Merge pull request 'fix: empty dialogs - relative project path caused a silently-swallowed 403 (+ cache-busting)' (#7) from fix/cache-busting into master

THE ACTUAL CAUSE of "codegit is just a black box". Sections 4 and 5 were real bugs but
neither was it; this is.

CHAIN
  1. install/process.php stores a RELATIVE folder name -> projects.db {"Blog":"blog"}
  2. common.php::loadState() does $projectPath = reset($projectList) -> "blog", and
     SESSION("projectPath","blog") PERSISTS it, so the bad value sticks across logins
  3. filetree puts it straight into the DOM: <a id="project-root" data-path="blog">
  4. codegit sends repo="blog"; getWorkspacePath("blog") fails checkPath() ->
       traits/path.php:67  Common::send(403, "Client does not have access.")
  5. modal.js SILENTLY discards it:
       settled: function(reply,status){ if (status !== 200) return; ... }
     No toast, no console error, #content left empty.

That last step is why it presents as an empty black dialog rather than an error - the request
fails and nothing reports it. Which is exactly why it survived the CSS fixes.

PINNED DOWN BY CAPTURING THE REAL REQUEST, not by reading CSS:
  POST /dialog.php {"target":"codegit","action":"codegit","repo":"blog"} -> 403
  #content innerHTML length: 0
  getWorkspacePath("blog") -> 403
  projects store           -> {"Blog":"blog"}

FIX (scripts/fix-project-path.sh) - both parts required:
  A. resolve the path in loadState and re-store it, which also HEALS sessions already
     holding the relative value (and re-persists so it stays healed)
  B. make the projects store absolute, so array_search() can still map path -> name for
     the tree label. Fixing only (A) would silently break the label: the path would resolve
     but array_search would return false and the tree would show an empty project name.

VERIFIED from a deliberately poisoned session ("blog"): it self-heals to the absolute path,
dialog returns 200, #content fills with 1758 chars. An EXISTING browser session heals on its
next page load - no hard refresh or re-login needed.

Tests: 47 passed, 0 failed, 1 accepted-risk
  + projects store must hold an absolute path
  + loadState must resolve a relative projectPath

Also marks section 4 as superseded so a future reader doesn't stop at the CSS explanation.

docs/known-issues.md

@@ -9,7 +9,79 @@ Pinned Atheos commit: `f90cd1806dbe0e25673a77e27390e8b1a240c3f6` (build 611).
 
 ---
 
-## 1. 🔴 Plugin market: the **Terminal** plugin does not work as shipped
+## 1. 🔴 **Deleting any file or folder was broken** — `GLOB_BRACE` does not exist on musl
+
+**Symptom:** removing the Terminal plugin from the market **cycled forever in the UI** (never
+completed, never errored). Deleting a file or folder in the editor was broken by the same cause.
+
+**Root cause — a glibc-only constant referenced on musl.** `traits/helpers.php::rDelete()`:
+
+```php
+$files = glob($target . "{*,.[!.]*,..?*}", GLOB_BRACE|GLOB_MARK);
+```
+
+`GLOB_BRACE` is a **glibc extension**. Alpine uses **musl**, where the constant is *undefined* —
+and touching an undefined constant is a **fatal error** in PHP 8 (a warning in older versions):
+
+```
+PHP Fatal error: Uncaught Error: Undefined constant "GLOB_BRACE"
+in /var/www/atheos/traits/helpers.php:138
+#0 components/market/class.market.php(178): Common::rDelete()
+#1 components/market/controller.php(46): Market->remove()
+```
+
+Because the fatal kills the request before `Common::send(200)`, the front end never receives a
+settle response — so the UI **spins indefinitely**. A hang, not an error.
+
+**Blast radius — measured, two call sites:**
+
+| Caller | What breaks |
+|---|---|
+| `components/market/class.market.php:178` | removing a plugin from the market |
+| `components/filetree/class.filetree.php:59` | **deleting any file or folder in the editor** |
+
+The second is core editor functionality, so this is **not** a plugin bug — installing the Terminal
+plugin is merely what made it visible. Verified directly: with the original code, `rDelete()` fatals
+and the target is left on disk.
+
+**Fix applied** (`patches/helpers-rDelete-GLOB_BRACE.diff`) — expand the brace pattern by hand when
+`GLOB_BRACE` is absent, keeping upstream's exact behaviour where it *is* defined:
+
+```php
+if (defined("GLOB_BRACE")) {
+    $files = glob($target . "{*,.[!.]*,..?*}", GLOB_BRACE | GLOB_MARK);
+} else {
+    $files = array_merge(
+        glob($target . "/*",        GLOB_MARK) ?: [],
+        glob($target . "/.[!.]*",   GLOB_MARK) ?: [],
+        glob($target . "/..?*",     GLOB_MARK) ?: []
+    );
+}
+```
+
+The three patterns are precisely what the brace expansion produces (`*`, dotfiles, and `.`/`..`-like
+names), so the directory listing is equivalent.
+
+**Verified** — `php83 -l` clean, then a real deletion of a tree containing nested dirs and two
+dotfiles:
+
+```
+entries before: 10
+rDelete() returned: true
+exists after: gone (OK)
+single file: rDelete=true exists=gone (OK)
+```
+
+**Upstream has NOT fixed this** — the same line is still in `main` (checked directly), so it cannot
+be resolved by updating Atheos. Re-apply this patch after any update (`scripts/update-atheos.sh`).
+
+**Consequence for the platform choice:** this is the real cost of Alpine. A glibc-based image
+(Debian/Ubuntu) would not have hit it. It is patchable in one place, so Alpine stays — but it is worth
+knowing that `GLOB_BRACE` is the kind of thing musl breaks.
+
+---
+
+## 2. 🔴 Plugin market: the **Terminal** plugin does not work as shipped
 
 **Symptom:** installed the Terminal plugin from the market; it failed / did not function.
 
@@ -86,17 +158,30 @@ Because of (1) and (2), the in-app password is treated as a **secret**:
 - it changes per install; `scripts/provision.sh` does not set one, so a rebuild returns to the
   upstream default — **rotate it again after a rebuild**
 
-**Recommendation: remove this plugin unless you specifically want a browser shell.** It was installed
-during testing to diagnose a rendering problem; it is the single largest attack surface in the
-container. Note that Atheos macros already provide command execution, so the plugin adds little you
-do not already have — and macros are at least under your own configuration.
+**Outcome: the plugin has been REMOVED.** Once the `GLOB_BRACE` fault (§1) was fixed, removal through
+the market succeeded — and that is the right end state: a browser shell is the single largest attack
+surface in the container, and **Atheos macros already provide command execution**, so it added little
+you did not already have. Removal was done by invoking the market's own `remove()` path, so the plugin
+list, the `addons` cache and the generated bundle all stayed consistent:
+
+```
+{"text":"Plugin successfully removed.","status":200}
+plugins/ -> (only README.md remains)
+addons cache references to Terminal: 0
+```
+
+The notes above are kept because they document what the plugin *is* and how it failed — and because
+the same stale-API pattern will recur with any other Codiad-era plugin. To reinstall, use the
+market: it will re-introduce the `Common::execute` fault, so `patches/Terminal-terminal.php.patched`
+was the fix — **it has been deleted along with the plugin**. If you ever reinstall, re-derive it:
+`grep -rhoE 'Common::[a-zA-Z_]+' plugins/Terminal/` and expect `Common::execute` to be missing.
 
