wiki-viewer 1.7.1 → 1.8.0

package/.next/standalone/src/app/api/system/admins/route.ts

@@ -0,0 +1,103 @@
+/**
+ * Admin management API.
+ *
+ * GET  /api/system/admins  — any signed-in user (returns isAdmin flag, admin list,
+ *                            and user roster if caller is admin).
+ * POST   { userId }        — admin-only: promote user to admin.
+ * DELETE { userId }        — admin-only: demote user; refuses to remove last admin.
+ *
+ * Bootstrap: first authenticated request triggers ensureBootstrapAdmin so the
+ * first user to sign in becomes admin when no WIKI_ADMIN_EMAILS is set.
+ */
+import { NextResponse } from "next/server";
+import Database from "better-sqlite3";
+import path from "node:path";
+import os from "node:os";
+import { mkdirSync } from "node:fs";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import {
+	isAdmin,
+	listAdmins,
+	addAdmin,
+	removeAdmin,
+	requireAdmin,
+	ensureBootstrapAdmin,
+} from "@/lib/auth/admin";
+
+export const runtime = "nodejs";
+
+interface UserRow {
+	id: string;
+	email: string;
+	name: string;
+}
+
+function queryAllUsers(): UserRow[] {
+	try {
+		const dir = path.join(process.env.HOME ?? os.homedir(), ".wiki-viewer");
+		mkdirSync(dir, { recursive: true });
+		const db = new Database(path.join(dir, "auth.db"));
+		db.pragma("journal_mode = WAL");
+		return db.prepare("SELECT id, email, name FROM user").all() as UserRow[];
+	} catch {
+		return [];
+	}
+}
+
+export async function GET(request: Request) {
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
+	// Bootstrap: first authenticated user becomes admin if no admin set yet.
+	await ensureBootstrapAdmin(auth.user.id);
+
+	const admin = await isAdmin(auth.user.id, auth.user.email);
+	const admins = await listAdmins();
+	const users = admin ? queryAllUsers() : [];
+
+	return NextResponse.json({ admins, isAdmin: admin, users });
+}
+
+export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const authResult = await requireAdmin(request);
+	if (!authResult.ok)
+		return NextResponse.json({ error: authResult.code }, { status: authResult.status });
+
+	const body: { userId?: string } = await request.json();
+	if (!body.userId?.trim())
+		return NextResponse.json({ error: "Missing userId" }, { status: 400 });
+
+	await addAdmin(body.userId.trim());
+	const admins = await listAdmins();
+	return NextResponse.json({ ok: true, admins });
+}
+
+export async function DELETE(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const authResult = await requireAdmin(request);
+	if (!authResult.ok)
+		return NextResponse.json({ error: authResult.code }, { status: authResult.status });
+
+	const body: { userId?: string } = await request.json();
+	if (!body.userId?.trim())
+		return NextResponse.json({ error: "Missing userId" }, { status: 400 });
+
+	try {
+		await removeAdmin(body.userId.trim());
+	} catch (e) {
+		const msg = e instanceof Error ? e.message : String(e);
+		if (msg.startsWith("LAST_ADMIN")) {
+			return NextResponse.json({ error: "LAST_ADMIN", message: msg }, { status: 409 });
+		}
+		throw e;
+	}
+
+	const admins = await listAdmins();
+	return NextResponse.json({ ok: true, admins });
+}

package/.next/standalone/src/app/api/system/reveal/route.ts

@@ -2,14 +2,15 @@ import { exec } from "node:child_process";
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { getRootDir } from "@/lib/root-dir";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 export async function POST(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
@@ -17,8 +18,8 @@ export async function POST(request: Request) {
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 
 	// Path traversal guard
-	const resolved = path.resolve(getRootDir(), rel);
-	if (resolved !== getRootDir() && !resolved.startsWith(getRootDir() + path.sep))
+	const resolved = safeWorkspacePath(rootDir, rel);
+	if (!resolved)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 
 	// Open in system file manager

package/.next/standalone/src/app/api/system/set-root/route.ts

@@ -1,9 +1,25 @@
+/**
+ * Legacy set-root endpoint — back-compat shim for D1.
+ *
+ * Behaviour:
+ *  1. Validate dir (same as before).
+ *  2. Create (or find) a workspace for rootDir in the registry.
+ *  3. Keep setting the process-global rootDir + writing lastOpenedPath to config
+ *     so the legacy fallback path still works for the existing client.
+ *  4. Return { ok, path, workspaceId } — added workspaceId for D2 migration.
+ *
+ * NOTE: NOT admin-gated here so the current single-user flow is unaffected.
+ * The new POST /api/system/workspaces route is admin-gated; D2 will switch the
+ * UI to use that endpoint.
+ */
 import { stat } from "node:fs/promises";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
 import { requireUser } from "@/lib/auth/server";
 import { writeConfig } from "@/lib/config";
 import { setRootDir } from "@/lib/root-dir";
+import { listWorkspaces, createWorkspace } from "@/lib/workspaces";
+import path from "node:path";
 
 export async function POST(request: Request) {
 	const csrf = checkOrigin(request);
@@ -24,7 +40,14 @@ export async function POST(request: Request) {
 		return NextResponse.json({ error: "Directory not found" }, { status: 404 });
 	}
 
