wiki-viewer 1.7.1 → 1.8.0

package/.next/standalone/src/app/layout.tsx

@@ -1,4 +1,4 @@
-import type { Metadata } from "next";
+import type { Metadata, Viewport } from "next";
 import { Inter } from "next/font/google";
 import "./globals.css";
 import { Toaster } from "sonner";
@@ -9,6 +9,20 @@ const inter = Inter({ subsets: ["latin"], variable: "--font-inter" });
 export const metadata: Metadata = {
 	title: "Wiki Viewer",
 	description: "Local file browser, viewer, and editor",
+	manifest: "/manifest.webmanifest",
+	appleWebApp: {
+		capable: true,
+		title: "Wiki",
+		statusBarStyle: "black-translucent",
+	},
+	icons: {
+		icon: "/icon-192.png",
+		apple: "/icon-192.png",
+	},
+};
+
+export const viewport: Viewport = {
+	themeColor: "#0c0a09",
 };
 
 export default function RootLayout({

package/.next/standalone/src/app/manifest.ts

@@ -0,0 +1,30 @@
+import type { MetadataRoute } from "next";
+
+/**
+ * Web app manifest. Makes iOS/Android "Add to Home Screen" install a real
+ * standalone PWA (display: standalone) with persistent storage, instead of a
+ * plain bookmark. Without this, iOS treats the shortcut as ephemeral and evicts
+ * its cookie jar, forcing re-login on every reopen.
+ */
+export default function manifest(): MetadataRoute.Manifest {
+	return {
+		name: "Wiki Viewer",
+		short_name: "Wiki",
+		description: "Local file browser, viewer, and editor",
+		start_url: "/",
+		scope: "/",
+		display: "standalone",
+		background_color: "#0c0a09",
+		theme_color: "#0c0a09",
+		icons: [
+			{ src: "/icon-192.png", sizes: "192x192", type: "image/png", purpose: "any" },
+			{ src: "/icon-512.png", sizes: "512x512", type: "image/png", purpose: "any" },
+			{
+				src: "/icon-maskable-512.png",
+				sizes: "512x512",
+				type: "image/png",
+				purpose: "maskable",
+			},
+		],
+	};
+}

package/.next/standalone/src/app/page.tsx

@@ -50,8 +50,10 @@ import {
 	DropdownMenu,
 	DropdownMenuContent,
 	DropdownMenuItem,
+	DropdownMenuSeparator,
 	DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
+import { getActiveWorkspaceId, withWs, wsFetch } from "@/lib/workspace-client";
 import { ThemeToggle } from "@/components/theme-toggle";
 import { AuthSettingsSheet } from "@/components/auth-settings-sheet";
 import { Button } from "@/components/ui/button";
@@ -63,6 +65,8 @@ import { parseFrontmatter } from "@/lib/markdown/parse-frontmatter";
 import { showError } from "@/lib/toast";
 import { cn } from "@/lib/utils";
 import { AIPanel } from "@/components/ai-panel/ai-panel";
+import { SearchCommandDialog } from "@/components/search/search-command-dialog";
+import { SidebarSearchBox } from "@/components/search/sidebar-search-box";
 import { useAIPanelStore } from "@/stores/ai-panel-store";
 import { useEditorStore } from "@/stores/editor-store";
 import { useViewWidthStore, VIEW_WIDTH_CLASS } from "@/stores/view-width-store";
@@ -168,7 +172,7 @@ function isHtmlFile(name: string) {
 }
 
 async function fetchDir(dir: string): Promise<TreeNode[]> {
-	const res = await fetch(`/api/wiki?dir=${encodeURIComponent(dir)}`);
+	const res = await wsFetch(`/api/wiki?dir=${encodeURIComponent(dir)}`);
 	if (!res.ok) return [];
 	const data: {
 		entries: Array<{
@@ -219,17 +223,47 @@ export default function Page() {
 	// null = checking, false = not set, true = ready
 	const [rootConfigured, setRootConfigured] = useState<boolean | null>(null);
 	const [rootPath, setRootPath] = useState<string | null>(null);
+	// Workspace state
+	const [activeWorkspaceId, setActiveWorkspaceId] = useState<string | null>(() =>
+		typeof window !== "undefined" ? getActiveWorkspaceId() : null
+	);
+	const [workspaces, setWorkspaces] = useState<Array<{id:string;name:string;rootDir:string;lastOpenedAt?:string;createdAt:string}>>([]);
+	const [isWsAdmin, setIsWsAdmin] = useState(false);
+	const [addingWorkspace, setAddingWorkspace] = useState(false);
 