 `docs/security-notes.md` §2 S-7 covers disabling `exec`/`proc_open`, which would neutralise **both**
 this plugin and the macros. That is the correct lever if you ever expose this container.
 
 ---
 
-## 2. 🟠 The Macro dialog crashed when folder-scoped macros existed
+## 3. 🟠 The Macro dialog crashed when folder-scoped macros existed
 
 **Symptom:** the Settings → Macro dialog returned HTTP 500.
 
@@ -139,7 +224,216 @@ Worth doing if the dialog starts 500-ing again after editing a macro in the UI.
 
 ---
 
-## 3. Checking for plugin problems in future
+## 4. 🟠 The CodeGit panel looked like an empty black box
+
+**Symptom:** the CodeGit dialog appeared as a mostly-empty black rectangle. Nothing was *broken* —
+it was unreadable, which reads as "broken".
+
+> **⚠️ Superseded by §6.** This section fixed a real layout bug, but it was NOT the cause of the
+> empty CodeGit dialog. The actual cause was a relative project path making the request 403, which
+> the modal silently swallowed. Both are fixed; if a dialog is ever blank again, read §6 first.
+
+**This was NOT a codegit bug in the JS sense.** Verified exhaustively first:
+
+```
+all four panels return real content through the authenticated API:
+  overview   200    940 bytes
+  log        200  79596 bytes   (full commit history)
+  transfer   200   1460 bytes
+  config     200   1174 bytes
+no JS errors in the browser console; all DOM helpers (replaceClass etc.) exist
+```
+
+**Root cause — the generic `panel` rule hardcodes a height.** `theme/modules/common/_panel.scss`
+(after minification, in `theme/main.min.css`):
+
+```css
+panel { padding: 5px; width: calc(100% - 200px); overflow: auto; overflow-y: scroll;
+        height: 500px; position: relative; border-left: var(--borderLight); }
+```
+
+Measured live, that produces:
+
+| Element | Height | Problem |
+|---|---|---|
+| `#dialog` | 404px | clamped by `max-height: 70vh` + `overflow-y: auto` |
+| `#codegit panel` | 500px | **forced**, while its content is 119px |
+| `toolbar` ("Branch: …") | top **620** vs dialog bottom **490** | **pushed OUTSIDE the modal** |
+
+So ~380px of the dialog was **empty dead space**, and anything after the panel — including the
+Branch line — rendered *below* the modal, invisible. A generic `panel { height: 500px }` is exactly
+the kind of rule that looks like a void.
+
+**Fix applied:**
+
+```css
+panel { ... height: auto; max-height: 58vh; overflow-y: auto; ... }
+```
+
+Content-sized, capped so long content (the 79KB log) still scrolls. Verified live:
+
+```
+before: panel 500px  → toolbar top 620, dialog bottom 490   (outside)
+after:  panel 136px  → toolbar top 256, dialog bottom 279   (inside)
+```
+
+`theme/modules/common/_panel.scss` is updated too, so the source does not contradict the shipped CSS
+(there is no Sass compiler on the guest, so `main.min.css` is edited directly).
+
+---
+
+## 5. 🟠 CSS/JS changes were invisible behind the browser cache
+
+**Symptom:** a fix to the theme did not appear until a hard refresh — so the panel fix in §4 looked
+like it had not worked at all. Reported twice, the second time with "is it because I'm on Firefox?"
+
+**It was not Firefox.** Verified in a real, scripted Firefox (155.0) against the live server with the
+fix applied:
+
+```
+assets Firefox requested:  theme/main.min.css?v=1790663824   <- versioned
+applied panel rule:        height: auto; max-height: 58vh    <- the fix
+dialog 193px | panel 138px | toolbar INSIDE | JS errors: none
+```
+
+The panel rendered correctly and the Branch toolbar sat inside the modal. Firefox behaves identically
+to Chromium here; it was simply still running the **old cached stylesheet**.
+
+**Root cause — stable asset URLs, with nothing to bust them.** Atheos emits:
+
+```html
+<link rel="stylesheet" href="theme/main.min.css">   <!-- no version -->
+<script src="public/modules.min.js"></script>       <!-- no version -->
+```
+
+Same path before and after a change, and originally no cache headers at all. A browser therefore keeps
+its cached copy across an update, and never even asks the server. Changing the CSS on the server
+cannot fix that — the browser is not fetching it.
+
+**Fix (two parts):**
+
+1. **nginx** sends `Cache-Control: no-cache, must-revalidate` for `*.css`/`*.js`. This does **not**
+   disable caching — it forces **revalidation**, so normal loads still get a cheap 304 while changes
+   are picked up.
+2. **Versioned URLs.** `SourceManager::getTag()` and the theme link in `index.php` now append the
+   file's mtime (`?v=<mtime>`). A changed file gets a **new URL** so it is fetched immediately; an
+   unchanged file keeps its URL and stays cached.
+
+Part 2 is the one that actually mattered here: it works **even against an already-poisoned cache**,
+which part 1 alone cannot do. Once the *page* refreshes (it is served `no-store`), every asset URL it
+references is new, so the stale CSS is bypassed with no manual clearing.
+
+**If you ever see a stale UI again:** force a reload (Ctrl/Cmd-Shift-R). If that fixes it, this
+section is why.
+
+**Forcing this one time:** if a browser holds an old copy, any of these work —
+Ctrl/Cmd-Shift-R, `about:blank` then back, a private window, or `rm -rf` the profile's cache. Or just
+change the file's mtime (`touch`) and the URL changes by itself.
+
+---
+
+## 6. 🔴 Every dialog rendered EMPTY (CodeGit "just a black box")
+
+**Symptom:** CodeGit — and, it turns out, the Macro / Market / Settings dialogs — opened as an empty
+black area. No error, no text, nothing. Reported as *"codegit still no go just a black box"*, twice,
+and it survived the CSS fix in §4, because it was never a CSS problem.
+
+**This is the bug that actually mattered.** §4 and §5 were real defects, but neither was the cause.
+
+### The chain
+
+1. **The installer stores a RELATIVE path.** `components/install/process.php` keeps the folder name
+   as given, so the project store held `{"Blog": "blog"}` — not an absolute path.
+2. **`loadState()` hands it to the UI unmodified and persists it** (`common.php`):
+
+   ```php
+   $projectPath = reset($projectList);          // "blog"
+   ...
+   SESSION("projectPath", $projectPath);        // stored -> the bad value STICKS across logins
+   ```
+
+3. **The file tree puts it straight into the DOM** (`components/filetree/init.js`):
+
+   ```js
+   let path = atheos.current.projectPath;
+   `<a id="project-root" data-type="root" data-path="${path}">`   // data-path="blog"
+   ```
+
+4. **CodeGit then sends `repo="blog"`**, and `getWorkspacePath("blog")` fails its access check:
+
+   ```
+   traits/path.php:67   Common::send(403, "Client does not have access.");
+   ```
+
+5. **`modal.js` silently discards the failure** — this is what makes it look like a "black box"
+   rather than an error:
+
+   ```js
+   settled: function(reply, status) {
+       if (status !== 200) return;      // no message, no toast, no console error
+       content.html(reply);
+   ```
+
+So the request 403s, nothing is rendered, and nothing is reported. The dialog is left with an empty
+`<section id="content">`.
+
+### How it was pinned down
+
+Not by reading CSS. By capturing the real request/response from a scripted browser:
+
+```
+POST /dialog.php   {"target":"codegit","action":"codegit","repo":"blog"}
+-> 403  (and #content innerHTML length: 0)
+```
+
+A relative path was reproduced directly:
+
+```
+is_dir("blog") from the app root        -> NO
+getWorkspacePath("blog")                -> 403 Client does not have access.
+projects store                          -> {"Blog": "blog"}
+```
+
+### Fix (`scripts/fix-project-path.sh`)
+
+A relative value in the store is **legitimate** — Atheos's own project-creation code resolves
+relative → `WORKSPACE/<name>`. `loadState()` simply never does. Two changes, both required:
+
+**A. Resolve at load time, and re-store it** — this heals sessions already holding the bad value:
+
+```php
+if (!Common::isAbsPath($projectPath)) {
+    $projectPath = Common::getWorkspacePath($projectPath, true);
+    SESSION("projectPath", $projectPath);
+}
+```
+
+**B. Make the store absolute** (`{"Blog": "/var/www/atheos/workspace/blog"}`) so that
+`array_search($projectPath, $projectList)`, which `loadState()` uses to derive the project *name*
+for the tree label, keeps working. Fixing only (A) would silently break the label — the path would
+resolve but `array_search` would return `false`, so the tree would show an empty name.
+
+**Verified** by starting from a deliberately poisoned session (`projectPath="blog"`) and confirming
+it self-heals:
+
+```
+projectPath : /var/www/atheos/workspace/blog    <- healed from "blog"
+data-path   : /var/www/atheos/workspace/blog
+dialog.php  : 200 with content
+#content    : 1758 chars
+visible     : CodeGit Overview Log Transfer Configure Commit Amend ...
+```
+
+**An existing browser session heals on its next page load** — no hard refresh or re-login needed.
+
+### Worth remembering
+
+A 403 from `getWorkspacePath()` presents as *"the dialog is empty"*, with no error anywhere. If any
+Atheos dialog is ever blank again, check the **project path** first, then the response code — not the CSS.
+
+---
+
+## 7. Checking for plugin problems in future
 