+	// Legacy: keep the global + config in sync for the fallback resolver.
 	setRootDir(dir);
 	await writeConfig({ lastOpenedPath: dir });
-	return NextResponse.json({ ok: true, path: dir });
+
+	// Find or create a workspace for this rootDir so the registry is populated.
+	const resolved = path.resolve(dir);
+	const existing = (await listWorkspaces()).find((w) => w.rootDir === resolved);
+	const ws = existing ?? (await createWorkspace({ rootDir: dir, createdBy: auth.user.id }));
+
+	return NextResponse.json({ ok: true, path: dir, workspaceId: ws.id });
 }

package/.next/standalone/src/app/api/system/users/route.ts

@@ -0,0 +1,120 @@
+/**
+ * POST /api/system/users  (admin only)
+ *
+ * Admin creates a new account with a generated temporary password, returned
+ * once in the response. The new user signs in and changes it. The signup
+ * allowlist is bypassed for admin-initiated creation (the admin is the gate).
+ *
+ * This calls auth.api.signUpEmail server-side; the session it would mint for
+ * the new user is discarded (we never forward those Set-Cookie headers), so
+ * the admin's own session is untouched.
+ */
+export const runtime = "nodejs";
+
+import { NextResponse } from "next/server";
+import { randomBytes } from "node:crypto";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireAdmin } from "@/lib/auth/admin";
+import { auth, authReady, withAdminUserCreate, passwordAuthEnabled, db } from "@/lib/auth/server";
+
+const EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+
+/** Readable temp password: 4 groups, mixed case + digits, no ambiguous chars. */
+function generateTempPassword(): string {
+	const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
+	const bytes = randomBytes(16);
+	let out = "";
+	for (let i = 0; i < 16; i++) {
+		out += alphabet[bytes[i] % alphabet.length];
+		if (i % 4 === 3 && i < 15) out += "-";
+	}
+	return out; // e.g. "k7Pm-9QrT-x2Vn-bL4w"
+}
+
+export async function POST(req: Request): Promise<NextResponse> {
+	const csrf = checkOrigin(req);
+	if (csrf) return csrf;
+
+	const admin = await requireAdmin(req);
+	if (!admin.ok) {
+		return NextResponse.json({ error: admin.code }, { status: admin.status });
+	}
+
+	if (!passwordAuthEnabled) {
+		return NextResponse.json(
+			{ error: "PASSWORD_AUTH_DISABLED", message: "Email/password sign-in is disabled; cannot create password accounts." },
+			{ status: 400 },
+		);
+	}
+
+	let body: { email?: unknown; name?: unknown };
+	try {
+		body = (await req.json()) as { email?: unknown; name?: unknown };
+	} catch {
+		return NextResponse.json({ error: "INVALID_PAYLOAD", message: "Invalid JSON" }, { status: 400 });
+	}
+
+	const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+	const name = typeof body.name === "string" && body.name.trim() ? body.name.trim() : email.split("@")[0];
+
+	if (!EMAIL_RE.test(email)) {
+		return NextResponse.json({ error: "INVALID_EMAIL", message: "A valid email is required" }, { status: 400 });
+	}
+
+	const tempPassword = generateTempPassword();
+
+	await authReady();
+	// Reject duplicates up front (signUpEmail may otherwise create a second
+	// credential row or silently succeed depending on Better Auth internals).
+	try {
+		const existing = db
+			.prepare("SELECT 1 FROM user WHERE lower(email) = ? LIMIT 1")
+			.get(email);
+		if (existing) {
+			return NextResponse.json(
+				{ error: "USER_EXISTS", message: "A user with that email already exists." },
+				{ status: 409 },
+			);
+		}
+	} catch {
+		// If the lookup fails, fall through and let signUpEmail decide.
+	}
+
+	try {
+		// Bypass the signup allowlist for this admin-initiated creation. The
+		// returned response (and any session cookie) is intentionally discarded.
+		const result = await withAdminUserCreate(() =>
+			auth.api.signUpEmail({
+				body: { email, password: tempPassword, name },
+				asResponse: true,
+			}),
+		);
+		if (!result.ok) {
+			const text = await result.text().catch(() => "");
+			if (/exist|unique|already/i.test(text)) {
+				return NextResponse.json(
+					{ error: "USER_EXISTS", message: "A user with that email already exists." },
+					{ status: 409 },
+				);
+			}
+			return NextResponse.json(
+				{ error: "CREATE_FAILED", message: text || "Failed to create user" },
+				{ status: 500 },
+			);
+		}
+	} catch (e) {
+		const msg = e instanceof Error ? e.message : "";
+		if (/exist|unique|already/i.test(msg)) {
+			return NextResponse.json(
+				{ error: "USER_EXISTS", message: "A user with that email already exists." },
+				{ status: 409 },
+			);
+		}
+		return NextResponse.json(
+			{ error: "CREATE_FAILED", message: msg || "Failed to create user" },
+			{ status: 500 },
+		);
+	}
+
+	return NextResponse.json({ ok: true, email, name, tempPassword });
+}

