wiki-viewer 1.7.2 → 1.8.1

package/.next/standalone/src/stores/search-store.ts

@@ -0,0 +1,86 @@
+/**
+ * Zustand store for full-text search state.
+ * Shared between the cmd+k palette and the sidebar search box.
+ */
+import { create } from "zustand";
+import { wsFetch } from "@/lib/workspace-client";
+
+export interface SearchMatch {
+	path: string;
+	score: number;
+	snippet: string;
+}
+
+interface SearchState {
+	query: string;
+	results: SearchMatch[];
+	loading: boolean;
+	truncated: boolean;
+	open: boolean;
+	setQuery: (q: string) => void;
+	setOpen: (b: boolean) => void;
+	search: (q: string) => Promise<void>;
+	clear: () => void;
+}
+
+let abortRef: AbortController | null = null;
+
+export const useSearchStore = create<SearchState>((set) => ({
+	query: "",
+	results: [],
+	loading: false,
+	truncated: false,
+	open: false,
+
+	setQuery: (q) => set({ query: q }),
+	setOpen: (b) => set({ open: b }),
+
+	clear: () => {
+		abortRef?.abort();
+		set({ query: "", results: [], loading: false, truncated: false });
+	},
+
+	search: async (q) => {
+		abortRef?.abort();
+		const ctrl = new AbortController();
+		abortRef = ctrl;
+
+		if (!q.trim()) {
+			set({ results: [], loading: false, truncated: false });
+			return;
+		}
+
+		set({ loading: true });
+
+		try {
+			const r = await wsFetch("/api/wiki/search", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ query: q, limit: 30 }),
+				signal: ctrl.signal,
+			});
+
+			if (!r.ok) {
+				set({ results: [], loading: false, truncated: false });
+				return;
+			}
+
+			const d = (await r.json()) as {
+				matches?: SearchMatch[];
+				truncated?: boolean;
+			};
+
+			if (ctrl.signal.aborted) return;
+
+			set({
+				results: d.matches ?? [],
+				truncated: !!d.truncated,
+				loading: false,
+			});
+		} catch (e) {
+			if ((e as Error).name !== "AbortError") {
+				set({ loading: false });
+			}
+		}
+	},
+}));

package/.next/standalone/src/stores/wiki-slugs-store.ts

@@ -1,5 +1,6 @@
 "use client";
 import { create } from "zustand";
+import { wsFetch } from "@/lib/workspace-client";
 
 type Dir = "entities" | "concepts" | "comparisons" | "root";
 
@@ -36,7 +37,7 @@ export const useWikiSlugsStore = create<WikiSlugsState>((set, get) => ({
 
 		set({ loading: true });
 		try {
-			const res = await fetch("/api/wiki/slugs");
+			const res = await wsFetch("/api/wiki/slugs");
 			if (!res.ok) throw new Error("Failed to fetch wiki slugs");
 			const buckets = (await res.json()) as SlugBuckets;
 

package/.next/standalone/src/tests/proof/admin-create-user.test.ts

@@ -0,0 +1,43 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+test("admin create-user: bypasses allowlist, returns temp password, dup 409, unauth 401", async () => {
+  process.env.HOME = mkdtempSync(path.join(tmpdir(), "adduser-"));
+  process.env.WIKI_OWNER_HOSTS = "localhost";
+  const { writeConfig } = await import("../../lib/config.js");
+  const { auth, authReady } = await import("../../lib/auth/server.js");
+  await authReady();
+  const adminRes = await auth.api.signUpEmail({ body: { email: "admin@x.com", password: "test1234!", name: "Admin" }, asResponse: true });
+  const cookie = (adminRes.headers.get("set-cookie") ?? "").split(/,(?=[^ ])/).map(c=>c.split(";")[0].trim()).join("; ");
+  const adminBody = await adminRes.json() as any;
+  const { ensureBootstrapAdmin } = await import("../../lib/auth/admin.js");
+  await ensureBootstrapAdmin(adminBody.user.id);
+  // lock allowlist; admin create must bypass
+  await writeConfig({ allowedEmails: ["onlythis@allowed.com"] });
+  const { POST } = await import("../../app/api/system/users/route.js");
+  const req = new Request("http://localhost:3000/api/system/users", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Origin: "http://localhost:3000", cookie },
+    body: JSON.stringify({ email: "newbie@notallowed.com", name: "New Bie" }),
+  });
+  const res = await POST(req);
+  const out = await res.json() as any;
+  assert.equal(res.status, 200);
+  assert.ok(out.tempPassword && out.tempPassword.length >= 16, "temp password returned");
+  assert.equal(out.email, "newbie@notallowed.com");
+  // dup -> 409
+  const res2 = await POST(new Request("http://localhost:3000/api/system/users", {
+    method: "POST", headers: { "Content-Type": "application/json", Origin: "http://localhost:3000", cookie },
+    body: JSON.stringify({ email: "newbie@notallowed.com" }),
+  }));
+  assert.equal(res2.status, 409);
+  // non-admin -> 403 (no cookie)
+  const res3 = await POST(new Request("http://localhost:3000/api/system/users", {
+    method: "POST", headers: { "Content-Type": "application/json", Origin: "http://localhost:3000" },
+    body: JSON.stringify({ email: "x@y.com" }),
+  }));
+  assert.equal(res3.status, 401);
+});