 The plugin's JS is bundled into `public/plugins.min.js` (built by `classes/sourcemanager.php`), and
 its rightbar button is rendered by `components/sidebars/sb-right.php` from `plugin.json`. Both were
@@ -173,22 +467,26 @@ verify them before trusting it.
 
 ---
 
-## 4. Follow-ups not done (recorded so they are not forgotten)
+## 8. Follow-ups not done (recorded so they are not forgotten)
 
 These came out of review. They are **operator decisions**, not agent ones — several change what the
 editor can do.
 
-### 4.1 Remove the Terminal plugin (recommended)
+### 8.0 Branch protection on `master` — ACCEPTED RISK
 
-The strongest advice from review, and correct: a browser shell is the largest attack surface in this
-container, and **Atheos macros already provide command execution**, so the plugin adds little. It was
-installed during testing to diagnose a plugin-rendering problem. Removing the plugin directory (or
-renaming it to `Terminal.disabled` — `readDirectory()` skips `*.disabled`) removes the surface.
+Deliberately **not** enabled while the editor is LAN-only (operator decision). Full reasoning and the
+"enable it before you expose this host" trigger are in
+[`docs/writer-branch-workflow.md` §2](writer-branch-workflow.md#2-protect-master-on-the-blog-repo--recommendation-deliberately-not-enabled).
 
-Left installed because it is the **operator's** plugin and removing it unilaterally would take away a
-tool without being asked.
+The suite still probes for it on every run and reports `ACCEPTED-RISK` (not a failure) while it is
+off, so the recommendation self-cancels the moment it is enabled.
 
-### 4.2 ❌ `disable_functions` cannot be "on by default" here — measured
+### 8.1 Remove the Terminal plugin — ✅ DONE
+
+Removed through the market's own code path once §1 was fixed (see §2). A browser shell was the largest
+attack surface in the container and macros already cover command execution.
+
+### 8.2 ❌ `disable_functions` cannot be "on by default" here — measured
 
 Review asked for `php.ini` to disable `exec`, `shell_exec`, `passthru`, `system` by default.
 **This would break the editor's core function.** Evidence:
@@ -205,18 +503,18 @@ turns the editor into a text editor that cannot commit. So it stays **a delibera
 you would also lose macros and git integration, which is why S-7 already says *"test, do not
 blind-apply"*.
 
-### 4.3 Rotate the terminal password automatically
+### 8.3 Rotate the terminal password automatically
 
 If the plugin is kept, `provision.sh` should generate a random password rather than leaving the
 upstream default. Not implemented: it would hardcode a secret into a repo file, which is the same
 class of problem this file already documents.
 
-### 4.4 Deploy key could be read-only
+### 8.4 Deploy key could be read-only
 
 Review suggested making the deploy key read-only if writes are unnecessary. **They are necessary** —
 that is the whole point of the writer-branch workflow (macro 2 pushes). Not applicable.
 
-### 4.5 The real upstream fix for §2
+### 8.5 The real upstream fix for §3
 
-`class.macro.php::save()` should write `[]` instead of `"N/A"` for folder macros. See §2 — the fix is
+`class.macro.php::save()` should write `[]` instead of `"N/A"` for folder macros. See §4 — the fix is
 currently applied to the data, so it survives updates, at the cost of being reversible from the UI.

docs/writer-branch-workflow.md

@@ -17,7 +17,7 @@ merging into `master` is done by the operator in Gitea.
                                      │  operator opens a PR in Gitea
                                      │  operator reviews
                                      ▼
-                              master  (protected)
+                              master  (protected: RECOMMENDED, currently OFF - see §2)
                                      │
                                      ▼
                         existing Pelican build pipeline
@@ -43,12 +43,31 @@ This is the *same* global gitconfig php-fpm uses (`HOME=/home/atheos` — verifi
 as **you**. If it is not set, macro **2** refuses with an actionable error rather than
 committing under a bogus identity.
 