-	useEffect(() => {
-		fetch("/api/system/root-status")
-			.then((r) => r.json())
-			.then((d: { configured: boolean; path: string | null }) => {
-				setRootConfigured(d.configured);
-				setRootPath(d.path);
-			})
-			.catch(() => setRootConfigured(false));
+	const loadWorkspaces = useCallback(async () => {
+		try {
+			const res = await fetch("/api/system/workspaces");
+			if (!res.ok) throw new Error("Failed");
+			const d: { workspaces: Array<{id:string;name:string;rootDir:string;lastOpenedAt?:string;createdAt:string}>; isAdmin: boolean } = await res.json();
+			setWorkspaces(d.workspaces);
+			setIsWsAdmin(d.isAdmin);
+			if (d.workspaces.length > 0) {
+				setRootConfigured(true);
+				const urlWsId = new URLSearchParams(window.location.search).get("ws");
+				const inList = urlWsId ? d.workspaces.find((w) => w.id === urlWsId) : null;
+				const active = inList ?? [...d.workspaces].sort(
+					(a, b) => (b.lastOpenedAt ?? b.createdAt).localeCompare(a.lastOpenedAt ?? a.createdAt)
+				)[0];
+				setActiveWorkspaceId(active.id);
+				setRootPath(active.rootDir);
+				if (!inList) {
+					const u = new URL(location.href);
+					u.searchParams.set("ws", active.id);
+					history.replaceState(null, "", u.toString());
+				}
+			} else {
+				setRootConfigured(false);
+			}
+		} catch {
+			setRootConfigured(false);
+		}
 	}, []);
 
+	useEffect(() => {
+		void loadWorkspaces();
+	}, [loadWorkspaces]);
+
 	const editorCurrentPath = useEditorStore((s) => s.currentPath);
 
 	// Path captured from the URL at first render, before any effect can clear it.
@@ -407,7 +441,7 @@ export default function Page() {
 		if (!["editor", "text"].includes(kind) && !isText(openFile.name)) return;
 		setFileLoading(true);
 		try {
-			const res = await fetch(
+			const res = await wsFetch(
 				`/api/wiki/content?path=${encodeURIComponent(openFile.path)}`,
 			);
 			if (res.ok) {
@@ -449,7 +483,7 @@ export default function Page() {
 			);
 		}
 
-		const es = new EventSource("/api/wiki/watch");
+		const es = new EventSource(withWs("/api/wiki/watch"));
 
 		es.onmessage = (event) => {
 			let data: { type: string; path: string };
@@ -544,7 +578,7 @@ export default function Page() {
 		if (!["editor", "text"].includes(kind) && !isText(node.name)) return;
 		setFileLoading(true);
 		try {
-			const res = await fetch(
+			const res = await wsFetch(
 				`/api/wiki/content?path=${encodeURIComponent(node.path)}`,
 			);
 			if (res.ok) {
@@ -558,6 +592,16 @@ export default function Page() {
 		setFileLoading(false);
 	}
 
+	// Open a file from a search result: reveal it in the tree, then open it.
+	const openFromSearch = useCallback(
+		(relPath: string) => {
+			const name = relPath.split("/").pop() ?? relPath;
+			void revealPath(relPath);
+			void openViewer({ path: relPath, name, type: "file" } as TreeNode);
+		},
+		[revealPath],
+	);
+
 	// biome-ignore lint/correctness/useExhaustiveDependencies: only react to editor path changes
 	useEffect(() => {
 		if (!editorCurrentPath) return;
@@ -610,23 +654,35 @@ export default function Page() {
 		})();
 	}, [rootLoaded, revealPath]);
 
-	const handleChangeDir = async () => {
-		await fetch("/api/system/clear-root", { method: "POST" });
+	const switchWorkspace = useCallback(async (id: string) => {
+		if (id === activeWorkspaceId) return;
+		try {
+			await fetch(`/api/system/workspaces/${id}/open`, { method: "POST" });
+		} catch {
+			/* best-effort lastOpened bump */
+		}
+		const u = new URL(location.href);
+		u.searchParams.set("ws", id);
+		u.searchParams.delete("path");
+		history.pushState(null, "", u.toString());
+		// Reset open file + caches; the key={activeWorkspaceId} remount clears the rest.
 		setOpenFile(null);
 		setFileContent(null);
 		setEditing(false);
 		setRoots([]);
 		setRootLoaded(false);
 		rootLoadingRef.current = false;
-		setRootPath(null);
-		setRootConfigured(false);
-	};
+		useWikiSlugsStore.getState().invalidate();
+		const ws = workspaces.find((w) => w.id === id);
+		if (ws) setRootPath(ws.rootDir);
+		setActiveWorkspaceId(id);
+	}, [activeWorkspaceId, workspaces]);
 
 	async function handleSave() {
 		if (!openFile) return;
 		setSaving(true);
 		setSaveError(null);
-		const res = await fetch("/api/wiki/content", {
+		const res = await wsFetch("/api/wiki/content", {
 			method: "PUT",
 			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({
@@ -658,7 +714,7 @@ export default function Page() {
 					const fd = new FormData();
 					fd.append("file", file);
 					fd.append("dir", dir);
-					const res = await fetch("/api/wiki/upload", {
+					const res = await wsFetch("/api/wiki/upload", {
 						method: "POST",
 						body: fd,
 					});
@@ -690,7 +746,7 @@ export default function Page() {
 		if (!name || newFolderParent === null) return;
 		setFolderError(null);
 		const rel = newFolderParent ? `${newFolderParent}/${name}` : name;
-		const res = await fetch("/api/wiki/folder", {
+		const res = await wsFetch("/api/wiki/folder", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({ path: rel }),
@@ -716,7 +772,7 @@ export default function Page() {
 		setFileCreateError(null);
 		const name = raw.includes(".") ? raw : `${raw}.md`;
 		const rel = newFileParent ? `${newFileParent}/${name}` : name;
-		const res = await fetch("/api/wiki/new-file", {
+		const res = await wsFetch("/api/wiki/new-file", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({ path: rel }),
@@ -744,7 +800,7 @@ export default function Page() {
 	}
 
 	function handleDownload(node: TreeNode) {
-		const url = `/api/wiki/download?path=${encodeURIComponent(node.path)}`;
+		const url = withWs(`/api/wiki/download?path=${encodeURIComponent(node.path)}`);
 		const a = document.createElement("a");
 		a.href = url;
 		a.download = node.type === "file" ? node.name : `${node.name}.zip`;
@@ -755,7 +811,7 @@ export default function Page() {
 
 	async function handleDelete() {
 		if (!deletingPath) return;
-		await fetch("/api/wiki", {
+		await wsFetch("/api/wiki", {
 			method: "DELETE",
 			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({ path: deletingPath }),
@@ -811,7 +867,7 @@ export default function Page() {
 		const newPath = targetDirPath ? `${targetDirPath}/${node.name}` : node.name;
 		if (newPath === node.path) return;
 
-		const res = await fetch("/api/wiki/move", {
+		const res = await wsFetch("/api/wiki/move", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({ from: node.path, to: newPath }),
@@ -876,8 +932,8 @@ export default function Page() {
 					className={cn(
 						"flex items-center gap-1.5 rounded-sm px-2 py-1 text-sm cursor-pointer group transition-colors select-none",
 						openFile?.path === node.path
-							? "bg-accent text-accent-foreground"
-							: "hover:bg-accent/50",
+							? "bg-accent-soft text-foreground font-medium"
+							: "hover:bg-muted",
 						dragOverPath === node.path && "ring-2 ring-primary bg-primary-soft",
 						node.name.startsWith(".") && "opacity-40",
 					)}
@@ -907,17 +963,17 @@ export default function Page() {
 							<Folder className={cn("h-4 w-4 shrink-0", openFile?.path !== node.path && "text-warning")} />
 						)
 					) : node.type === "app" ? (
-						<Globe className={cn("h-4 w-4 shrink-0", openFile?.path !== node.path && "text-accent")} />
+						<Globe className={cn("h-4 w-4 shrink-0", openFile?.path !== node.path && "text-foreground/70")} />
 					) : node.type === "node-app" ? (
 						<Terminal className={cn("h-4 w-4 shrink-0", openFile?.path !== node.path && "text-emerald-500")} />
 					) : isHtmlFile(node.name) ? (
-						<Globe className={cn("h-4 w-4 shrink-0", openFile?.path !== node.path && "text-accent/70")} />
+						<Globe className={cn("h-4 w-4 shrink-0", openFile?.path !== node.path && "text-foreground/60")} />
 					) : isImage(node.name) ? (
 						<ImageIcon className={cn("h-4 w-4 shrink-0", openFile?.path !== node.path && "text-sunshine-700")} />
 					) : isText(node.name) ? (
-						<FileText className={cn("h-4 w-4 shrink-0", openFile?.path !== node.path && "text-accent")} />
+						<FileText className={cn("h-4 w-4 shrink-0", openFile?.path !== node.path && "text-foreground/70")} />
 					) : (
-						<File className={cn("h-4 w-4 shrink-0", openFile?.path !== node.path && "text-muted-foreground")} />
+						<File className={cn("h-4 w-4 shrink-0", openFile?.path !== node.path && "text-foreground/60")} />
 					)}
 
 					<span className="flex-1 truncate">{node.name}</span>
@@ -1104,21 +1160,41 @@ export default function Page() {
 	}
 
 	return (
-		<div className="flex h-screen gap-0 overflow-hidden bg-background">
+		<div key={activeWorkspaceId ?? "none"} className="flex h-screen gap-0 overflow-hidden bg-background">
 			{rootConfigured === null && (
 				<div className="flex-1 flex items-center justify-center">
 					<Loader2 className="h-5 w-5 animate-spin text-muted-foreground" />
 				</div>
 			)}
 			{rootConfigured === false && (
-				<DirPicker onSelect={(path) => {
+				<DirPicker onSelect={(workspaceId) => {
+					const u = new URL(location.href);
+					u.searchParams.set("ws", workspaceId);
+					u.searchParams.delete("path");
+					history.replaceState(null, "", u.toString());
 					setRootLoaded(false);
 					rootLoadingRef.current = false;
-					setRootPath(path);
+					setActiveWorkspaceId(workspaceId);
 					setRootConfigured(true);
+					void loadWorkspaces();
 				}} />
 			)}
-			{rootConfigured === true && <>
+			{rootConfigured === true && addingWorkspace && (
+				<div className="flex-1 flex flex-col">
+					<div className="flex items-center justify-end border-b px-3 py-2 bg-muted shrink-0">
+						<Button size="sm" variant="ghost" className="h-7 gap-1.5 text-xs" onClick={() => setAddingWorkspace(false)}>
+							<X className="h-3.5 w-3.5" /> Cancel
+						</Button>
+					</div>
+					<DirPicker onSelect={(workspaceId) => {
+						setAddingWorkspace(false);
+						void loadWorkspaces();
+						void switchWorkspace(workspaceId);
+					}} />
+				</div>
+			)}
+			{rootConfigured === true && !addingWorkspace && <>
+			<SearchCommandDialog onOpenFile={openFromSearch} />
 			{/* Tree sidebar */}
 			{!sidebarCollapsed && (
 				<Card className="flex flex-col w-72 shrink-0 overflow-hidden rounded-none border-r border-l-0 border-t-0 border-b-0">
@@ -1318,6 +1394,10 @@ export default function Page() {
 						</div>
 					)}
 
