wiki-viewer 1.7.2 → 1.8.1

package/.next/standalone/src/lib/search/search-db.ts

@@ -0,0 +1,57 @@
+/**
+ * Search database lifecycle.
+ *
+ * Separate from auth.db: FTS5 shadow tables would pollute the auth schema and
+ * better-auth's migrator could misidentify them. search.db is rebuildable from
+ * the filesystem at any time -- deleting it only triggers a rescan on next access.
+ *
+ * Mirrors src/lib/proof/audit.ts structure.
+ */
+import Database from "better-sqlite3";
+import path from "node:path";
+import os from "node:os";
+import { mkdirSync } from "node:fs";
+
+function dataDir(): string {
+	return path.join(process.env.HOME ?? os.homedir(), ".wiki-viewer");
+}
+
+let _db: InstanceType<typeof Database> | null = null;
+
+export function getSearchDb(): InstanceType<typeof Database> {
+	if (_db) return _db;
+	const dir = dataDir();
+	mkdirSync(dir, { recursive: true });
+	_db = new Database(path.join(dir, "search.db"));
+	_db.pragma("journal_mode = WAL");
+	_db.pragma("synchronous = NORMAL");
+	_db.pragma("temp_store = MEMORY");
+	_db.pragma("mmap_size = 134217728"); // 128 MiB
+	_db.exec(`
+		CREATE VIRTUAL TABLE IF NOT EXISTS docs USING fts5(
+			ws         UNINDEXED,
+			path       UNINDEXED,
+			name,
+			frontmatter,
+			body,
+			tokenize = 'porter unicode61 remove_diacritics 2'
+		);
+		CREATE TABLE IF NOT EXISTS docs_meta (
+			ws         TEXT NOT NULL,
+			path       TEXT NOT NULL,
+			size       INTEGER NOT NULL,
+			mtime_ns   INTEGER NOT NULL,
+			sha        TEXT NOT NULL,
+			indexed_at TEXT NOT NULL,
+			PRIMARY KEY (ws, path)
+		) WITHOUT ROWID;
+		CREATE INDEX IF NOT EXISTS docs_meta_ws_idx ON docs_meta(ws);
+	`);
+	return _db;
+}
+
+/** Reset cached DB handle. Used by tests to pick up a new HOME. */
+export function _resetSearchDb(): void {
+	try { _db?.close(); } catch { /* ignore */ }
+	_db = null;
+}

package/.next/standalone/src/lib/search/watcher-pool.ts

@@ -0,0 +1,79 @@
+/**
+ * Shared chokidar watcher pool.
+ *
+ * Ensures exactly ONE FSWatcher per workspace regardless of how many SSE
+ * connections or indexer subscriptions are active. When the last subscriber
+ * unsubscribes, the watcher is closed.
+ *
+ * The watch route and the indexer both subscribe through this pool.
+ */
+import { watch, type FSWatcher } from "chokidar";
+import path from "node:path";
+
+export type WatchEvent = "add" | "unlink" | "addDir" | "unlinkDir" | "change";
+export type WatchListener = (ev: WatchEvent, relPath: string) => void;
+
+interface PoolEntry {
+	watcher: FSWatcher;
+	listeners: Set<WatchListener>;
+	rootDir: string;
+}
+
+const pool = new Map<string, PoolEntry>();
+
+/**
+ * Subscribe to file-system events for a workspace.
+ * Returns an unsubscribe function. Call it when the subscriber is done.
+ * The pool creates a watcher on first subscribe and closes it on last unsubscribe.
+ */
+export function subscribe(
+	wsId: string,
+	rootDir: string,
+	fn: WatchListener,
+): () => void {
+	let entry = pool.get(wsId);
+	if (!entry) {
+		const watcher = watch(rootDir, {
+			ignoreInitial: true,
+			ignored: /(node_modules|\.git|\.next|\.proof)/,
+			persistent: true,
+			awaitWriteFinish: { stabilityThreshold: 150, pollInterval: 50 },
+		});
+		entry = { watcher, listeners: new Set(), rootDir };
+		pool.set(wsId, entry);
+
+		const emit = (ev: WatchEvent, abs: string) => {
+			const e = pool.get(wsId);
+			if (!e) return;
+			const rel = path.relative(e.rootDir, abs);
+			e.listeners.forEach((l) => {
+				try { l(ev, rel); } catch { /* listener errors must not crash the pool */ }
+			});
+		};
+
+		watcher.on("add",       (p: string) => emit("add",       p));
+		watcher.on("unlink",    (p: string) => emit("unlink",    p));
+		watcher.on("change",    (p: string) => emit("change",    p));
+		watcher.on("addDir",    (p: string) => { const rel = path.relative(rootDir, p); if (rel) emit("addDir",    p); });
+		watcher.on("unlinkDir", (p: string) => { const rel = path.relative(rootDir, p); if (rel) emit("unlinkDir", p); });
+	}
+	entry.listeners.add(fn);
+
+	return () => {
+		const e = pool.get(wsId);
+		if (!e) return;
+		e.listeners.delete(fn);
+		if (e.listeners.size === 0) {
+			e.watcher.close().catch(() => { /* ignore */ });
+			pool.delete(wsId);
+		}
+	};
+}
+
+/** Reset entire pool. Used by tests. */
+export function _resetWatcherPool(): void {
+	for (const e of pool.values()) {
+		e.watcher.close().catch(() => { /* ignore */ });
+	}
+	pool.clear();
+}

package/.next/standalone/src/lib/workspace-client.ts

@@ -0,0 +1,82 @@
+/**
+ * workspace-client.ts — browser-safe ws injection helpers.
+ * No React, no server imports. Safe to use in any "use client" file.
+ */
+
+/**
+ * URL prefixes that are workspace-scoped and need ?ws= injected.
+ * Rules:
+ *   include:  /api/wiki, /api/assets/, /api/agent/ (except sub-paths below),
+ *             /api/upload/, /api/system/reveal
+ *   exclude:  /api/agent/admin, /api/agent/register, /api/agents
+ *             (those are global registrations, not file-workspace calls)
+ */
+const WS_SCOPED_PREFIXES = [
+	"/api/wiki",
+	"/api/assets/",
+	"/api/upload/",
+	"/api/system/reveal",
+];
+
+const WS_AGENT_PREFIX = "/api/agent/";
+
+const WS_AGENT_EXCLUDED_PREFIXES = [
+	"/api/agent/admin",
+	"/api/agent/register",
+	"/api/agents",
+];
+
+export function getActiveWorkspaceId(): string | null {
+	if (typeof window === "undefined") return null;
+	return new URLSearchParams(window.location.search).get("ws");
+}
+
+/** Returns true if this URL is workspace-scoped and needs ?ws= appended. */
+function needsWs(pathname: string): boolean {
+	// Excluded patterns first (match on prefix + segment boundary so
+	// "/api/agent/adminfoo" is NOT treated as "/api/agent/admin").
+	for (const ex of WS_AGENT_EXCLUDED_PREFIXES) {
+		if (pathname === ex || pathname.startsWith(ex + "/")) return false;
+	}
+	if (pathname.startsWith(WS_AGENT_PREFIX)) return true;
+	for (const prefix of WS_SCOPED_PREFIXES) {
+		if (pathname.startsWith(prefix)) return true;
+	}
+	return false;
+}
+
+/**
+ * Append ?ws=<activeId> to a workspace-scoped URL if:
+ *   - the URL needs ws injection (needsWs)
+ *   - an active workspace id exists in the current URL
+ *   - the URL doesn't already carry a ws= param
+ *
+ * Handles both plain paths (/api/wiki) and paths with existing query strings
+ * (/api/wiki/content?path=foo → /api/wiki/content?path=foo&ws=<id>).
+ */
+export function withWs(url: string): string {
+	const wsId = getActiveWorkspaceId();
+	if (!wsId) return url;
+
+	// Split on first '?' to isolate the pathname
+	const qIdx = url.indexOf("?");
+	const pathname = qIdx === -1 ? url : url.slice(0, qIdx);
+	const search = qIdx === -1 ? "" : url.slice(qIdx + 1);
+
+	if (!needsWs(pathname)) return url;
+
+	// Don't double-inject
+	const params = new URLSearchParams(search);
+	if (params.has("ws")) return url;
+
+	params.set("ws", wsId);
+	return `${pathname}?${params.toString()}`;
+}
+
+/**
+ * drop-in fetch replacement that injects ?ws=<activeId> on workspace-scoped
+ * URLs. Non-scoped URLs pass through unchanged.
+ */
+export function wsFetch(input: string, init?: RequestInit): Promise<Response> {
+	return fetch(withWs(input), init);
+}

package/.next/standalone/src/lib/workspace-context.ts

@@ -0,0 +1,142 @@
+/**
+ * Request-scoped workspace resolution for browser/session routes.
+ *
+ * Determines which workspace a request targets and enforces access control.
+ * Phase B routes call this instead of getRootDir().
+ */
+
+import path from "node:path";
+import { requireUser } from "@/lib/auth/server";
+import { isAdmin } from "@/lib/auth/admin";
+import { getRootDir } from "@/lib/root-dir";
+import {
+	getWorkspace,
+	listWorkspaces,
+	userCanAccess,
+	migrateConfigToWorkspaces,
+	type Workspace,
+} from "@/lib/workspaces";
+
+/**
+ * Synthetic fallback workspace built from the legacy process-global rootDir
+ * (root-dir.ts). Used only when the registry has no workspaces — keeps the
+ * ROOT_DIR / CLI / test paths working until Phase E removes the global.
+ * Returns null when no global root is set either.
+ */
+function fallbackWorkspace(): Workspace | null {
+	const root = getRootDir();
+	if (!root) return null;
+	return {
+		id: "ws_default",
+		name: path.basename(root) || "workspace",
+		rootDir: root,
+		createdAt: new Date(0).toISOString(),
+	};
+}
+
+/**
+ * Resolve the target workspace from the request alone (no auth/access check).
+ * Selection: ?ws= query → x-workspace header → most-recent lastOpenedAt →
+ * synthetic fallback from the global rootDir. Returns null if nothing resolves.
+ */
+async function pickWorkspace(req: Request): Promise<Workspace | null> {
+	await migrateConfigToWorkspaces();
+	const url = new URL(req.url);
+	const wsId = url.searchParams.get("ws") ?? req.headers.get("x-workspace") ?? null;
+	if (wsId) {
+		return (await getWorkspace(wsId)) ?? null;
+	}
+	const all = await listWorkspaces();
+	if (all.length === 0) return fallbackWorkspace();
+	return all
+		.slice()
+		.sort((a, b) => {
+			const ta = a.lastOpenedAt ? new Date(a.lastOpenedAt).getTime() : 0;
+			const tb = b.lastOpenedAt ? new Date(b.lastOpenedAt).getTime() : 0;
+			if (tb !== ta) return tb - ta;
+			return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+		})[0];
+}
+
+export interface WorkspaceContext {
+	ok: true;
+	ws: Workspace;
+	rootDir: string;
+	userId: string;
+	isAdmin: boolean;
+}
+
+export interface WorkspaceError {
+	ok: false;
+	status: number;
+	code: string;
+}
+
+/**
+ * Resolves the workspace for a browser/session request.
+ *
+ * Selection order:
+ *   1. `?ws=<id>` query param (preferred).
+ *   2. `x-workspace` header.
+ *   3. Fall back to the workspace with the most recent lastOpenedAt.
+ *      If exactly one workspace exists, use it.
+ *      If zero workspaces → 400 WORKSPACE_REQUIRED.
+ */
+export async function resolveWorkspaceForUser(
+	req: Request,
+): Promise<WorkspaceContext | WorkspaceError> {
+	// Authenticate
+	const auth = await requireUser(req);
+	if (!auth.ok) return { ok: false, status: 401, code: "UNAUTHORIZED" };
+
+	const admin = await isAdmin(auth.user.id, auth.user.email);
+	const url = new URL(req.url);
+	const explicitWsId =
+		url.searchParams.get("ws") ?? req.headers.get("x-workspace") ?? null;
+
+	const ws = await pickWorkspace(req);
+	if (!ws) {
+		// No workspace and no global root configured yet.
+		return {
+			ok: false,
+			status: explicitWsId ? 404 : 400,
+			code: explicitWsId ? "WORKSPACE_NOT_FOUND" : "WORKSPACE_REQUIRED",
+		};
+	}
+
+	if (!userCanAccess(ws, auth.user.id, admin)) {
+		return { ok: false, status: 403, code: "WORKSPACE_FORBIDDEN" };
+	}
+
+	return { ok: true, ws, rootDir: ws.rootDir, userId: auth.user.id, isAdmin: admin };
+}
+
+export interface AgentWorkspaceContext {
+	ok: true;
+	ws: Workspace;
+	rootDir: string;
+}
+
+/**
+ * Resolve the target workspace for an AUTHENTICATED agent request.
+ *
+ * Phase B: resolution only (no per-agent workspace grant check — that is added
+ * in Phase C, which will verify the agent's scope.workspaceId === ws.id).
+ * Selection mirrors the session resolver: ?ws / x-workspace / default / global.
+ */
+export async function resolveWorkspaceForAgent(
+	req: Request,
+): Promise<AgentWorkspaceContext | WorkspaceError> {
+	const ws = await pickWorkspace(req);
+	if (!ws) {
+		const url = new URL(req.url);
+		const explicit =
+			url.searchParams.get("ws") ?? req.headers.get("x-workspace") ?? null;
+		return {
+			ok: false,
+			status: explicit ? 404 : 400,
+			code: explicit ? "WORKSPACE_NOT_FOUND" : "WORKSPACE_REQUIRED",
+		};
+	}
+	return { ok: true, ws, rootDir: ws.rootDir };
+}

package/.next/standalone/src/lib/workspaces.ts

@@ -0,0 +1,196 @@
+/**
+ * Workspace registry — persisted in ~/.wiki-viewer/config.json under `workspaces[]`.
+ *
+ * Design choice: rootDir is the natural namespace key for in-memory stores
+ * (lease, mutex, idempotency).  Each workspace has a stable `id` for URLs and
+ * access control.  All mutations read fresh config inside the function to
+ * avoid stale in-memory copies.
+ */
+
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+import { readConfig, updateConfig } from "./config";
+
+export interface Workspace {
+	/** "ws_" + 6 random url-safe bytes. Stable, used in ?ws= query param. */
+	id: string;
+	/** Display label. Defaults to path.basename(rootDir). */
+	name: string;
+	/** Absolute, path.resolve'd rootDir. */
+	rootDir: string;
+	createdAt: string;
+	lastOpenedAt?: string;
+	/** Per-workspace pinned paths (moved from flat config.pinnedPaths). */
+	pinnedPaths?: string[];
+	/** User id of admin who created this workspace. */
+	createdBy?: string;
+	/**
+	 * Explicit access list.  Empty / undefined = any signed-in user may access.
+	 * Admin users always have access regardless of this list.
+	 */
+	allowedUserIds?: string[];
+}
+
+// ── Queries ────────────────────────────────────────────────────────────────────
+
+export async function listWorkspaces(): Promise<Workspace[]> {
+	const cfg = await readConfig();
+	return (cfg.workspaces ?? []) as Workspace[];
+}
+
+export async function getWorkspace(id: string): Promise<Workspace | null> {
+	const list = await listWorkspaces();
+	return list.find((w) => w.id === id) ?? null;
+}
+
+export async function resolveWorkspaceRoot(id: string): Promise<string | null> {
+	const ws = await getWorkspace(id);
+	return ws?.rootDir ?? null;
+}
+
+// ── Mutations ──────────────────────────────────────────────────────────────────
+
+export async function createWorkspace(input: {
+	rootDir: string;
+	name?: string;
+	createdBy?: string;
+}): Promise<Workspace> {
+	const rootDir = path.resolve(input.rootDir);
+	const ws: Workspace = {
+		id: "ws_" + randomBytes(6).toString("base64url"),
+		name: input.name ?? path.basename(rootDir),
+		rootDir,
+		createdAt: new Date().toISOString(),
+		lastOpenedAt: new Date().toISOString(),
+		createdBy: input.createdBy,
+	};
+	await updateConfig((cfg) => ({
+		...cfg,
+		workspaces: [...((cfg.workspaces ?? []) as Workspace[]), ws],
+	}));
+	return ws;
+}
+
+function mutateWorkspace(
+	id: string,
+	fn: (w: Workspace) => Workspace,
+): Promise<void> {
+	return updateConfig((cfg) => {
+		const workspaces = ((cfg.workspaces ?? []) as Workspace[]).map((w) =>
+			w.id === id ? fn(w) : w,
+		);
+		return { ...cfg, workspaces };
+	}).then(() => undefined);
+}
+
+export async function renameWorkspace(id: string, name: string): Promise<void> {
+	await mutateWorkspace(id, (w) => ({ ...w, name }));
+}
+
+export async function removeWorkspace(id: string): Promise<void> {
+	await updateConfig((cfg) => ({
+		...cfg,
+		workspaces: ((cfg.workspaces ?? []) as Workspace[]).filter((w) => w.id !== id),
+	}));
+	// Purge search index for the removed workspace. Import dynamically to avoid
+	// circular dependency if search modules ever import from workspaces.
+	try {
+		const { purgeWorkspace } = await import("./search/indexer");
+		await purgeWorkspace(id);
+	} catch (e) {
+		console.error("[search] purge failed on workspace remove", e);
+	}
+}
+
+export async function setWorkspaceAccess(id: string, userIds: string[]): Promise<void> {
+	await mutateWorkspace(id, (w) => ({ ...w, allowedUserIds: userIds }));
+}
+
+export async function setWorkspacePins(id: string, pinnedPaths: string[]): Promise<void> {