-### 2. ⚠️ Protect `master` on the blog repo
+### 2. Protect `master` on the blog repo — RECOMMENDATION, deliberately not enabled
 
-**Not yet enabled — the deploy key can currently force-push `master` directly**, which defeats the
-whole model. Set it in Gitea (repo owner only):
+**Status: accepted risk. Branch protection is OFF, and that is a decision, not an oversight.**
 
-`armistace/blog` → **Settings** → **Branches** → add rule for `master`:
+> *"leave it as a recommendation — I won't do that unless I take this out to the wider internet"*
+> — operator
+
+The deploy key **can** push `master` directly, which means the writer-branch model is **advisory, not
+enforced**. The operator has weighed this and chosen not to add the gate while the editor is LAN-only:
+
+- **The compensating control is reachability, not immutability.** The editor is LAN-only (FR-10). The
+  threat this setting defends against is a compromised editor publishing straight to `master`; while
+  nothing off-LAN can reach the editor, and the only user on the LAN is the operator, that is largely
+  theoretical.
+- **The cost is real now, the benefit is not.** Protection adds a merge gate for the sole user, who is
+  also the repo owner — friction with no realistic risk reduction today.
+
+#### ⚠️ Enable it BEFORE either of these happens
+
+1. **The editor becomes reachable off-LAN** — an NPM proxy entry, a port-forward, or a
+   Tailscale/WireGuard route to `blog-ide.aridgwayweb.com`.
+2. **Anyone other than the operator gets access to the editor.**
+
+At that point a deploy key that can force-push `master` stops being theoretical. The setting
+(`armistace/blog` → **Settings** → **Branches** → rule for `master`):
 