package/.next/standalone/src/app/api/system/workspaces/[id]/open/route.ts

@@ -0,0 +1,34 @@
+/**
+ * POST /api/system/workspaces/[id]/open
+ *
+ * Client calls this when switching to a workspace.  Records lastOpenedAt so
+ * the most-recently-used workspace can be selected on next load.
+ */
+import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import { isAdmin } from "@/lib/auth/admin";
+import { getWorkspace, touchWorkspace, userCanAccess } from "@/lib/workspaces";
+
+export const runtime = "nodejs";
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function POST(request: Request, { params }: Params) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
+	const { id } = await params;
+	const ws = await getWorkspace(id);
+	if (!ws) return NextResponse.json({ error: "WORKSPACE_NOT_FOUND" }, { status: 404 });
+
+	const admin = await isAdmin(auth.user.id, auth.user.email);
+	if (!userCanAccess(ws, auth.user.id, admin))
+		return NextResponse.json({ error: "WORKSPACE_FORBIDDEN" }, { status: 403 });
+
+	await touchWorkspace(id);
+	return NextResponse.json({ ok: true });
+}

package/.next/standalone/src/app/api/system/workspaces/[id]/route.ts

@@ -0,0 +1,74 @@
+/**
+ * Per-workspace management API.
+ *
+ * PATCH  /api/system/workspaces/[id]  — update name, pinnedPaths (any user with
+ *                                       access), or allowedUserIds (admin-only).
+ * DELETE /api/system/workspaces/[id]  — admin-only: remove workspace from registry
+ *                                       (never touches the filesystem directory).
+ */
+import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import { isAdmin, requireAdmin } from "@/lib/auth/admin";
+import {
+	getWorkspace,
+	renameWorkspace,
+	removeWorkspace,
+	setWorkspaceAccess,
+	setWorkspacePins,
+	userCanAccess,
+} from "@/lib/workspaces";
+
+export const runtime = "nodejs";
+
+type Params = { params: Promise<{ id: string }> };
+
+export async function PATCH(request: Request, { params }: Params) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
+	const { id } = await params;
+	const ws = await getWorkspace(id);
+	if (!ws) return NextResponse.json({ error: "WORKSPACE_NOT_FOUND" }, { status: 404 });
+
+	const admin = await isAdmin(auth.user.id, auth.user.email);
+	if (!userCanAccess(ws, auth.user.id, admin))
+		return NextResponse.json({ error: "WORKSPACE_FORBIDDEN" }, { status: 403 });
+
+	const body: {
+		name?: string;
+		pinnedPaths?: string[];
+		allowedUserIds?: string[];
+	} = await request.json();
+
+	// allowedUserIds is admin-only
+	if (body.allowedUserIds !== undefined && !admin)
+		return NextResponse.json({ error: "ADMIN_REQUIRED" }, { status: 403 });
+
+	// Apply each field
+	if (body.name !== undefined) await renameWorkspace(id, body.name.trim());
+	if (body.pinnedPaths !== undefined) await setWorkspacePins(id, body.pinnedPaths);
+	if (body.allowedUserIds !== undefined) await setWorkspaceAccess(id, body.allowedUserIds);
+
+	const updated = await getWorkspace(id);
+	return NextResponse.json({ ok: true, workspace: updated });
+}
+
+export async function DELETE(request: Request, { params }: Params) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const authResult = await requireAdmin(request);
+	if (!authResult.ok)
+		return NextResponse.json({ error: authResult.code }, { status: authResult.status });
+
+	const { id } = await params;
+	const ws = await getWorkspace(id);
+	if (!ws) return NextResponse.json({ error: "WORKSPACE_NOT_FOUND" }, { status: 404 });
+
+	await removeWorkspace(id);
+	return NextResponse.json({ ok: true });
+}

