)
+
+The `/api/agents/install` manifest and the skill state the rule in one sentence:
+
+> _"Before editing a `.md`, read it and check `X-Collab-State`. If `active`, use block-ops (Tier 2) so a human can review. Otherwise use raw fs (Tier 1). For non-markdown, always use raw fs."_
+
+### Layer 3 — enforced (R4 + R6 backstop)
+
+Even a confused or racing agent cannot silently clobber a live session: a raw `PUT` to an `active` `.md` is **rejected with 409 `COLLAB_ACTIVE`** unless it carries a matching `If-Collab-Match` (R6) — and the state is re-checked atomically inside the write mutex, so a session that goes active mid-flight still wins. Any genuinely orphaned suggestion/comment is marked `stale` by reconciliation (R2), never dropped. The 409 returns the Tier-2 snapshot URL, re-teaching the mode.
+
+### What the human sees
+
+- Agent works in Tier-2 on an `active` doc → normal reviewable suggestions (existing UX).
+- Agent raw-writes an `active` doc anyway → `file.rawWritten by ai:<id>` in the AI Panel feed + any unbindable anchors flagged `stale` (not vanished).
+- Agent works on `untracked`/non-md → silent, fast, audited. No collab noise.
+
+---
+
 ## 4. Integration rules (load-bearing)
 
 - **R1 — Shared lock.** A raw write/move/delete on a `.md` acquires the **same** `withFileMutex` key the ops-applier uses. No interleaving with block-ops mid-proof-span.
 - **R2 — No fake provenance.** Raw writes never author proof-spans. After a raw write to a tracked `.md`, emit `file.rawWritten` (writer known) and **reconcile the sidecar synchronously, inside the same mutex** (rebuild `refMap`, set fingerprint to `newSha`, mark affected proof refs stale). Raw edits are unmarked by definition; human sees _who_ via the event, not as an accept/revert suggestion.
   - **GOTCHA (do not regress):** do NOT just "bump fingerprint to newSha and let existing reconciliation fire later." The existing reconciliation triggers on `sidecar.fingerprint != file sha256`; if the raw write sets fingerprint current, the mismatch is gone and rebuild never runs. Because the writer is known, reconcile **eagerly within the write**, not lazily on next read.
-- **R3 — Sidecar lifecycle.** Raw `mv`/`rm` of a `.md` moves/deletes its sidecar (reuse human `wiki/move` logic).
+- **R3 — Sidecar lifecycle.** Raw `mv`/`rm` of a `.md` moves/deletes its sidecar. **NOTE:** the human `wiki/move` route currently does a bare `rename` and does NOT move the sidecar — a latent bug that orphans `.proof/` JSON today. Build a shared `moveSidecar`/`deleteSidecar` helper in `sidecar.ts` and wire **both** the raw-fs path and `wiki/move` to it (fixes the existing bug for free).
 - **R4 — Write guard (If-Match by default).** **All** mutating raw ops (`PUT`/`DELETE`/`move`) REQUIRE `If-Match: <sha256>` by default; 412 on mismatch. An explicit `?force=true` bypasses it and is recorded in the audit row. Rationale: agents edit code/config just as much as `.md`; optional concurrency = silent lost updates, and a format-based safety boundary is arbitrary. Cheap because the agent already has the sha from `GET`.
-- **R5 — Scope unification.** Registration `scope.paths` glob + `scope.ops:[read,mutate]` already exist; raw-fs honors the same. No new scope concepts in v1.
+- **R5 — Scope unification + `delete` op.** Registration `scope.paths` glob already covers **directories natively** (e.g. `notes/**` grants the whole subtree — no file lists). Raw-fs honors the same glob, on every surface (read/ls/search/move/delete results all re-checked). **One addition:** split `delete` out of `mutate`, so `scope.ops` becomes `[read, mutate, delete]`. This lets a human grant "edit but never delete." `mutate` = create/overwrite/move; `delete` = remove. Back-compat: existing `[read, mutate]` agents simply can't delete until re-scoped. Glob dialect (v1): `**`, `*`, `?` only — no braces/negation; advertise this in the manifest.
+- **R6 — Collab-state precondition on raw `.md` writes (closes the TOCTOU race).** `If-Match` protects _bytes_, not _collaboration intent_: a human could create a sidecar/lease after the agent's read but before its raw `PUT`, leaving bytes unchanged so `If-Match` still passes. To prevent silently writing into a session that went `active` mid-flight:
+  - Every `.md` read also returns `X-Collab-Revision: <n>` (bumped on any sidecar/lease state change).