 | Setting | Value |
 |---|---|
@@ -63,6 +82,14 @@ curl -s -H "Authorization: token $GITEA_TOKEN" \
   https://git.aridgwayweb.com/api/v1/repos/armistace/blog/branch_protections
 ```
 
+#### It is still checked on every test run
+
+`build-and-test.sh` attempts a direct push to `master` with the deploy key and requires it to be
+**rejected**. While protection is off that reports as `ACCEPTED-RISK`, not `FAIL` — so the suite stays
+green and CI-usable — but **the check runs every time**. It flips to
+`PASS master is protected` by itself the moment protection is enabled, and this recommendation
+becomes moot without anyone having to remember it.
+
 ### 3. The macros
 
 Installed directly into Atheos's macro store (`data/macros.db.php`); a copy is kept in this repo at

files/atheos.conf

@@ -7,13 +7,12 @@ server {
     root /var/www/atheos;
     index index.php index.html;
 
+    # --- logging ---------------------------------------------------------
     access_log /var/log/nginx/atheos.access.log;
     error_log  /var/log/nginx/atheos.error.log;
 
-    # --- PHP -----------------------------------------------------------------
-    # The socket path here MUST byte-match the pool's `listen =` in
-    #   /etc/php83/php-fpm.d/www.conf
-    # (interface I-1 — a mismatch yields a bare 502 with no other diagnostic).
+    # --- PHP: the socket path here MUST byte-match the pool's `listen =`
+    #     in /etc/php83/php-fpm.d/www.conf  (interface I-1 -> else bare 502)
     location ~ \.php$ {
         try_files $uri =404;
         fastcgi_split_path_info ^(.+\.php)(/.+)$;
@@ -27,7 +26,8 @@ server {
         try_files $uri $uri/ =404;
     }
 
-    # --- hardening -----------------------------------------------------------
+    # --- hardening (free, no downside) -----------------------------------
+    # never serve the VCS directory, the app's private data, or dotfiles
     location ~ /\.git       { deny all; }
     location ~ /\.ssh       { deny all; }
     location ~ /\.           { deny all; }
@@ -40,4 +40,13 @@ server {
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
 
     client_max_body_size 64m;
+
+    # Atheos serves theme/main.min.css and the generated *.min.js/css bundles from STABLE URLs
+    # with no cache headers. Without this, a CSS/JS change stays invisible behind a cached copy
+    # until the user hard-refreshes. "no-cache" permits caching but forces revalidation, so a
+    # 304 keeps normal loads fast while guaranteeing updates are picked up on the next load.
+    location ~* \.(css|js)$ {
+        add_header Cache-Control "no-cache, must-revalidate";
+        try_files $uri =404;
+    }
 }

patches/Terminal-terminal.php.patched

@@ -1,155 +0,0 @@
-<?php
-//////////////////////////////////////////////////////////////////////////////80
-// Atheos Terminal
-//////////////////////////////////////////////////////////////////////////////80
-// Copyright (c) 2020 Liam Siira (liam@siira.io), distributed as-is and without
-// warranty under the MIT License. See [root]/docs/LICENSE.md for more.
-// This information must remain intact.
-//////////////////////////////////////////////////////////////////////////////80
-// Copyright (c) 2013 Codiad & Kent Safranski
-// Source: https://github.com/Fluidbyte/Codiad-Terminal
-//////////////////////////////////////////////////////////////////////////////80
-require_once("../../common.php");
-
-//////////////////////////////////////////////////////////////////////////////80
-// Verify Session or Key
-//////////////////////////////////////////////////////////////////////////////80
-Common::checkSession();
-
-//////////////////////////////////////////////////////////////////////////////80
-// Globals
-//////////////////////////////////////////////////////////////////////////////80
-$project = SESSION("project");
-
-define("PASSWORD", "<ROTATED - retrieve on the guest>");
-define("ROOT", Common::getWorkspacePath($project));
-define("BLOCKED", "ssh,telnet");
-// define("ENABLED", "java,ls,cd,echo,javac");
-define("ENABLED", false);
-
-//////////////////////////////////////////////////////////////////////////////80
-// Terminal Class
-//////////////////////////////////////////////////////////////////////////////80
-
-class Terminal {
-
-	//////////////////////////////////////////////////////////////////////////80
-	// Constructor
-	//////////////////////////////////////////////////////////////////////////80
-	public function __construct() {
-		if (!isset($_SESSION["activeDir"]) || !isset($_SESSION["activeDir"][$_SESSION["project"]]) || empty($_SESSION["activeDir"][$_SESSION["project"]])) {
-			if (ROOT === "") {
-				$output = Common::raw_execute("pwd");
-				$_SESSION["activeDir"] = array([$_SESSION["project"]] => implode("\n", (array)$output["output"]));
-			} else {
-				$this->changeDir(ROOT);
-			}
-		} else {
-			$this->changeDir($_SESSION["activeDir"][$_SESSION["project"]]);
-		}
-	}
-
-	//////////////////////////////////////////////////////////////////////////80
-	// Primary call
-	//////////////////////////////////////////////////////////////////////////80
-	public function process($str) {
-		$cmd = $this->parseCommand($str);
-		if ($cmd === "") return;
-		$output = Common::raw_execute($cmd);
-		return implode("\n", (array)$output["output"]);
-	}
-
-	//////////////////////////////////////////////////////////////////////////80
-	// Parse command for special functions, blocks
-	//////////////////////////////////////////////////////////////////////////80
-	public function parseCommand($str) {
-
-		// Explode command
-		$command_parts = explode(" ", $str);
-
-		// Handle "cd" command
-		if (in_array("cd", $command_parts)) {
-			$cd_key = array_search("cd", $command_parts);
-			$cd_key++;
-
-			$dir = $command_parts[$cd_key];
-
-			$this->changeDir($dir);
-			// Remove from command
-			$str = str_replace("cd $dir", "", $str);
-		}
-
-		// Replace text editors with cat
-		$editors = array("vim", "vi", "nano");
-		$str = preg_replace("/^(".join("|", $editors).")/", "cat", trim($str));
-
-
-		if (ENABLED) {
-			// Handle enabled commands
-			$enabled = explode(",", ENABLED);
-			if (in_array($command_parts[0], $enabled) === false) {
-				$str = "echo ERROR: Command not allowed";
-			}
-		} else {
-			// Handle blocked commands
-			$blocked = explode(",", BLOCKED === true);
-			if (in_array($command_parts[0], $blocked)) {
-				$str = "echo ERROR: Command not allowed";
-			}
-		}
-
-
-
-		// Update exec command
-		return $str . " 2>&1";
-	}
-
-	//////////////////////////////////////////////////////////////////////////80
-	// Chnage Directory
-	//////////////////////////////////////////////////////////////////////////80
-	public function changeDir($dir) {
-		chdir($dir);
-		// Store new directory
-		$_SESSION["activeDir"][$_SESSION["project"]] = exec("pwd");
-	}
-}
-
-//////////////////////////////////////////////////////////////////////////////80
-// Processing
-//////////////////////////////////////////////////////////////////////////////80
-
-$activeUser = SESSION("user");
-$command = POST("command");
-
-if (strtolower($command === "exit")) {