+					<div className="border-b">
+						<SidebarSearchBox onOpenFile={openFromSearch} />
+					</div>
+
 					<div
 						className={cn(
 							"flex-1 overflow-auto py-1",
@@ -1365,21 +1445,55 @@ export default function Page() {
 							renderNodes(roots)
 						)}
 					</div>
-					<div className="border-t px-3 py-2 flex items-center gap-2 bg-muted shrink-0">
-						<span
-							className="flex-1 text-xs text-muted-foreground font-mono truncate"
-							title={rootPath ?? ""}
-						>
-							{rootPath ?? ""}
-						</span>
-						<Button
-							size="sm"
-							variant="ghost"
-							className="h-6 shrink-0 text-xs px-2 text-muted-foreground hover:text-foreground"
-							onClick={handleChangeDir}
-						>
-							Change
-						</Button>
+					<div className="border-t px-2 py-2 bg-muted shrink-0">
+						<DropdownMenu>
+							<DropdownMenuTrigger asChild>
+								<Button
+									size="sm"
+									variant="ghost"
+									className="w-full h-auto justify-between gap-2 px-2 py-1.5 text-left"
+									title={rootPath ?? ""}
+								>
+									<span className="flex flex-col min-w-0">
+										<span className="truncate text-xs font-medium">
+											{workspaces.find((w) => w.id === activeWorkspaceId)?.name ?? "Workspace"}
+										</span>
+										<span className="truncate text-[10px] text-muted-foreground font-mono">
+											{rootPath ?? ""}
+										</span>
+									</span>
+									<ChevronDown className="h-3.5 w-3.5 shrink-0 opacity-60" />
+								</Button>
+							</DropdownMenuTrigger>
+							<DropdownMenuContent align="start" className="w-60">
+								{workspaces.map((w) => (
+									<DropdownMenuItem
+										key={w.id}
+										onClick={() => void switchWorkspace(w.id)}
+										className={cn("gap-2", w.id === activeWorkspaceId && "font-medium")}
+									>
+										{w.id === activeWorkspaceId ? (
+											<Check className="h-3.5 w-3.5 shrink-0" />
+										) : (
+											<span className="w-3.5 shrink-0" />
+										)}
+										<span className="flex flex-col min-w-0">
+											<span className="truncate">{w.name}</span>
+											<span className="truncate text-[10px] text-muted-foreground font-mono">{w.rootDir}</span>
+										</span>
+									</DropdownMenuItem>
+								))}
+								{isWsAdmin && (
+									<>
+										<DropdownMenuSeparator />
+										<DropdownMenuItem onClick={() => setAddingWorkspace(true)}>
+											<FolderPlus className="mr-2 h-3.5 w-3.5" />
+											Add workspace…
+										</DropdownMenuItem>
+									</>
+								)}
+							</DropdownMenuContent>
+						</DropdownMenu>
 					</div>
 				</Card>
 			)}

package/.next/standalone/src/components/auth-settings-sheet.tsx

@@ -43,6 +43,32 @@ export function AuthSettingsSheet({
 	const [rateLimit, setRateLimit] = useState<number | null>(null);
 	const { data: session } = authClient.useSession();
 