+  - A raw `PUT` to a `.md` must, **inside the same mutex, re-read collab state immediately before writing**: if the doc is now `active` and the request did not supply a matching `If-Collab-Match: <n>`, **reject with 409 `COLLAB_ACTIVE`** + the Tier-2 snapshot URL. The agent then switches to block-ops. `?force=true` still bypasses (audited) for deliberate overrides.
+  - This makes the mode check atomic with the write, not advisory.
 
 ### Event taxonomy (don't overload)
 
@@ -120,7 +174,8 @@ A full-file `PUT` to a `.md` can strip `<proof-span>` marks and shift block boun
 Extend `/api/agents/install` manifest:
 
 - Advertise the new `fs/*` routes.
-- Add a `capabilities` block: `{ maxFileBytes, supportsRange, ifMatchRequired:true, forceBypass:true, search:["grep","glob"] }`.
+- Add a `capabilities` block: `{ maxFileBytes, supportsRange, ifMatchRequired:true, forceBypass:true, search:["grep","glob"], globDialect:"**,*,?", scopeOps:["read","mutate","delete"], collabStates:["active","tracked","untracked","not-markdown"], collabPrecondition:"If-Collab-Match" }`.
+- State the **working-vs-collaborating rule** (§3.5) in prose so the agent self-configures its tier choice.
 - Advertise the optional MCP adapter package + version.
   One manifest; agent self-configures. HTTP routes are the canonical contract.
 
@@ -135,6 +190,8 @@ Extend `/api/agents/install` manifest:
   - `edit_file` (str-replace) → **client-side**: read → transform → `PUT If-Match`. (Server stays dumb; edit footguns live in the adapter.)
   - `list_directory` → `GET fs/ls`
   - `search` → `POST fs/search`
+  - `delete_file` → `DELETE fs/file` (requires `delete` scope + `If-Match`)
+- The shim reads `X-Collab-State` and, when `active`, **warns or routes the edit through the Tier-2 block-op tools** instead of a blind raw write — so even off-the-shelf MCP clients respect collaborating mode.
 - Do **not** make the core app MCP-native first. The app already has HTTP auth/discovery; the shim adapts to Claude Code / Cursor / Codex without poisoning the core.
 
 ---
@@ -165,7 +222,8 @@ Extend `/api/agents/install` manifest:
 5. `fs/search` (grep/glob, limits).
 6. Extend `/api/agents/install` manifest + capabilities.
 7. `wiki-viewer-mcp` adapter (read/write/edit/list/search).
-8. Tests: traversal, symlink escape, If-Match 412, sidecar move, scope filtering on ls/search, big-file Range, binary skip in grep.
+8. **Mode plumbing:** human edit-lease (`POST /api/wiki/presence` + TTL, editor heartbeat), `X-Collab-State` + `X-Collab-Revision` headers on both read paths, R6 atomic re-check + 409 `COLLAB_ACTIVE` on raw `.md` writes. Plus `delete` scope op + create/`?mkdirs`/`?recursive` semantics.
+9. Tests: traversal, symlink escape, If-Match 412, create-collision 412, sidecar move (incl. `wiki/move` bug fix), scope filtering on ls/search, big-file Range, binary skip in grep, **`X-Collab-State` matrix incl. lease-only `active`**, **R6 TOCTOU: doc goes active between read and raw PUT → 409**, stale-anchor after raw `.md` overwrite, `delete` op gating, lease expiry flips active→tracked.
 
 ```
 

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-viewer",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "Local file viewer and wiki — view markdown, HTML, PDFs, notebooks, office docs, and more from any directory",
   "license": "MIT",
   "type": "module",

package/.next/standalone/src/app/signin/page.tsx

@@ -1,231 +1,16 @@
-"use client";
+import SignInForm from "./signin-form";
+import { passwordAuthEnabled } from "@/lib/auth/server";
 
-import { useState, useEffect, type FormEvent } from "react";
-import { authClient } from "@/lib/auth/client";
+// Server component: resolve the available auth methods at render time so the
+// initial HTML already reflects the configuration. This prevents the password
+// form from flashing on load when it is disabled (AUTH_DISABLE_PASSWORD=1).
+export const dynamic = "force-dynamic";
 
 export default function SignInPage() {
-	const [mode, setMode] = useState<"signin" | "signup">("signin");
-	const [email, setEmail] = useState("");
-	const [password, setPassword] = useState("");
-	const [name, setName] = useState("");
-	const [error, setError] = useState<string | null>(null);
-	const [loading, setLoading] = useState(false);
-	const [hasGoogle, setHasGoogle] = useState(false);
-	const [passwordAuth, setPasswordAuth] = useState(true);
-	const [callbackURL, setCallbackURL] = useState("/");
-
-	useEffect(() => {
-		// Learn which auth methods to show. Public endpoint, no session needed.
-		fetch("/api/system/auth-config", { credentials: "include" })
-			.then((r) => r.json())
-			.then((data: unknown) => {
-				if (data && typeof data === "object") {
-					const cfg = data as { google?: boolean; passwordAuth?: boolean };
-					setHasGoogle(Boolean(cfg.google));
-					// Default to showing the password form unless told otherwise, so a
-					// failed fetch never leaves the user with no way to sign in.
-					setPasswordAuth(cfg.passwordAuth !== false);
-				}
-			})
-			.catch(() => {});
-
-		// Honour ?next= redirect param
-		const params = new URLSearchParams(window.location.search);
-		const next = params.get("next");
-		if (next && next.startsWith("/")) setCallbackURL(next);
-	}, []);
-
-	async function handleSubmit(e: FormEvent) {
-		e.preventDefault();
-		setError(null);
-		setLoading(true);
-		try {
-			if (mode === "signup") {
-				const res = await authClient.signUp.email({
-					email,
-					password,
-					name,
-					callbackURL,
-				});
-				if (res.error) {
-					setError(res.error.message ?? "Sign-up failed");
-				} else {
-					window.location.href = callbackURL;
-				}
-			} else {
-				const res = await authClient.signIn.email({
-					email,
-					password,
-					callbackURL,
-				});
-				if (res.error) {
-					const status = res.error.status;
-					if (status === 429) {
-						setError("Too many sign-in attempts. Wait a minute and try again.");
-					} else {
-						setError(res.error.message ?? "Sign-in failed");
-					}
-				} else {
-					window.location.href = callbackURL;
-				}
-			}
-		} catch (err: unknown) {
-			setError(err instanceof Error ? err.message : "Unexpected error");
-		} finally {
-			setLoading(false);
-		}
-	}
-
-	async function handleGoogle() {
-		setError(null);
-		setLoading(true);
-		try {
-			await authClient.signIn.social({ provider: "google", callbackURL });
-		} catch (err: unknown) {
-			setError(err instanceof Error ? err.message : "Google sign-in failed");
-			setLoading(false);
-		}
-	}
-
+	const google = Boolean(
+		process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET,
+	);
 	return (
-		<div className="min-h-screen flex items-center justify-center bg-background">
-			<div className="w-full max-w-sm rounded-lg border border-border bg-card p-8 shadow-sm">
-				<h1 className="mb-6 text-xl font-semibold text-foreground">Sign in to wiki-viewer</h1>
-
-				{hasGoogle && (
-					<>
-						<button
-							type="button"
-							onClick={handleGoogle}
-							disabled={loading}
-							className="flex w-full items-center justify-center gap-2 rounded-md border border-border px-4 py-2 text-sm font-medium hover:bg-accent disabled:opacity-50"
-						>
-							<svg viewBox="0 0 24 24" className="h-4 w-4" aria-hidden="true">
-								<path
-									fill="#4285F4"
-									d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"
-								/>
-								<path
-									fill="#34A853"
-									d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"
-								/>
-								<path
-									fill="#FBBC05"
-									d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l3.66-2.84z"
-								/>
-								<path
-									fill="#EA4335"
-									d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"
-								/>
-							</svg>
-							Continue with Google
-						</button>
-						{passwordAuth && (
-							<div className="my-4 flex items-center gap-3">
-								<hr className="flex-1 border-border" />
-								<span className="text-xs text-muted-foreground">or</span>
-								<hr className="flex-1 border-border" />
-							</div>
-						)}
-					</>
-				)}
-
-				{!passwordAuth && !hasGoogle && (
-					<p className="rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive">
-						No sign-in method is configured. Set GOOGLE_CLIENT_ID and
-						GOOGLE_CLIENT_SECRET, or enable email/password auth.
-					</p>
-				)}
-
-				{passwordAuth && (
-				<form onSubmit={handleSubmit} className="space-y-4">
-					{mode === "signup" && (
-						<div>
-							<label className="mb-1 block text-sm font-medium text-foreground" htmlFor="name">
-								Name
-							</label>
-							<input
-								id="name"
-								type="text"
-								autoComplete="name"
-								value={name}
-								onChange={(e) => setName(e.target.value)}
-								required
-								className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
-							/>
-						</div>
-					)}
-					<div>
-						<label className="mb-1 block text-sm font-medium text-foreground" htmlFor="email">
-							Email
-						</label>
-						<input
-							id="email"
-							type="email"
-							autoComplete="email"
-							value={email}
-							onChange={(e) => setEmail(e.target.value)}
-							required
-							className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
-						/>
-					</div>
-					<div>
-						<label
-							className="mb-1 block text-sm font-medium text-foreground"
-							htmlFor="password"
-						>
-							Password
-						</label>
-						<input
-							id="password"
-							type="password"
-							autoComplete={mode === "signup" ? "new-password" : "current-password"}
-							value={password}
-							onChange={(e) => setPassword(e.target.value)}
-							required
-							minLength={8}
-							className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
-						/>
-					</div>
-
-					{error && (
-						<p className="rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive">
-							{error}
-						</p>
-					)}
-
-					<button
-						type="submit"
-						disabled={loading}
-						className="w-full rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50"
-					>
-						{loading
-							? mode === "signup"
-								? "Creating account..."
-								: "Signing in..."
-							: mode === "signup"
-								? "Create account"
-								: "Sign in"}
-					</button>
-				</form>
-				)}
-
-				{passwordAuth && (
-				<p className="mt-4 text-center text-sm text-muted-foreground">
-					{mode === "signin" ? "No account?" : "Already have an account?"}{" "}
-					<button
-						type="button"
-						onClick={() => {
-							setMode(mode === "signin" ? "signup" : "signin");
-							setError(null);
-						}}
-						className="font-medium text-foreground underline-offset-4 hover:underline"
-					>
-						{mode === "signin" ? "Sign up" : "Sign in"}
-					</button>
-				</p>
-				)}
-			</div>
-		</div>
+		<SignInForm initialPasswordAuth={passwordAuthEnabled} initialGoogle={google} />
 	);
 }

package/.next/standalone/src/app/signin/signin-form.tsx

@@ -0,0 +1,238 @@
+"use client";
+
+import { useState, useEffect, type FormEvent } from "react";
+import { authClient } from "@/lib/auth/client";
+
+export default function SignInForm({
+	initialPasswordAuth,
+	initialGoogle,
+}: {
+	initialPasswordAuth: boolean;
+	initialGoogle: boolean;
+}) {
+	const [mode, setMode] = useState<"signin" | "signup">("signin");
+	const [email, setEmail] = useState("");
+	const [password, setPassword] = useState("");
+	const [name, setName] = useState("");
+	const [error, setError] = useState<string | null>(null);
+	const [loading, setLoading] = useState(false);
+	// Seed from server-rendered values so the first paint already matches the
+	// configured auth methods. This avoids a flash of the password form when it
+	// is disabled. The fetch below only refreshes in case config changed.
+	const [hasGoogle, setHasGoogle] = useState(initialGoogle);
+	const [passwordAuth, setPasswordAuth] = useState(initialPasswordAuth);
+	const [callbackURL, setCallbackURL] = useState("/");
+
+	useEffect(() => {
+		// Refresh which auth methods to show. Public endpoint, no session needed.
+		fetch("/api/system/auth-config", { credentials: "include" })
+			.then((r) => r.json())
+			.then((data: unknown) => {
+				if (data && typeof data === "object") {
+					const cfg = data as { google?: boolean; passwordAuth?: boolean };
+					setHasGoogle(Boolean(cfg.google));
+					setPasswordAuth(cfg.passwordAuth !== false);
+				}
+			})
+			.catch(() => {});
+
+		// Honour ?next= redirect param
+		const params = new URLSearchParams(window.location.search);
+		const next = params.get("next");
+		if (next && next.startsWith("/")) setCallbackURL(next);
+	}, []);
+
+	async function handleSubmit(e: FormEvent) {
+		e.preventDefault();
+		setError(null);
+		setLoading(true);
+		try {
+			if (mode === "signup") {
+				const res = await authClient.signUp.email({
+					email,
+					password,
+					name,
+					callbackURL,
+				});
+				if (res.error) {
+					setError(res.error.message ?? "Sign-up failed");
+				} else {
+					window.location.href = callbackURL;
+				}
+			} else {
+				const res = await authClient.signIn.email({
+					email,
+					password,
+					callbackURL,
+				});
+				if (res.error) {
+					const status = res.error.status;
+					if (status === 429) {
+						setError("Too many sign-in attempts. Wait a minute and try again.");
+					} else {
+						setError(res.error.message ?? "Sign-in failed");
+					}
+				} else {
+					window.location.href = callbackURL;
+				}
+			}
+		} catch (err: unknown) {
+			setError(err instanceof Error ? err.message : "Unexpected error");
+		} finally {
+			setLoading(false);
+		}
+	}
+
+	async function handleGoogle() {
+		setError(null);
+		setLoading(true);
+		try {
+			await authClient.signIn.social({ provider: "google", callbackURL });
+		} catch (err: unknown) {
+			setError(err instanceof Error ? err.message : "Google sign-in failed");
+			setLoading(false);
+		}
+	}
+
+	return (
+		<div className="min-h-screen flex items-center justify-center bg-background">
+			<div className="w-full max-w-sm rounded-lg border border-border bg-card p-8 shadow-sm">
+				<h1 className="mb-6 text-xl font-semibold text-foreground">Sign in to wiki-viewer</h1>
+
+				{hasGoogle && (
+					<>
+						<button
+							type="button"
+							onClick={handleGoogle}
+							disabled={loading}
+							className="flex w-full items-center justify-center gap-2 rounded-md border border-border px-4 py-2 text-sm font-medium hover:bg-accent disabled:opacity-50"
+						>
+							<svg viewBox="0 0 24 24" className="h-4 w-4" aria-hidden="true">
+								<path
+									fill="#4285F4"
+									d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"
+								/>
+								<path
+									fill="#34A853"
+									d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"
+								/>
+								<path
+									fill="#FBBC05"
+									d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l3.66-2.84z"
+								/>
+								<path
+									fill="#EA4335"
+									d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"
+								/>
+							</svg>
+							Continue with Google
+						</button>
+						{passwordAuth && (
+							<div className="my-4 flex items-center gap-3">
+								<hr className="flex-1 border-border" />
+								<span className="text-xs text-muted-foreground">or</span>
+								<hr className="flex-1 border-border" />
+							</div>
+						)}
+					</>
+				)}
+
+				{!passwordAuth && !hasGoogle && (
+					<p className="rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive">
+						No sign-in method is configured. Set GOOGLE_CLIENT_ID and
+						GOOGLE_CLIENT_SECRET, or enable email/password auth.
+					</p>
+				)}
+
+				{passwordAuth && (
+				<form onSubmit={handleSubmit} className="space-y-4">
+					{mode === "signup" && (
+						<div>
+							<label className="mb-1 block text-sm font-medium text-foreground" htmlFor="name">
+								Name
+							</label>
+							<input
+								id="name"
+								type="text"
+								autoComplete="name"
+								value={name}
+								onChange={(e) => setName(e.target.value)}
+								required
+								className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
+							/>
+						</div>
+					)}
+					<div>
+						<label className="mb-1 block text-sm font-medium text-foreground" htmlFor="email">
+							Email
+						</label>
+						<input
+							id="email"
+							type="email"
+							autoComplete="email"
+							value={email}
+							onChange={(e) => setEmail(e.target.value)}
+							required
+							className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
+						/>
+					</div>
+					<div>
+						<label
+							className="mb-1 block text-sm font-medium text-foreground"
+							htmlFor="password"
+						>
+							Password
+						</label>
+						<input
+							id="password"
+							type="password"
+							autoComplete={mode === "signup" ? "new-password" : "current-password"}
+							value={password}
+							onChange={(e) => setPassword(e.target.value)}
+							required
+							minLength={8}
+							className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
+						/>
+					</div>
+
+					{error && (
+						<p className="rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive">
+							{error}
+						</p>
+					)}
+
+					<button
+						type="submit"
+						disabled={loading}
+						className="w-full rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50"
+					>
+						{loading
+							? mode === "signup"
+								? "Creating account..."
+								: "Signing in..."
+							: mode === "signup"
+								? "Create account"
+								: "Sign in"}
+					</button>
+				</form>
+				)}
+
+				{passwordAuth && (
+				<p className="mt-4 text-center text-sm text-muted-foreground">
+					{mode === "signin" ? "No account?" : "Already have an account?"}{" "}
+					<button
+						type="button"
+						onClick={() => {
+							setMode(mode === "signin" ? "signup" : "signin");
+							setError(null);
+						}}
+						className="font-medium text-foreground underline-offset-4 hover:underline"
+					>
+						{mode === "signin" ? "Sign up" : "Sign in"}
+					</button>
+				</p>
+				)}
+			</div>
+		</div>
+	);
+}