-	$_SESSION["term_auth"] = false;
-	$output = "[EXIT]";
-
-} else if (!isset($_SESSION["term_auth"]) || $_SESSION["term_auth"] !== true) {
-	if ($command === PASSWORD) {
-		$_SESSION["term_auth"] = true;
-		$output = "[AUTHENTICATED]";
-	} else {
-		$output = "Enter Password:";
-	}
-
-} else {
-	$Terminal = new Terminal();
-	$output = "";
-	$command = explode(" && ", $command);
-	debug($command);
-	foreach ($command as $c) {
-		$output .= $Terminal->process($c);
-		// $output .= implode("\n",$Terminal->process($c));
-	}
-}
-
-$output = array(
-	"data" => htmlentities($output),
-	"dir" => htmlentities(exec("pwd")),
-	"prompt" => "<span class=\"user\">$activeUser</span>:<span class=\"path\">" . exec("pwd") . "</span>$ "
-);
-
-Common::send("success", $output);
-
-?>

patches/helpers-rDelete-GLOB_BRACE.diff

@@ -0,0 +1,22 @@
+--- /var/www/atheos/traits/helpers.php.orig
++++ /var/www/atheos/traits/helpers.php
+@@ -135,7 +135,18 @@
+ 
+         if (is_dir($target)) {
+ 
+-            $files = glob($target . "{*,.[!.]*,..?*}", GLOB_BRACE|GLOB_MARK); //GLOB_MARK adds a slash to directories returned
++            // GLOB_BRACE is a glibc extension and is UNDEFINED under musl (Alpine), where
++            // referencing it is a fatal error in PHP 8. Expand the brace pattern by hand
++            // so this works on both libcs.
++            if (defined("GLOB_BRACE")) {
++                $files = glob($target . "{*,.[!.]*,..?*}", GLOB_BRACE | GLOB_MARK);
++            } else {
++                $files = array_merge(
++                    glob($target . "/*", GLOB_MARK) ?: [],
++                    glob($target . "/.[!.]*", GLOB_MARK) ?: [],
++                    glob($target . "/..?*", GLOB_MARK) ?: []
++                );
++            }
+             // $files = glob($target . "/*");
+ 
+             foreach ($files as $file) {

scripts/build-and-test.sh

@@ -5,9 +5,10 @@
 # ==============================================================================
 W=/var/www/atheos
 B=$W/workspace/blog
-pass=0; fail=0
+pass=0; fail=0; note=0
 ok()   { echo "  PASS  $1"; pass=$((pass+1)); }
 bad()  { echo "  FAIL  $1"; fail=$((fail+1)); }
+note() { echo "  ACCEPTED  $1"; note=$((note+1)); }
 chk()  { if [ "$2" = "$3" ]; then ok "$1 ($2)"; else bad "$1 (got '$2', want '$3')"; fi; }
 asuser() { su -s /bin/sh atheos -c "$1"; }
 
@@ -108,7 +109,63 @@ done
 
 echo
 echo "=============================================================="
-echo "GUARD: is master PROTECTED on the blog repo? (the writer-branch model depends on it)"
+echo "REGRESSION: panel has no hardcoded height (empty-modal bug)"
+echo "=============================================================="
+# panel { height:500px } forced every modal panel to a fixed box: short content left a large
+# empty black region and anything after the panel (codegit's Branch toolbar) was pushed outside
+# the modal. docs/known-issues.md §4. Fails loudly if lost to an update.
+PNL=$(grep -oE '(^|[;}])panel\{[^}]*\}' /var/www/atheos/theme/main.min.css 2>/dev/null | head -1)
+if [ -z "$PNL" ]; then
+  bad "could not read the panel rule from theme/main.min.css"
+elif echo "$PNL" | grep -q 'height:500px'; then
+  bad "panel is fixed at 500px - re-run scripts/fix-panel-layout.sh"
+else
+  ok "panel is content-sized ($(echo "$PNL" | grep -oE 'height:[^;]*' | head -1))"
+fi
+# and the CSS/JS cache header must be present, or fixes stay invisible
+if wget -qO /dev/null --server-response --header='Host: 127.0.0.1' http://127.0.0.1/theme/main.min.css 2>&1 | grep -qi 'Cache-Control.*no-cache'; then
+  ok "theme CSS sends Cache-Control: no-cache (changes are picked up)"
+else
+  bad "theme CSS has no Cache-Control - a CSS fix can stay hidden behind the browser cache"
+fi
+echo
+echo "=============================================================="
+echo "REGRESSION: asset URLs are versioned (cache-busting)"
+echo "=============================================================="
+# Stable asset URLs with no version are why a CSS/JS fix stayed invisible behind the browser cache,
+# in every browser incl. Firefox. docs/known-issues.md §5.
+ASSETS=$(wget -qO /tmp/bt_page.html --header='Host: 127.0.0.1' http://127.0.0.1/ 2>/dev/null; grep -oE '(href|src)="[^"]+\.(css|js)"' /tmp/bt_page.html 2>/dev/null | wc -l | tr -d ' ')
+VER=$(grep -oE '(href|src)="[^"]+\.(css|js)\?v=[0-9]+"' /tmp/bt_page.html 2>/dev/null | wc -l | tr -d ' ')
+if [ "${VER:-0}" -ge 4 ]; then
+  ok "asset URLs are versioned ($VER asset tags carry ?v=)"
+elif [ "${ASSETS:-0}" -eq 0 ]; then
+  note "could not read the served page from the guest (unauthenticated: expected)"
+else
+  bad "only $VER of $ASSETS asset URLs are versioned - a CSS fix can stay hidden in the browser cache"
+fi
+echo "=============================================================="
+echo "REGRESSION: rDelete works (GLOB_BRACE is glibc-only; musl lacks it)"
+echo "=============================================================="
+# That broke deleting ANY file/folder in the editor AND removing a market plugin (the UI
+# would spin forever because the fatal killed the response before Common::send()).
+# docs/known-issues.md §1. This test fails loudly if the patch is lost (e.g. by an update).
+rm -rf /tmp/rdel_guard 2>/dev/null
+if mkdir -p /tmp/rdel_guard/a/b/c /tmp/rdel_guard/.hd 2>/dev/null \
+   && touch /tmp/rdel_guard/f.txt /tmp/rdel_guard/.dot /tmp/rdel_guard/a/b/c/deep.txt; then
+  ROUT=$(php83 -r 'require_once("/var/www/atheos/common.php"); echo Common::rDelete("/tmp/rdel_guard/") ? "ok" : "fail";' 2>&1 | grep -viE 'deprecat|warning|notice' | tail -1)
+  if [ "$ROUT" = "ok" ] && [ ! -e /tmp/rdel_guard ]; then
+    ok "rDelete removed a nested tree incl. dotfiles (delete works)"
+  else
+    if echo "$ROUT" | grep -q 'GLOB_BRACE'; then
+      bad "rDelete FATALS on GLOB_BRACE - re-apply patches/helpers-rDelete-GLOB_BRACE.diff"
+    else
+      bad "rDelete failed (got: $ROUT)"
+    fi
+  fi
+else
+  bad "could not build the rDelete test tree"
+fi
+rm -rf /tmp/rdel_guard 2>/dev/null
 echo "=============================================================="
 # The whole branch-based workflow assumes the deploy key CANNOT push master. That is a
 # repo-side setting we cannot verify from here by inspection - so test it the way an
@@ -120,18 +177,58 @@ else
   if echo "$PUSH_OUT" | grep -qiE 'protected|not allowed|denied|forbidden|remote rejected'; then
     ok "master is protected - the deploy key CANNOT push it"
   else
-    bad "master is NOT protected - the deploy key could push master directly!"
-    echo "        Enable it: armistace/blog -> Settings -> Branches -> add rule for 'master',"
-    echo "        Enable push = OFF, merge whitelist = armistace.  See docs/writer-branch-workflow.md"
+    # ACCEPTED RISK, not a failure. The operator has decided NOT to enable branch protection
+    # while this editor is LAN-only; the control is "it is not reachable off-LAN", not "master
+    # is immutable". So this is reported, not failed - but it is checked on EVERY run, so the
+    # moment protection does go on, the run says so and the recommendation below becomes moot.