package/.next/standalone/src/app/api/system/workspaces/route.ts

@@ -0,0 +1,67 @@
+/**
+ * Workspace management API — list and create.
+ *
+ * GET  /api/system/workspaces  — any signed-in user; returns workspaces the
+ *                                caller can access + isAdmin flag.
+ * POST { rootDir, name? }      — admin-only: create a new workspace.
+ *
+ * Bootstrap: first authenticated request triggers ensureBootstrapAdmin.
+ */
+import { stat } from "node:fs/promises";
+import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import { isAdmin, requireAdmin, ensureBootstrapAdmin } from "@/lib/auth/admin";
+import {
+	listWorkspaces,
+	createWorkspace,
+	migrateConfigToWorkspaces,
+	userCanAccess,
+} from "@/lib/workspaces";
+
+export const runtime = "nodejs";
+
+export async function GET(request: Request) {
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
+	// Bootstrap: first authenticated user becomes admin if no admin set yet.
+	await ensureBootstrapAdmin(auth.user.id);
+	await migrateConfigToWorkspaces();
+
+	const admin = await isAdmin(auth.user.id, auth.user.email);
+	const all = await listWorkspaces();
+	const workspaces = all.filter((ws) => userCanAccess(ws, auth.user.id, admin));
+
+	return NextResponse.json({ workspaces, isAdmin: admin });
+}
+
+export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+
+	const authResult = await requireAdmin(request);
+	if (!authResult.ok)
+		return NextResponse.json({ error: authResult.code }, { status: authResult.status });
+
+	const body: { rootDir?: string; name?: string } = await request.json();
+	const rootDir = body.rootDir?.trim();
+	if (!rootDir) return NextResponse.json({ error: "Missing rootDir" }, { status: 400 });
+
+	// Validate directory
+	try {
+		const info = await stat(rootDir);
+		if (!info.isDirectory())
+			return NextResponse.json({ error: "Not a directory" }, { status: 400 });
+	} catch {
+		return NextResponse.json({ error: "Directory not found" }, { status: 404 });
+	}
+
+	const workspace = await createWorkspace({
+		rootDir,
+		name: body.name?.trim() || undefined,
+		createdBy: authResult.user.id,
+	});
+
+	return NextResponse.json({ ok: true, workspace });
+}

package/.next/standalone/src/app/api/upload/[...path]/route.ts

@@ -1,7 +1,8 @@
 import { mkdir, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
-import { getRootDir } from "@/lib/root-dir";
+import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 const MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
 
@@ -32,13 +33,17 @@ export async function POST(
 	request: Request,
 	{ params }: { params: Promise<{ path: string[] }> },
 ) {
+	const wsx = await resolveWorkspaceForAgent(request);
+	if (!wsx.ok) return NextResponse.json({ error: wsx.code }, { status: wsx.status });
+	const { rootDir } = wsx;
+
 	const { path: segments } = await params;
 	const subPath = (segments ?? []).join("/");
 
-	// Save images in _uploads/ within getRootDir(), mirroring the page path
-	const uploadsDir = path.join(getRootDir(), "_uploads", subPath);
-	const resolved = path.resolve(uploadsDir);
-	if (!resolved.startsWith(getRootDir() + path.sep) && resolved !== getRootDir())
+	// Save images in _uploads/ within rootDir, mirroring the page path
+	const uploadsDir = path.join(rootDir, "_uploads", subPath);
+	const resolved = safeWorkspacePath(rootDir, path.join("_uploads", subPath));
+	if (!resolved)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 
 	let form: FormData;

package/.next/standalone/src/app/api/wiki/app/route.ts

@@ -1,14 +1,14 @@
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 import { getStatus, startApp, stopApp } from "@/lib/app-runner";
-import { getRootDir, safeRootPath } from "@/lib/root-dir";
 
 // GET /api/wiki/app?path=relative/path
 export async function GET(request: Request) {
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
 
 	const { searchParams } = new URL(request.url);
 	const rel = searchParams.get("path") ?? "";
@@ -19,15 +19,16 @@ export async function GET(request: Request) {
 export async function POST(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
 	if (!rel || typeof rel !== "string")
 		return NextResponse.json({ error: "Missing path" }, { status: 400 });
 