package/.next/standalone/src/tests/proof/agent-workspace-scope.test.ts

@@ -0,0 +1,134 @@
+/**
+ * Phase C — Agent workspace scoping.
+ *
+ * Proves an agent whose scope.workspaceId is pinned to one workspace is
+ * rejected (403) when a request resolves to a DIFFERENT workspace, and
+ * allowed (200) when it matches. An agent with no workspaceId (wildcard)
+ * works in any workspace.
+ */
+import { test, before, after } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtemp, rm, writeFile, mkdir } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+
+import { setRootDir } from "../../lib/root-dir.js";
+import { ensureRegistry, addAgent, hashToken } from "../../lib/proof/registry.js";
+import { writeConfig } from "../../lib/config.js";
+import type { Workspace } from "../../lib/workspaces.js";
+
+let tmpHome: string;
+let rootA: string;
+let rootB: string;
+let wsA: Workspace;
+let wsB: Workspace;
+
+let fileGET: (req: Request, ctx: { params: Promise<{ path: string[] }> }) => Promise<Response>;
+
+const PINNED_TOKEN = randomBytes(32).toString("hex");
+const WILDCARD_TOKEN = randomBytes(32).toString("hex");
+
+function headers(token: string, id: string): Record<string, string> {
+	return { Authorization: `Bearer ${token}`, "X-Agent-Id": id };
+}
+
+function makeCtx(segments: string[]): { params: Promise<{ path: string[] }> } {
+	return { params: Promise.resolve({ path: segments }) };
+}
+
+before(async () => {
+	tmpHome = await mkdtemp(path.join(tmpdir(), "ws-scope-home-"));
+	rootA = await mkdtemp(path.join(tmpdir(), "ws-scope-A-"));
+	rootB = await mkdtemp(path.join(tmpdir(), "ws-scope-B-"));
+	process.env.HOME = tmpHome;
+	setRootDir(rootA); // fallback (unused once registry has workspaces)
+
+	wsA = {
+		id: "ws_AAAAAA",
+		name: "A",
+		rootDir: rootA,
+		createdAt: new Date().toISOString(),
+		lastOpenedAt: new Date().toISOString(),
+	};
+	wsB = {
+		id: "ws_BBBBBB",
+		name: "B",
+		rootDir: rootB,
+		createdAt: new Date().toISOString(),
+		lastOpenedAt: new Date().toISOString(),
+	};
+	// Seed registry so resolveWorkspaceForAgent picks by ?ws= instead of fallback.
+	await writeConfig({ workspaces: [wsA, wsB] });
+
+	await ensureRegistry();
+	await addAgent({
+		id: "ai:pinned",
+		displayName: "Pinned to A",
+		tokenHash: hashToken(PINNED_TOKEN),
+		scope: { paths: ["**/*"], ops: ["read", "mutate"], workspaceId: wsA.id },
+		createdAt: new Date().toISOString(),
+		lastSeen: new Date().toISOString(),
+	});
+	await addAgent({
+		id: "ai:wildcard",
+		displayName: "Wildcard",
+		tokenHash: hashToken(WILDCARD_TOKEN),
+		scope: { paths: ["**/*"], ops: ["read", "mutate"] }, // no workspaceId
+		createdAt: new Date().toISOString(),
+		lastSeen: new Date().toISOString(),
+	});
+
+	await writeFile(path.join(rootA, "a.txt"), "in A");
+	await writeFile(path.join(rootB, "b.txt"), "in B");
+
+	const fileRoute = await import("../../app/api/agent/fs/file/[...path]/route.js");
+	fileGET = fileRoute.GET;
+});
+
+async function rmQuiet(p: string): Promise<void> {
+	// File-lock sentinels may be written concurrently during teardown → retry.
+	for (let i = 0; i < 3; i++) {
+		try {
+			await rm(p, { recursive: true, force: true });
+			return;
+		} catch {
+			await new Promise((r) => setTimeout(r, 50));
+		}
+	}
+}
+
+after(async () => {
+	await rmQuiet(tmpHome);
+	await rmQuiet(rootA);
+	await rmQuiet(rootB);
+});
+
+test("pinned agent: 200 in its own workspace", async () => {
+	const req = new Request(`http://localhost/api/agent/fs/file/a.txt?ws=${wsA.id}`, {
+		headers: headers(PINNED_TOKEN, "ai:pinned"),
+	});
+	const res = await fileGET(req, makeCtx(["a.txt"]));
+	assert.equal(res.status, 200);
+	assert.equal(await res.text(), "in A");
+});
+
+test("pinned agent: 403 when request resolves to a different workspace", async () => {
+	const req = new Request(`http://localhost/api/agent/fs/file/b.txt?ws=${wsB.id}`, {
+		headers: headers(PINNED_TOKEN, "ai:pinned"),
+	});
+	const res = await fileGET(req, makeCtx(["b.txt"]));
+	assert.equal(res.status, 403);
+});
+
+test("wildcard agent: 200 in either workspace", async () => {
+	const reqA = new Request(`http://localhost/api/agent/fs/file/a.txt?ws=${wsA.id}`, {
+		headers: headers(WILDCARD_TOKEN, "ai:wildcard"),
+	});
+	assert.equal((await fileGET(reqA, makeCtx(["a.txt"]))).status, 200);
+
+	const reqB = new Request(`http://localhost/api/agent/fs/file/b.txt?ws=${wsB.id}`, {
+		headers: headers(WILDCARD_TOKEN, "ai:wildcard"),
+	});
+	assert.equal((await fileGET(reqB, makeCtx(["b.txt"]))).status, 200);
+});