+    note "master is NOT protected - the deploy key CAN push master directly"
+    echo "            ACCEPTED because the editor is LAN-only (see docs/writer-branch-workflow.md)."
+    echo "            BECOMES A REAL FINDING THE MOMENT THIS HOST IS REACHABLE OFF-LAN. Before that:"
+    echo "              armistace/blog -> Settings -> Branches -> add rule for 'master'"
+    echo "              Enable push = OFF, merge whitelist = armistace"
   fi
 fi
 
 echo
 echo "=============================================================="
-echo "FR-11 GUARD: agent created NO identity or armistace credential"
+echo "REGRESSION: project path is ABSOLUTE (relative => empty dialogs)"
 echo "=============================================================="
-chk "git user.name empty"  "$(asuser 'git config --get user.name'  2>/dev/null)" ""
-chk "git user.email empty" "$(asuser 'git config --get user.email' 2>/dev/null)" ""
+# A relative project path makes every getWorkspacePath() call fail its access check with 403,
+# which modal.js silently swallows - so CodeGit/Macro/Market/Settings render EMPTY with no error.
+# docs/known-issues.md S6. This is the bug that presented as "just a black box".
+PP=$(php83 -r '
+$raw=@file_get_contents("/var/www/atheos/data/projects.db.json.php");
+if(!$raw) exit;
+preg_match("/<\?php\/\*\|(.*)\|\*\/\?>/s",$raw,$m);
+$d=json_decode($m[1],true);
+if(is_array($d)) echo reset($d);' 2>/dev/null)
+case "$PP" in
+  /*)        ok "projects store holds an absolute path ($PP)" ;;
+  "")        bad "could not read the projects store" ;;
+  *)         bad "projects store holds a RELATIVE path ('$PP') - dialogs will render empty; re-run scripts/fix-project-path.sh" ;;
+esac
+if grep -q 'isAbsPath($projectPath)' /var/www/atheos/common.php 2>/dev/null; then
+  ok "loadState resolves a relative projectPath (heals poisoned sessions)"
+else
+  bad "loadState does NOT resolve relative project paths - re-run scripts/fix-project-path.sh"
+fi
+echo "=============================================================="
+echo "IDENTITY: git identity is SET by the operator (FR-11 superseded by explicit request)"
+echo "=============================================================="
+# FR-11 originally required the agent to leave the identity EMPTY so it could not impersonate
+# the operator. The operator has since explicitly asked for it to be set, so the requirement is
+# superseded - and the guard is inverted: the identity must now be present and must be the
+# OPERATOR's, not an agent-invented one. Guarding the old expectation would assert the opposite
+# of the current design and fail forever (which is what it did).
+NAME=$(asuser 'git config --get user.name'  2>/dev/null)
+MAIL=$(asuser 'git config --get user.email' 2>/dev/null)
+if [ -n "$NAME" ]; then ok "git user.name set ($NAME)"; else bad "git user.name is empty - macro 2 will refuse to commit"; fi
+if [ -n "$MAIL" ]; then ok "git user.email set ($MAIL)"; else bad "git user.email is empty"; fi
+case "$MAIL" in
+  *hermes*|*bot*|*noreply@anthropic*|*agent*) bad "identity looks agent-generated: $MAIL" ;;
+  "") ;;
+  *) ok "identity is an operator address, not an agent-invented one" ;;
+esac
 if [ -f /home/atheos/.ssh/id_ed25519_blog ]; then ok "deploy key present"; else bad "deploy key missing"; fi
 chk "deploy key mode" "$(stat -c '%a' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "600"
 chk "deploy key owner" "$(stat -c '%U' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "atheos"
@@ -157,6 +254,6 @@ echo "  listening ports: $(netstat -tln 2>/dev/null | awk '/LISTEN/{split($4,a,"
 
 echo
 echo "=============================================================="
-printf 'RESULT: %d passed, %d failed\n' "$pass" "$fail"
+printf 'RESULT: %d passed, %d failed, %d accepted-risk\n' "$pass" "$fail" "$note"
 echo "=============================================================="
 [ "$fail" -eq 0 ] || exit 1

scripts/fix-panel-layout.sh

@@ -0,0 +1,111 @@
+#!/bin/sh
+# Re-apply the UI/layout fixes to a rebuilt or updated Atheos tree.
+#
+# Why this exists: Atheos has no releases and `scripts/update-atheos.sh` replaces the whole
+# application directory, so any local patch is lost on update. These are the two that were
+# needed to make the editor usable. Both are IDEMPOTENT - run it as often as you like.
+#
+#   1. panel { height: 500px }      ->  height:auto; max-height:58vh
+#      Every modal panel was forced to a fixed 500px box, so dialogs with short content showed
+#      a large empty black region and anything after the panel (codegit's "Branch:" toolbar)
+#      was pushed OUTSIDE the modal. See docs/known-issues.md §4.
+#
+#   2. nginx: Cache-Control: no-cache for *.css/*.js
+#      Theme/bundle changes were invisible behind the browser cache. §5.
+#
+# Usage:  sh scripts/fix-panel-layout.sh          (run ON the guest, as root)
+set -e
+
+ATH=/var/www/atheos
+CSS=$ATH/theme/main.min.css
+SCSS=$ATH/theme/modules/common/_panel.scss
+NGX=/etc/nginx/http.d/atheos.conf
+
+echo "=== 1. panel layout ==="
+OLD='height:500px;position:relative;border-left:var(--borderLight)'
+NEW='height:auto;max-height:58vh;position:relative;border-left:var(--borderLight)'
+if [ ! -f "$CSS" ]; then
+  echo "  !! $CSS not found - is Atheos installed?"
+elif grep -qF "$NEW" "$CSS"; then
+  echo "  already applied"
+elif grep -qF "$OLD" "$CSS"; then
+  [ -f "$CSS.orig" ] || cp -a "$CSS" "$CSS.orig"
+  php83 -r '$f=$argv[1];$o=$argv[2];$n=$argv[3];$s=file_get_contents($f);
+            if(strpos($s,$o)===false){exit(1);} file_put_contents($f,str_replace($o,$n,$s));' "$CSS" "$OLD" "$NEW"
+  echo "  applied to main.min.css"
+else
+  echo "  !! expected panel rule not found - inspect manually"
+  echo "     (upstream may have changed it; diff against $CSS.orig)"
+fi
+
+# keep the SCSS source consistent so the shipped CSS is not contradicted by the source
+if [ -f "$SCSS" ] && grep -q 'height: 500px;' "$SCSS"; then
+  [ -f "$SCSS.orig" ] || cp -a "$SCSS" "$SCSS.orig"
+  php83 -r '$f=$argv[1];$s=file_get_contents($f);
+            $s=str_replace("height: 500px;","height: auto;\n\tmax-height: 58vh;",$s);
+            file_put_contents($f,$s);' "$SCSS"
+  echo "  synchronised _panel.scss"
+fi
+
+echo "=== 2. nginx cache headers ==="
+if [ ! -f "$NGX" ]; then
+  echo "  !! $NGX not found"
+elif grep -q 'must-revalidate' "$NGX"; then
+  echo "  already applied"
+else
+  [ -f "$NGX.orig" ] || cp -a "$NGX" "$NGX.orig"
+  cat > /tmp/.cacheblock <<'EOF'
+
+    # Atheos serves theme/main.min.css and the generated *.min.js/css bundles from STABLE URLs
+    # with no cache headers, so a CSS/JS fix stays invisible behind the browser cache until a
+    # hard refresh. "no-cache" permits caching but forces revalidation: normal loads still get a
+    # cheap 304, and a change is guaranteed to be picked up on the next load.
+    location ~* \.(css|js)$ {
+        add_header Cache-Control "no-cache, must-revalidate";
+        try_files $uri =404;
+    }
+EOF
+  php83 -r '$f=$argv[1];$b=$argv[2];$s=file_get_contents($f);
+            $p=strrpos($s,"}"); if($p===false){exit(1);}