-	const abs = safeRootPath(rel);
+	const abs = safeWorkspacePath(rootDir, rel);
 	if (!abs)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 
@@ -43,8 +44,8 @@ export async function POST(request: Request) {
 export async function DELETE(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
 
 	const body: { path?: string } = await request.json();
 	const rel = body.path;

package/.next/standalone/src/app/api/wiki/content/route.ts

@@ -3,12 +3,12 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 import { emitEvents, trimEvents } from "@/lib/proof/event-bus";
 import { withFileMutex } from "@/lib/proof/mutex";
 import { emptySidecar, readSidecar, writeSidecar } from "@/lib/proof/sidecar";
 import { SIDECAR_EVENT_TRIM_SIZE } from "@/lib/proof-config";
-import { getRootDir, safeRootPath } from "@/lib/root-dir";
 
 const TEXT_EXTS = new Set([
 	"txt", "md", "markdown", "json", "yaml", "yml", "toml", "csv", "tsv",
@@ -35,12 +35,13 @@ function sha256content(content: string): string {
 }
 
 export async function GET(request: Request) {
-	const sessionAuth = await requireUser(request);
-	if (!sessionAuth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const { searchParams } = new URL(request.url);
 	const rel = searchParams.get("path") ?? "";
-	const filePath = safeRootPath(rel);
+	const filePath = safeWorkspacePath(rootDir, rel);
 	if (!filePath)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 	if (!isTextFile(path.basename(filePath)))
@@ -55,7 +56,6 @@ export async function GET(request: Request) {
 		const content = buffer.toString("utf-8");
 		const headers: Record<string, string> = {};
 		if (isMarkdownFile(path.basename(filePath))) {
-			const rootDir = getRootDir();
 			const sc = await readSidecar(rootDir, rel);
 			if (sc) {
 				headers["X-Wiki-Revision"] = String(sc.revision);
@@ -71,10 +71,9 @@ export async function GET(request: Request) {
 export async function PUT(request: Request) {
 	const csrf = checkOrigin(request);
 	if (csrf) return csrf;
-	const user = await requireUser(request);
-	if (!user.ok) {
-		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-	}
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const body: { path?: string; content?: string; baseRevision?: number } =
 		await request.json();
@@ -84,7 +83,7 @@ export async function PUT(request: Request) {
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 	if (typeof content !== "string")
 		return NextResponse.json({ error: "Missing content" }, { status: 400 });
-	const filePath = safeRootPath(rel);
+	const filePath = safeWorkspacePath(rootDir, rel);
 	if (!filePath)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 	if (!isTextFile(path.basename(filePath)))
@@ -102,8 +101,9 @@ export async function PUT(request: Request) {
 	}
 
 	// Markdown files: mutex + sidecar revision check + fingerprint update + event.
-	return withFileMutex(filePath, async () => {
-		const rootDir = getRootDir();
+	// Use the same key format as the agent routes (`${rootDir}\0${rel}`) so a doc
+	// edited via both the editor and the agent fs API shares one lock.
+	return withFileMutex(`${rootDir}\u0000${rel}`, async () => {
 		const sc = (await readSidecar(rootDir, rel)) ?? emptySidecar(rel);
 
 		// baseRevision is required for markdown to prevent lost writes.
@@ -146,7 +146,7 @@ export async function PUT(request: Request) {
 			{
 				type: "file.edited",
 				at: new Date().toISOString(),
-				by: `user:${user.user.id}`,
+				by: `user:${ctx.userId}`,
 				revision: newRevision,
 			},
 		]);

package/.next/standalone/src/app/api/wiki/download/route.ts

@@ -4,8 +4,8 @@ import path from "node:path";
 import { Readable } from "node:stream";
 import JSZip from "jszip";
 import { NextResponse } from "next/server";
-import { requireUser } from "@/lib/auth/server";
-import { safeRootPath } from "@/lib/root-dir";
+import { resolveWorkspaceForUser } from "@/lib/workspace-context";
+import { safeWorkspacePath } from "@/lib/workspaces";
 
 // Skip noise that should never end up in a downloaded archive.
 const SKIP_DIRS = new Set([".git", "node_modules", ".next", ".proof"]);
@@ -37,13 +37,14 @@ async function addDirToZip(
 }
 
 export async function GET(request: Request) {
-	const auth = await requireUser(request);
-	if (!auth.ok)
-		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	const ctx = await resolveWorkspaceForUser(request);
+	if (!ctx.ok)
+		return NextResponse.json({ error: ctx.code }, { status: ctx.status });
+	const { rootDir } = ctx;
 
 	const { searchParams } = new URL(request.url);
 	const rel = searchParams.get("path") ?? "";
-	const target = safeRootPath(rel);
+	const target = safeWorkspacePath(rootDir, rel);
 	if (!target)
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });