feat: restore v0-style sidebar dropdown + ChatHeader (legendary theme switch)

app/api/chat/route.ts

@@ -13,7 +13,7 @@ import { buildAgentContext } from '@/lib/settings/agent-context'
 import { agentPrompt } from '@/lib/sin/agents'
 import { getSinTools } from '@/lib/sin/mcp'
 import { resolveModel } from '@/lib/sin/models'
-import { guardRequest } from '@/lib/sin/run'
+import { guardRequest } from '@/lib/sin/guard'
 import { SIN_CODE_INSTALL_CMD, SIN_MCP_TOOLS } from '@/lib/sin/tools'
 import { getSession } from '@/lib/session'
 import { getWorkspace, BUILT_IN_WORKSPACES } from '@/lib/workspaces'

app/api/chats/[id]/export/route.ts

@@ -5,7 +5,7 @@
  */
 import { chatToMarkdown } from '@/lib/chat-export'
 import { isValidChatId, listChats, loadMessages } from '@/lib/storage'
-import { guardRequest } from '@/lib/sin/run'
+import { guardRequest } from '@/lib/sin/guard'
 
 export async function GET(
   req: Request,

app/api/chats/[id]/route.ts

@@ -11,7 +11,7 @@ import {
   loadMessages,
   saveMessages,
 } from '@/lib/storage'
-import { guardRequest } from '@/lib/sin/run'
+import { guardRequest } from '@/lib/sin/guard'
 
 type Params = { params: Promise<{ id: string }> }
 

app/api/chats/[id]/share/route.ts

@@ -4,7 +4,7 @@
  * POST   /api/chats/[id]/share — create share, returns public URL slug
  * DELETE /api/chats/[id]/share — revoke share
  */
-import { guardRequest } from '@/lib/sin/run'
+import { guardRequest } from '@/lib/sin/guard'
 import { getSession } from '@/lib/session'
 import { getShareByChatId, shareChat, unshareChat } from '@/lib/shares'
 import { isValidChatId, ownsChat } from '@/lib/storage'

app/api/chats/route.ts

@@ -1,5 +1,5 @@
 import { isValidChatId, listChats, upsertChatMeta } from '@/lib/storage'
-import { guardRequest } from '@/lib/sin/run'
+import { guardRequest } from '@/lib/sin/guard'
 import { getSession } from '@/lib/session'
 
 export async function GET(req: Request) {

app/api/health/route.ts

@@ -4,6 +4,9 @@
  */
 import { isDbConfigured, getPool } from '@/lib/db'
 
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+
 export async function GET() {
   let db: 'ok' | 'error' | 'file' = 'file'
   if (isDbConfigured()) {

app/api/settings/activity/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server"
 import { readActivity, summarize } from "@/lib/settings/activity"
-import { guardRequest } from "@/lib/sin/run"
+import { guardRequest } from "@/lib/sin/guard"
 import { getSession } from "@/lib/session"
 
 export async function GET(req: Request) {

app/api/settings/api-keys/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server"
 import { listApiKeys, createApiKey, revokeApiKey } from "@/lib/settings/api-keys"
-import { guardRequest } from "@/lib/sin/run"
+import { guardRequest } from "@/lib/sin/guard"
 import { getSession } from "@/lib/session"
 
 export async function GET(req: Request) {

app/api/settings/files/route.ts

@@ -6,7 +6,7 @@ import {
   deleteFile,
   type Scope,
 } from "@/lib/settings/store"
-import { guardRequest } from "@/lib/sin/run"
+import { guardRequest } from "@/lib/sin/guard"
 import { getSession } from "@/lib/session"
 
 type Kind = "memories" | "skills"

app/api/settings/mcp/route.ts

@@ -2,7 +2,7 @@ import { NextResponse } from "next/server"
 import { promises as fs } from "fs"
 import path from "path"
 import crypto from "crypto"
-import { guardRequest } from "@/lib/sin/run"
+import { guardRequest } from "@/lib/sin/guard"
 import { getSession } from "@/lib/session"
 
 let _base: string | null = null

app/api/settings/members/route.ts

@@ -6,7 +6,7 @@
 import { NextResponse } from "next/server"
 import { getPool } from "@/lib/db"
 import { isBetterAuthEnabled } from "@/lib/auth/better-auth"
-import { guardRequest } from "@/lib/sin/run"
+import { guardRequest } from "@/lib/sin/guard"
 import { getSession } from "@/lib/session"
 
 async function requireAdmin(req: Request): Promise<Response | null> {

app/api/settings/preferences/route.ts

@@ -4,7 +4,7 @@ import {
   writePreferences,
   DEFAULT_PREFERENCES,
 } from "@/lib/settings/store"
-import { guardRequest } from "@/lib/sin/run"
+import { guardRequest } from "@/lib/sin/guard"
 import { getSession } from "@/lib/session"
 
 export async function GET(req: Request) {

app/api/settings/workspace/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from "next/server"
 import { promises as fs } from "fs"
 import path from "path"
-import { guardRequest } from "@/lib/sin/run"
+import { guardRequest } from "@/lib/sin/guard"
 import { getSession } from "@/lib/session"
 
 let _base: string | null = null

app/api/sin/orchestrator/stream/route.ts

@@ -3,19 +3,19 @@
  * GET /api/sin/orchestrator/stream?task=…
  * Emits: event "line" per stdout line, event "done" with exit code,
  *        event "error" on failure.
+ *
+ * The actual spawn() lives in lib/sin/orchestrator-stream.ts and is
+ * dynamically imported so the NFT tracer never sees child_process at
+ * the route boundary (#59 / #60).
  */
-import { guardRequest } from '@/lib/sin/run'
+import { guardRequest } from '@/lib/sin/guard'
 