+	await mutateWorkspace(id, (w) => ({ ...w, pinnedPaths }));
+}
+
+export async function touchWorkspace(id: string): Promise<void> {
+	await mutateWorkspace(id, (w) => ({ ...w, lastOpenedAt: new Date().toISOString() }));
+}
+
+// ── Access control ─────────────────────────────────────────────────────────────
+
+/**
+ * True if userId may use this workspace.
+ * Admin always passes.  If allowedUserIds is empty/undefined, any signed-in user passes.
+ */
+export function userCanAccess(ws: Workspace, userId: string, isAdmin: boolean): boolean {
+	if (isAdmin) return true;
+	if (!ws.allowedUserIds || ws.allowedUserIds.length === 0) return true;
+	return ws.allowedUserIds.includes(userId);
+}
+
+// ── Path safety ────────────────────────────────────────────────────────────────
+
+/**
+ * Returns the absolute path for `rel` within `rootDir`, or null on traversal.
+ * Replicates root-dir.ts safeRootPath exactly, but takes an explicit rootDir
+ * instead of reading the process-global.  Phase B removes safeRootPath in
+ * favour of this function.
+ */
+export function safeWorkspacePath(rootDir: string, rel: string): string | null {
+	if (!rootDir) return null;
+	if (!rel || rel === ".") return rootDir;
+	const resolved = path.resolve(rootDir, rel);
+	if (resolved !== rootDir && !resolved.startsWith(rootDir + path.sep)) return null;
+	return resolved;
+}
+
+// ── Migration ──────────────────────────────────────────────────────────────────
+
+// Guard: true once migration has run in this process (cheap fast-path).
+let _migrated = false;
+
+/**
+ * Idempotent migration: if config.workspaces is absent/empty, synthesise one
+ * workspace from the old single-root sources, in priority order:
+ *   1. config.lastOpenedPath (existing single-user config)
+ *   2. process.env.ROOT_DIR  (CLI / `wiki-viewer <dir>` / service boot)
+ * This makes a ROOT_DIR-launched server register a REAL workspace (visible in
+ * the switcher) instead of relying only on the synthetic fallback.
+ * Does NOT delete the old fields (rollback safety).  Logs once.
+ */
+export async function migrateConfigToWorkspaces(): Promise<void> {
+	if (_migrated) return;
+
+	const seedRoot = (cfg: { lastOpenedPath?: string }): string | null =>
+		cfg.lastOpenedPath ??
+		(process.env.ROOT_DIR ? path.resolve(process.env.ROOT_DIR) : null);
+
+	// Fast-path read to skip the serialized write when nothing to do.
+	const cfg = await readConfig();
+	if (((cfg.workspaces ?? []) as Workspace[]).length > 0 || !seedRoot(cfg)) {
+		_migrated = true;
+		return;
+	}
+
+	let created: Workspace | null = null;
+	// Atomic: re-check inside the lock so concurrent callers can't both create.
+	await updateConfig((fresh) => {
+		const existing = (fresh.workspaces ?? []) as Workspace[];
+		const seed = seedRoot(fresh);
+		if (existing.length > 0 || !seed) return fresh;
+		const rootDir = path.resolve(seed);
+		created = {
+			id: "ws_" + randomBytes(6).toString("base64url"),
+			name: path.basename(rootDir),
+			rootDir,
+			createdAt: new Date().toISOString(),
+			lastOpenedAt: new Date().toISOString(),
+			pinnedPaths: fresh.pinnedPaths,
+		};
+		return { ...fresh, workspaces: [created] };
+	});
+	if (created) {
+		console.log(
+			`[wiki-viewer] Migrated lastOpenedPath → workspace "${(created as Workspace).name}" (${(created as Workspace).id})`,
+		);
+	}
+	_migrated = true;
+}

package/.next/standalone/src/stores/ai-panel-store.ts

@@ -1,6 +1,7 @@
 "use client";
 import { create } from "zustand";
 import type { ActivityEvent } from "@/lib/proof/activity-shared";
+import { wsFetch } from "@/lib/workspace-client";
 import { deriveConnections } from "@/lib/proof/activity-shared";
 import { authHeaders } from "@/lib/proof/client-auth";
 