+            file_put_contents($f,substr($s,0,$p).file_get_contents($b).substr($s,$p));' "$NGX" /tmp/.cacheblock
+  rm -f /tmp/.cacheblock
+  nginx -t >/dev/null 2>&1 && rc-service nginx reload >/dev/null 2>&1 && echo "  applied + nginx reloaded" \
+    || echo "  !! nginx -t failed - restore $NGX.orig"
+fi
+
+echo "=== 3. cache-busting versioned asset URLs ==="
+# Atheos serves theme/main.min.css and the generated bundles from STABLE paths with no version:
+#   <link rel="stylesheet" href="theme/main.min.css">
+# A browser then keeps its cached copy across a change, so a CSS/JS fix appears not to work.
+# Appending each file's mtime means a changed file gets a NEW url (fetched immediately) and an
+# unchanged one keeps its url (stays cached). Better than headers alone: it also defeats a
+# browser cache that was already poisoned before any header was set.
+SM=$ATH/classes/sourcemanager.php
+IX=$ATH/index.php
+if grep -q 'filemtime($path)' "$SM" 2>/dev/null; then
+  echo "  getTag already versioned"
+else
+  [ -f "$SM.orig" ] || cp -a "$SM" "$SM.orig"
+  php83 -r '
+$f=$argv[1]; $s=file_get_contents($f);
+$old = "    function getTag(\$type, \$path) {\n        return \$type === \"css\" ? \"\\t<link rel=\\\"stylesheet\\\" href=\\\"\$path\\\">\\n\": \"\\t<script type=\\\"text/javascript\\\" src=\\\"\$path\\\"></script>\\n\";\n    }";
+if (strpos($s,$old) === false) { fwrite(STDERR, "  !! getTag signature changed - inspect $f\n"); exit(1); }
+$new = "    function getTag(\$type, \$path) {\n        // Version the URL by mtime so a changed asset is fetched immediately instead of being\n        // served from the browser cache (docs/known-issues.md §5).\n        if (file_exists(\$path)) {\n            \$path .= \"?v=\" . filemtime(\$path);\n        }\n        return \$type === \"css\" ? \"\\t<link rel=\\\"stylesheet\\\" href=\\\"\$path\\\">\\n\": \"\\t<script type=\\\"text/javascript\\\" src=\\\"\$path\\\"></script>\\n\";\n    }";
+file_put_contents($f, str_replace($old,$new,$s)); echo "  versioned getTag\n";' "$SM"
+  php83 -l "$SM" >/dev/null 2>&1 || echo "  !! SYNTAX ERROR in $SM - restore $SM.orig"
+fi
+
+if grep -q 'theme/main.min.css?v=' "$IX" 2>/dev/null; then
+  echo "  index.php already versioned"
+else
+  [ -f "$IX.orig" ] || cp -a "$IX" "$IX.orig"
+  php83 -r '
+$f=$argv[1]; $s=file_get_contents($f);
+$old = "    echo(\"\\t<link rel=\\\"stylesheet\\\" href=\\\"theme/main.min.css\\\">\\n\");";
+if (strpos($s,$old) === false) { fwrite(STDERR, "  !! theme echo line changed - inspect $f\n"); exit(1); }
+$new = "    // Version the theme URL by mtime; otherwise a browser keeps its cached copy across a\n    // theme change and the fix appears not to work (docs/known-issues.md §5).\n    \$themeV = file_exists(\"theme/main.min.css\") ? filemtime(\"theme/main.min.css\") : time();\n    echo(\"\\t<link rel=\\\"stylesheet\\\" href=\\\"theme/main.min.css?v=\$themeV\\\">\\n\");";
+file_put_contents($f, str_replace($old,$new,$s)); echo "  versioned index.php theme link\n";' "$IX"
+  php83 -l "$IX" >/dev/null 2>&1 || echo "  !! SYNTAX ERROR in $IX - restore $IX.orig"
+fi
+
+echo "=== done ==="

scripts/fix-project-path.sh

@@ -0,0 +1,70 @@
+#!/bin/sh
+# Fix: dialogs (CodeGit, Macro, Market, Settings) rendered EMPTY.
+#
+# Root cause: the project was registered with a RELATIVE path, and the UI used it verbatim.
+#
+#   1. install/process.php stores a relative folder name:  projects.db -> {"Blog": "blog"}
+#   2. common.php::loadState() does  $projectPath = reset($projectList)  ->  "blog"
+#      and persists it to the session, so the bad value STICKS.
+#   3. filetree puts it straight into the DOM:  <a id="project-root" data-path="blog">
+#   4. codegit sends repo="blog"; getWorkspacePath("blog") fails checkPath() -> 403
+#   5. modal.js does `if (status !== 200) return;` -> SWALLOWS the error -> #content stays empty
+#
+# That last step is why it presents as an empty/black dialog rather than an error: the request
+# fails, nothing is rendered, and nothing is reported.
+#
+# Atheos's own project-creation code resolves relative -> WORKSPACE/<name>, so a relative value in
+# the store is legitimate - loadState() simply fails to resolve it. Both fixes are needed:
+#   A. resolve at load time (this also heals sessions already holding the relative value)
+#   B. store absolute paths, so array_search() can still map path -> name for the tree label
+#
+# Usage: run ON the guest as root.  Idempotent.
+set -e
+A=/var/www/atheos
+
+echo "=== A. resolve a relative projectPath in loadState() ==="
+S=$A/common.php
+if [ ! -f "$S" ]; then echo "  !! $S not found"; exit 1; fi
+if grep -q 'isAbsPath($projectPath)' "$S"; then
+  echo "  already applied"
+else
+  [ -f "$S.orig" ] || cp -a "$S" "$S.orig"
+  php83 -r '
+$f=$argv[1]; $s=file_get_contents($f);
+$old = "        \$openFiles_db = Common::getObjStore(\"activeFiles\", \"users/\" . \$activeUser);";
+if (strpos($s,$old) === false) { fwrite(STDERR,"  !! anchor not found in loadState\n"); exit(1); }
+$new = "        // A project may be registered with a RELATIVE folder name (the installer stores it\n        // that way). Handing that to the UI yields data-path=\"blog\", and every later\n        // getWorkspacePath() call then fails its access check with 403 - which the modal\n        // silently swallows, leaving the dialog empty. Resolve it once here, and re-store it\n        // so sessions already holding the relative value heal on their next load.\n        if (!Common::isAbsPath(\$projectPath)) {\n            \$projectPath = Common::getWorkspacePath(\$projectPath, true);\n            SESSION(\"projectPath\", \$projectPath);\n        }\n\n" . $old;
+file_put_contents($f, str_replace($old,$new,$s)); echo "  patched loadState\n";' "$S"
+  php83 -l "$S" >/dev/null 2>&1 || { echo "  !! SYNTAX ERROR - restore $S.orig"; exit 1; }
+fi
+
+echo "=== B. store absolute paths in the projects store ==="
+P=$A/data/projects.db.json.php
+if [ ! -f "$P" ]; then
+  echo "  !! $P not found"
+elif grep -q '"\/' "$P"; then
+  echo "  already absolute"
+else
+  cp -a "$P" "$P.bak-$(date +%Y%m%d-%H%M%S)"
+  php83 -r '
+$f=$argv[1]; $ws="/var/www/atheos/workspace";
+$raw=file_get_contents($f);
+preg_match("/<\?php\/\*\|(.*)\|\*\/\?>/s",$raw,$m);
+$d=json_decode($m[1],true);
+if(!is_array($d)){ fwrite(STDERR,"  !! store unreadable\n"); exit(1); }
+$c=false;
+foreach($d as $n=>$p){ if(!preg_match("#^(/|[A-Za-z]:)#",$p)){ $d[$n]=$ws."/".ltrim($p,"/"); $c=true; } }
+if(!$c){ echo "  already absolute\n"; exit(0); }
+file_put_contents($f,"<?php/*|\n".json_encode($d, JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES)."\n|*/?>");
+echo "  store rewritten -> ".json_encode($d)."\n";' "$P"
+  chown atheos:atheos "$P" 2>/dev/null || true
+fi
+
+echo "=== verify ==="
+php83 -r '
+$raw=file_get_contents("/var/www/atheos/data/projects.db.json.php");
+preg_match("/<\?php\/\*\|(.*)\|\*\/\?>/s",$raw,$m); $d=json_decode($m[1],true);
+$p=reset($d); $n=array_search($p,$d);
+printf("  path=%s name=%s\n",$p,var_export($n,true));
+printf("  absolute: %s\n", preg_match("#^(/|[A-Za-z]:)#",$p) ? "yes" : "NO");' 2>&1
+echo "=== done ==="