package/.next/standalone/src/tests/proof/collab-state.test.ts

@@ -98,66 +98,68 @@ after(async () => {
 
 // ── Lease store unit tests ────────────────────────────────────────────────────
 
+const TEST_NS = "/test-ns";
+
 describe("lease store", () => {
 	before(() => _resetLeaseStore());
 	after(() => _resetLeaseStore());
 
 	test("new path has generation 0, no active lease", () => {
 		_resetLeaseStore();
-		assert.equal(leaseGeneration("docs/a.md"), 0);
-		assert.equal(hasActiveLease("docs/a.md"), false);
+		assert.equal(leaseGeneration(TEST_NS, "docs/a.md"), 0);
+		assert.equal(hasActiveLease(TEST_NS, "docs/a.md"), false);
 	});
 
 	test("setLease makes lease active, bumps generation 0→1", () => {
 		_resetLeaseStore();
-		setLease("docs/a.md", "u1");
-		assert.equal(hasActiveLease("docs/a.md"), true);
-		assert.equal(leaseGeneration("docs/a.md"), 1);
+		setLease(TEST_NS, "docs/a.md", "u1");
+		assert.equal(hasActiveLease(TEST_NS, "docs/a.md"), true);
+		assert.equal(leaseGeneration(TEST_NS, "docs/a.md"), 1);
 	});
 
 	test("second setLease (heartbeat) does NOT bump generation again", () => {
 		_resetLeaseStore();
-		setLease("docs/a.md", "u1");
-		const gen = leaseGeneration("docs/a.md");
-		setLease("docs/a.md", "u1"); // heartbeat
-		assert.equal(leaseGeneration("docs/a.md"), gen); // unchanged
+		setLease(TEST_NS, "docs/a.md", "u1");
+		const gen = leaseGeneration(TEST_NS, "docs/a.md");
+		setLease(TEST_NS, "docs/a.md", "u1"); // heartbeat
+		assert.equal(leaseGeneration(TEST_NS, "docs/a.md"), gen); // unchanged
 	});
 
 	test("clearLease removes active lease and bumps generation 1→2", () => {
 		_resetLeaseStore();
-		setLease("docs/a.md", "u1");
-		assert.equal(leaseGeneration("docs/a.md"), 1);
-		clearLease("docs/a.md", "u1");
-		assert.equal(hasActiveLease("docs/a.md"), false);
-		assert.equal(leaseGeneration("docs/a.md"), 2);
+		setLease(TEST_NS, "docs/a.md", "u1");
+		assert.equal(leaseGeneration(TEST_NS, "docs/a.md"), 1);
+		clearLease(TEST_NS, "docs/a.md", "u1");
+		assert.equal(hasActiveLease(TEST_NS, "docs/a.md"), false);
+		assert.equal(leaseGeneration(TEST_NS, "docs/a.md"), 2);
 	});
 