+	// Admin management
+	const [isAdmin, setIsAdmin] = useState(false);
+	const [admins, setAdmins] = useState<string[]>([]);
+	const [adminUsers, setAdminUsers] = useState<Array<{ id: string; email: string; name: string }>>([]);
+	const [adminError, setAdminError] = useState<string | null>(null);
+	const [adminWorking, setAdminWorking] = useState<string | null>(null);
+	// Add-user form
+	const [newUserEmail, setNewUserEmail] = useState("");
+	const [newUserName, setNewUserName] = useState("");
+	const [creatingUser, setCreatingUser] = useState(false);
+	const [createdUser, setCreatedUser] = useState<{ email: string; tempPassword: string } | null>(null);
+
+	const loadAdmins = useCallback(async () => {
+		try {
+			const res = await fetch("/api/system/admins");
+			if (!res.ok) return;
+			const d: { admins?: string[]; isAdmin?: boolean; users?: Array<{ id: string; email: string; name: string }> } =
+				await res.json();
+			setIsAdmin(!!d.isAdmin);
+			setAdmins(d.admins ?? []);
+			setAdminUsers(d.users ?? []);
+		} catch {
+			/* ignore */
+		}
+	}, []);
+
 	const load = useCallback(async () => {
 		setLoading(true);
 		setError(null);
@@ -62,8 +88,11 @@ export function AuthSettingsSheet({
 	}, []);
 
 	useEffect(() => {
-		if (open) void load();
-	}, [open, load]);
+		if (open) {
+			void load();
+			void loadAdmins();
+		}
+	}, [open, load, loadAdmins]);
 
 	async function handleSave() {
 		setSaving(true);
@@ -228,6 +257,146 @@ export function AuthSettingsSheet({
 						)}
 						</section>
 
+						{/* Admins — only visible to admins */}
+						{isAdmin && (
+							<section className="space-y-2">
+								<h3 className="text-xs font-semibold uppercase tracking-widest text-muted-foreground">
+									Admins
+								</h3>
+								<p className="text-xs leading-relaxed text-muted-foreground">
+									Admins can create workspaces, add users, and manage access.
+								</p>
+								{adminError && (
+									<div className="flex items-center gap-1.5 text-xs text-destructive">
+										<AlertCircle className="h-3.5 w-3.5 shrink-0" />
+										{adminError}
+									</div>
+								)}
+
+								{/* Add user */}
+								<div className="space-y-2 rounded-md border border-border p-3">
+									<div className="text-xs font-medium">Add user</div>
+									{createdUser ? (
+										<div className="space-y-2">
+											<p className="text-xs text-muted-foreground">
+												Created <span className="font-medium text-foreground">{createdUser.email}</span>. Share this temporary password now, it will not be shown again.
+											</p>
+											<div className="flex items-center gap-2">
+												<code className="flex-1 rounded bg-muted px-2 py-1.5 font-mono text-sm select-all">{createdUser.tempPassword}</code>
+												<button
+													type="button"
+													className="shrink-0 text-xs px-2 py-1 rounded border border-border hover:bg-accent"
+													onClick={() => void navigator.clipboard?.writeText(createdUser.tempPassword)}
+												>
+													Copy
+												</button>
+											</div>
+											<button
+												type="button"
+											className="text-xs text-muted-foreground hover:text-foreground"
+											onClick={() => { setCreatedUser(null); setNewUserEmail(""); setNewUserName(""); void loadAdmins(); }}
+										>
+											Done
+										</button>
+										</div>
+									) : (
+										<div className="space-y-2">
+											<input
+												type="email"
+												value={newUserEmail}
+												onChange={(e) => setNewUserEmail(e.target.value)}
+												placeholder="email@team.com"
+												className="w-full rounded-md border border-border bg-background px-2 py-1.5 text-sm outline-none focus:ring-2 focus:ring-primary"
+											/>
+											<input
+												type="text"
+												value={newUserName}
+												onChange={(e) => setNewUserName(e.target.value)}
+												placeholder="Name (optional)"
+												className="w-full rounded-md border border-border bg-background px-2 py-1.5 text-sm outline-none focus:ring-2 focus:ring-primary"
+											/>
+											<Button
+												size="sm"
+												className="w-full gap-1.5"
+												disabled={creatingUser || !newUserEmail.trim()}
+												onClick={async () => {
+													setCreatingUser(true);
+													setAdminError(null);
+													try {
+														const res = await fetch("/api/system/users", {