@@ -49,7 +50,7 @@ export const useAIPanelStore = create<AIPanelState>((set) => ({
 		const hasToken = !!(token && token.trim());
 
 		try {
-			const res = await fetch("/api/agent/activity?limit=50", {
+			const res = await wsFetch("/api/agent/activity?limit=50", {
 				headers: authHeaders(),
 			});
 			if (!res.ok) {
@@ -63,7 +64,7 @@ export const useAIPanelStore = create<AIPanelState>((set) => ({
 			// Also fetch rate-limit setting
 			let rateLimit: number | null = null;
 			try {
-				const sr = await fetch("/api/agent/settings", { headers: authHeaders() });
+				const sr = await wsFetch("/api/agent/settings", { headers: authHeaders() });
 				if (sr.ok) {
 					const sd = (await sr.json()) as { rateLimit: number };
 					rateLimit = sd.rateLimit ?? null;

package/.next/standalone/src/stores/editor-store.ts

@@ -1,5 +1,6 @@
 import { create } from "zustand";
 import type { FrontMatter, SaveStatus } from "@/types";
+import { wsFetch } from "@/lib/workspace-client";
 
 // Adapter around ccmc's /api/wiki/content endpoints.
 // The API returns { content: string } and accepts { path, content }.
@@ -23,7 +24,7 @@ interface PageData {
 }
 
 async function fetchPageFromApi(path: string): Promise<PageData> {
-	const res = await fetch(`/api/wiki/content?path=${encodeURIComponent(path)}`);
+	const res = await wsFetch(`/api/wiki/content?path=${encodeURIComponent(path)}`);
 	if (!res.ok) {
 		throw new FetchPageError(`Failed to fetch page: ${path}`, res.status);
 	}
@@ -55,7 +56,7 @@ async function savePageToApi(
 ): Promise<SaveResult> {
 	const body: Record<string, unknown> = { path, content };
 	if (baseRevision !== null) body.baseRevision = baseRevision;
-	const res = await fetch("/api/wiki/content", {
+	const res = await wsFetch("/api/wiki/content", {
 		method: "PUT",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify(body),
@@ -63,7 +64,7 @@ async function savePageToApi(
 	if (res.status === 409) {
 		// Server has a newer revision. Fetch current content and surface the conflict.
 		const conflictData = (await res.json()) as { currentRevision?: number };
-		const freshRes = await fetch(`/api/wiki/content?path=${encodeURIComponent(path)}`);
+		const freshRes = await wsFetch(`/api/wiki/content?path=${encodeURIComponent(path)}`);
 		const freshContent = freshRes.ok
 			? ((await freshRes.json()) as { content: string }).content
 			: content;

package/.next/standalone/src/stores/proof-store.ts

@@ -1,5 +1,6 @@
 import { create } from "zustand";
 import { authHeaders } from "@/lib/proof/client-auth";
+import { wsFetch } from "@/lib/workspace-client";
 import { useEditorStore } from "@/stores/editor-store";
 import type { Sidecar, ProofEvent, Block, Snapshot } from "@/lib/proof/types";
 
@@ -31,7 +32,7 @@ export const useProofStore = create<ProofState>((set, get) => ({
 	loadSidecar: async (path: string) => {
 		const encoded = encodeURIComponent(path).replace(/%2F/g, "/");
 		try {
-			const res = await fetch(`/api/agent/sidecar/${encoded}`, {
+			const res = await wsFetch(`/api/agent/sidecar/${encoded}`, {
 				headers: authHeaders(),
 			});
 			if (!res.ok) return;
@@ -55,7 +56,7 @@ export const useProofStore = create<ProofState>((set, get) => ({
 	loadSnapshot: async (path: string) => {
 		const encoded = encodeURIComponent(path).replace(/%2F/g, "/");
 		try {
-			const res = await fetch(`/api/agent/files/${encoded}`, {
+			const res = await wsFetch(`/api/agent/files/${encoded}`, {
 				headers: authHeaders(),
 			});
 			if (!res.ok) return;
@@ -84,7 +85,7 @@ export const useProofStore = create<ProofState>((set, get) => ({
 		const entry = get().byPath[path] ?? defaultEntry();
 		const encoded = encodeURIComponent(path).replace(/%2F/g, "/");
 		try {
-			const res = await fetch(
+			const res = await wsFetch(
 				`/api/agent/events/${encoded}?after=${entry.lastEventId}`,
 				{ headers: authHeaders() },
 			);