 	test("clearLease by different user is no-op", () => {
 		_resetLeaseStore();
-		setLease("docs/a.md", "u1");
-		clearLease("docs/a.md", "u-other");
-		assert.equal(hasActiveLease("docs/a.md"), true);
-		assert.equal(leaseGeneration("docs/a.md"), 1);
+		setLease(TEST_NS, "docs/a.md", "u1");
+		clearLease(TEST_NS, "docs/a.md", "u-other");
+		assert.equal(hasActiveLease(TEST_NS, "docs/a.md"), true);
+		assert.equal(leaseGeneration(TEST_NS, "docs/a.md"), 1);
 	});
 
 	test("expired lease (via short TTL) returns false and bumps generation", async () => {
 		_resetLeaseStore();
-		setLease("docs/expire.md", "u1", 10); // 10ms TTL
-		assert.equal(hasActiveLease("docs/expire.md"), true);
+		setLease(TEST_NS, "docs/expire.md", "u1", 10); // 10ms TTL
+		assert.equal(hasActiveLease(TEST_NS, "docs/expire.md"), true);
 		await new Promise((r) => setTimeout(r, 20));
-		assert.equal(hasActiveLease("docs/expire.md"), false);
+		assert.equal(hasActiveLease(TEST_NS, "docs/expire.md"), false);
 		// generation bumped on expiry check
-		assert.ok(leaseGeneration("docs/expire.md") >= 2);
+		assert.ok(leaseGeneration(TEST_NS, "docs/expire.md") >= 2);
 	});
 
 	test("set after expiry = new 0→1 transition, bumps again", async () => {
 		_resetLeaseStore();
-		setLease("docs/exp2.md", "u1", 10);
+		setLease(TEST_NS, "docs/exp2.md", "u1", 10);
 		await new Promise((r) => setTimeout(r, 20));
-		hasActiveLease("docs/exp2.md"); // triggers sweep
-		const genAfterExpiry = leaseGeneration("docs/exp2.md");
-		setLease("docs/exp2.md", "u1"); // fresh open
-		assert.equal(leaseGeneration("docs/exp2.md"), genAfterExpiry + 1);
+		hasActiveLease(TEST_NS, "docs/exp2.md"); // triggers sweep
+		const genAfterExpiry = leaseGeneration(TEST_NS, "docs/exp2.md");
+		setLease(TEST_NS, "docs/exp2.md", "u1"); // fresh open
+		assert.equal(leaseGeneration(TEST_NS, "docs/exp2.md"), genAfterExpiry + 1);
 	});
 });
 
@@ -252,11 +254,11 @@ describe("computeCollabState", () => {
 		const mdPath = "lease-only.md";
 		await writeFile(path.join(tmpRoot, mdPath), "# lease only");
 		// No sidecar; human opens it
-		setLease(mdPath, "human-user-1");
+		setLease(tmpRoot, mdPath, "human-user-1");
 		const result = await computeCollabState(tmpRoot, mdPath);
 		assert.equal(result.state, "active");
 		assert.equal(result.revision, 1); // 0 + gen(1)
-		clearLease(mdPath, "human-user-1");
+		clearLease(tmpRoot, mdPath, "human-user-1");
 	});
 
 	test("revision = sidecar.revision + leaseGeneration", async () => {
@@ -269,10 +271,10 @@ describe("computeCollabState", () => {
 		const r1 = await computeCollabState(tmpRoot, mdPath);
 		assert.equal(r1.revision, 7);
 		// open lease: gen=1, revision=8
-		setLease(mdPath, "u1");
+		setLease(tmpRoot, mdPath, "u1");
 		const r2 = await computeCollabState(tmpRoot, mdPath);
 		assert.equal(r2.revision, 8);
-		clearLease(mdPath, "u1");
+		clearLease(tmpRoot, mdPath, "u1");
 	});
 
 	test("stale pending suggestion does NOT count as active artifact", async () => {
@@ -332,14 +334,14 @@ describe("X-Collab headers on GET fs/file", () => {
 		_resetLeaseStore();
 		const mdPath = "hdr-active.md";
 		await writeFile(path.join(tmpRoot, mdPath), "# active");
-		setLease(mdPath, "human-1");
+		setLease(tmpRoot, mdPath, "human-1");
 		const req = new Request(fileUrl(mdPath), {
 			headers: agentHeaders(READ_TOKEN, "ai:reader"),
 		});
 		const res = await fileGET(req, makeCtx([mdPath]));
 		assert.equal(res.status, 200);
 		assert.equal(res.headers.get("x-collab-state"), "active");
-		clearLease(mdPath, "human-1");
+		clearLease(tmpRoot, mdPath, "human-1");
 	});
 });
 