+															method: "POST",
+															headers: { "Content-Type": "application/json" },
+															body: JSON.stringify({ email: newUserEmail.trim(), name: newUserName.trim() }),
+														});
+														const d: { ok?: boolean; email?: string; tempPassword?: string; error?: string; message?: string } = await res.json();
+														if (!res.ok || !d.tempPassword) {
+															setAdminError(d.message ?? d.error ?? "Failed to create user");
+														} else {
+															setCreatedUser({ email: d.email ?? newUserEmail.trim(), tempPassword: d.tempPassword });
+														}
+													} catch {
+														setAdminError("Network error");
+													} finally {
+														setCreatingUser(false);
+													}
+												}}
+											>
+												{creatingUser && <Loader2 className="h-3.5 w-3.5 animate-spin" />}
+												Create user
+											</Button>
+										</div>
+									)}
+								</div>
+								<div className="space-y-1 rounded-md border border-border overflow-hidden">
+									{adminUsers.map((u) => {
+										const isAdminUser = admins.includes(u.id);
+										return (
+											<div key={u.id} className="flex items-center justify-between px-3 py-2 bg-muted/40 hover:bg-muted/60 transition-colors">
+												<div className="text-sm min-w-0">
+													<div className="font-medium truncate">{u.name}</div>
+													<div className="text-xs text-muted-foreground truncate">{u.email}</div>
+												</div>
+												<button
+													type="button"
+													disabled={adminWorking === u.id}
+													className="ml-2 shrink-0 text-xs px-2 py-1 rounded border border-border hover:bg-accent disabled:opacity-50"
+													onClick={async () => {
+														setAdminWorking(u.id);
+														setAdminError(null);
+														try {
+															const res = await fetch("/api/system/admins", {
+																method: isAdminUser ? "DELETE" : "POST",
+																headers: { "Content-Type": "application/json" },
+																body: JSON.stringify({ userId: u.id }),
+															});
+															const d: { ok?: boolean; admins?: string[]; error?: string; message?: string } = await res.json();
+															if (!res.ok) {
+																setAdminError(d.message ?? d.error ?? "Failed");
+															} else if (d.admins) {
+																setAdmins(d.admins);
+															}
+														} catch {
+															setAdminError("Network error");
+														} finally {
+															setAdminWorking(null);
+														}
+													}}
+												>
+													{adminWorking === u.id ? (
+														<Loader2 className="h-3 w-3 animate-spin" />
+													) : isAdminUser ? "Demote" : "Promote"}
+												</button>
+											</div>
+										);
+									})}
+									{adminUsers.length === 0 && (
+										<div className="px-3 py-2 text-xs text-muted-foreground">No users yet.</div>
+									)}
+								</div>
+								{/* TODO: per-workspace access editor (PATCH /api/system/workspaces/[id] allowedUserIds) */}
+							</section>
+						)}
+
 						{/* Agent rate limit */}
 						<section className="space-y-2">
 							<h3 className="text-xs font-semibold uppercase tracking-widest text-muted-foreground">

package/.next/standalone/src/components/dir-picker.tsx

@@ -29,7 +29,8 @@ interface BrowseResult {
 }
 
 interface Props {
-	onSelect: (path: string) => void;
+	/** Called with the new workspace id after creation */
+	onSelect: (workspaceId: string) => void;
 }
 
 export function DirPicker({ onSelect }: Props) {
@@ -96,17 +97,18 @@ export function DirPicker({ onSelect }: Props) {
 		if (!target) return;
 		setSelecting(true);
 		try {
-			const res = await fetch("/api/system/set-root", {
+			const res = await fetch("/api/system/workspaces", {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({ path: target }),
+				body: JSON.stringify({ rootDir: target }),
 			});
 			if (!res.ok) {
-				const e: { error?: string } = await res.json();
-				setError(e.error ?? "Cannot use that directory");
+				const e: { error?: string; message?: string } = await res.json();
+				setError(e.message ?? e.error ?? "Cannot use that directory");
 				return;
 			}
-			onSelect(target);
+			const { workspace }: { workspace: { id: string } } = await res.json();
+			onSelect(workspace.id);
 		} catch {
 			setError("Network error");
 		} finally {