@@ -367,13 +369,13 @@ describe("X-Collab headers on Tier-2 GET agent/files", () => {
 		_resetLeaseStore();
 		const mdPath = "tier2-active.md";
 		await writeFile(path.join(tmpRoot, mdPath), "# active");
-		setLease(mdPath, "h1");
+		setLease(tmpRoot, mdPath, "h1");
 		const req = new Request(tier2Url(mdPath), {
 			headers: agentHeaders(READ_TOKEN, "ai:reader"),
 		});
 		const res = await tier2GET(req, makeCtx([mdPath]));
 		assert.equal(res.headers.get("x-collab-state"), "active");
-		clearLease(mdPath, "h1");
+		clearLease(tmpRoot, mdPath, "h1");
 	});
 });
 
@@ -409,7 +411,7 @@ describe("R6 TOCTOU enforcement on raw .md PUT", () => {
 		const oldSha = sha256hex(Buffer.from(initial));
 
 		// Simulate: agent read the file, then human opens it (lease set)
-		setLease(mdPath, "human-racer");
+		setLease(tmpRoot, mdPath, "human-racer");
 
 		// Agent tries raw PUT without If-Collab-Match
 		const req = new Request(fileUrl(mdPath), {
@@ -427,7 +429,7 @@ describe("R6 TOCTOU enforcement on raw .md PUT", () => {
 		assert.ok(body.snapshotUrl, "snapshotUrl in response");
 		assert.ok(typeof body.revision === "number", "revision in response");
 
-		clearLease(mdPath, "human-racer");
+		clearLease(tmpRoot, mdPath, "human-racer");
 	});
 
 	test("PUT .md with matching If-Collab-Match → 200", async () => {
@@ -437,7 +439,7 @@ describe("R6 TOCTOU enforcement on raw .md PUT", () => {
 		await writeFile(path.join(tmpRoot, mdPath), initial);
 		const oldSha = sha256hex(Buffer.from(initial));
 
-		setLease(mdPath, "human-match");
+		setLease(tmpRoot, mdPath, "human-match");
 		// Get the current revision
 		const { revision } = await computeCollabState(tmpRoot, mdPath);
 
@@ -453,7 +455,7 @@ describe("R6 TOCTOU enforcement on raw .md PUT", () => {
 		const res = await filePUT(req, makeCtx([mdPath]));
 		assert.equal(res.status, 200, "matching If-Collab-Match should allow write");
 
-		clearLease(mdPath, "human-match");
+		clearLease(tmpRoot, mdPath, "human-match");
 	});
 
 	test("PUT .md with ?force=true bypasses R6 even on active doc → 200", async () => {
@@ -463,7 +465,7 @@ describe("R6 TOCTOU enforcement on raw .md PUT", () => {
 		await writeFile(path.join(tmpRoot, mdPath), initial);
 		const oldSha = sha256hex(Buffer.from(initial));
 
-		setLease(mdPath, "human-force");
+		setLease(tmpRoot, mdPath, "human-force");
 
 		const req = new Request(fileUrl(mdPath, "?force=true"), {
 			method: "PUT",
@@ -476,7 +478,7 @@ describe("R6 TOCTOU enforcement on raw .md PUT", () => {
 		const res = await filePUT(req, makeCtx([mdPath]));
 		assert.equal(res.status, 200, "?force=true should bypass R6");
 
-		clearLease(mdPath, "human-force");
+		clearLease(tmpRoot, mdPath, "human-force");
 	});
 
 	test("PUT non-.md file is never blocked by R6 (no collab state)", async () => {

package/.next/standalone/src/tests/proof/preload.ts

@@ -0,0 +1,21 @@
+/**
+ * Test preload — runs before any test module is imported (via `tsx --import`).
+ *
+ * auth/server.ts resolves the SQLite DB path from $HOME at module-load time.
+ * Several test files import route handlers (and thus auth/server) at the top of
+ * the file, before their before() hook can override HOME. Without this preload
+ * those imports freeze the DB path to the real ~/.wiki-viewer/auth.db and the
+ * suite writes thousands of @test.local users into it.
+ *
+ * Forcing HOME to a throwaway tmp dir here, before anything else loads,
+ * guarantees every test run is isolated from the developer's real config.
+ */
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+if (!process.env.WIKI_TEST_HOME) {
+	const home = mkdtempSync(path.join(tmpdir(), "wiki-test-home-"));
+	process.env.HOME = home;
+	process.env.WIKI_TEST_HOME = home;
+}