-export const dynamic = "force-dynamic"
-export const runtime = "nodejs"
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
 export const maxDuration = 300
 
 const SAFE_TOKEN = /^[\w@./:=,\- ?!]{1,512}$/
 
-function sse(event: string, data: unknown): string {
-  return `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`
-}
-
 export async function GET(req: Request) {
   const guard = await guardRequest(req, 'orchestrator-stream', 3, 60_000)
   if (guard) return guard
@@ -25,71 +25,6 @@ export async function GET(req: Request) {
     return Response.json({ ok: false, error: 'invalid task' }, { status: 400 })
   }
 
-  const encoder = new TextEncoder()
-  const bin = process.env.SIN_CODE_BIN || 'sin-code'
-  const { spawn } = await import('node:child_process')
-
-  const stream = new ReadableStream<Uint8Array>({
-    start(controller) {
-      const child = spawn(bin, ['orchestrator-run', task], {
-        timeout: 280_000,
-      })
-
-      let buffer = ''
-      const pushLines = (chunk: Buffer) => {
-        buffer += chunk.toString()
-        const lines = buffer.split('\n')
-        buffer = lines.pop() ?? ''
-        for (const line of lines) {
-          if (line.trim()) {
-            controller.enqueue(encoder.encode(sse('line', { line })))
-          }
-        }
-      }
-
-      child.stdout.on('data', pushLines)
-      child.stderr.on('data', pushLines)
-
-      child.on('error', (err) => {
-        const e = err as NodeJS.ErrnoException
-        controller.enqueue(
-          encoder.encode(
-            sse('error', {
-              error:
-                e.code === 'ENOENT'
-                  ? 'sin-code binary not installed'
-                  : e.message,
-            }),
-          ),
-        )
-        controller.close()
-      })
-
-      child.on('close', (code) => {
-        if (buffer.trim()) {
-          controller.enqueue(encoder.encode(sse('line', { line: buffer })))
-        }
-        controller.enqueue(encoder.encode(sse('done', { exitCode: code })))
-        controller.close()
-      })
-
-      req.signal.addEventListener('abort', () => {
-        child.kill('SIGTERM')
-      })
-    },
-  })
-
-  return new Response(stream, {
-    headers: {
-      'Content-Type': 'text/event-stream',
-      'Cache-Control': 'no-cache, no-transform',
-      Connection: 'keep-alive',
-    },
-  })
-}
-
-export async function POST(req: Request) {
-  const { task } = await req.json()
-  const { runOrchestratorStream } = await import("@/lib/sin/orchestrator-runner")
-  return runOrchestratorStream(task)
+  const { runOrchestratorStream } = await import('@/lib/sin/orchestrator-stream')
+  return await runOrchestratorStream(task, req.signal)
 }

app/api/workspace/deploy/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from "next/server"
 import { isVercelConfigured } from "@/lib/vercel/client"
 import { createDeployment, getDeploymentStatus } from "@/lib/vercel/deploy"
-import { guardRequest } from "@/lib/sin/run"
+import { guardRequest } from "@/lib/sin/guard"
 
 export const maxDuration = 300
 

app/api/workspace/deployments/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server"
 import { listDeployments } from "@/lib/vercel/deploy"
-import { guardRequest } from "@/lib/sin/run"
+import { guardRequest } from "@/lib/sin/guard"
 
 export async function GET(req: Request) {
   const guard = await guardRequest(req, "deploy", 60)

app/api/workspace/design-edit/route.ts

@@ -1,80 +1,28 @@
-import { NextResponse } from "next/server"
-import { promises as fs } from "fs"
-import path from "path"
-import { pushEntry } from "@/lib/workspace/design-history"
+import { NextResponse } from 'next/server'
 
-let _root: string | null = null
-// @turbopack-disable-next-line
-function root(): string {
-  if (!_root) _root = /*turbopackIgnore: true*/ (process.env.SIN_WORKSPACE_DIR ?? process.cwd())
-  return _root
-}
-
-function safeResolve(rel: string): string {
-  const resolved = /*turbopackIgnore: true*/ path.resolve(root(), "." + path.sep + rel)
-  if (!resolved.startsWith(root())) throw new Error("Invalid path")
-  return resolved
-}
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
 
 export async function POST(req: Request) {
   const { loc, oldClasses, newClasses } = await req.json()
 
-  if (typeof oldClasses !== "string" || typeof newClasses !== "string") {
-    return NextResponse.json({ error: "oldClasses and newClasses required" }, { status: 400 })
+  if (typeof oldClasses !== 'string' || typeof newClasses !== 'string') {
+    return NextResponse.json({ error: 'oldClasses and newClasses required' }, { status: 400 })
   }
-  if (typeof loc !== "string" || !loc.includes(":")) {
+  if (typeof loc !== 'string' || !loc.includes(':')) {
     return NextResponse.json(
-      { error: "loc required (file:line). Add data-sin-loc attributes to your dev build." },
+      { error: 'loc required (file:line). Add data-sin-loc attributes to your dev build.' },
       { status: 400 },
     )
   }
 
-  const [file, lineStr] = loc.split(":")
-  const lineNo = parseInt(lineStr, 10)
+  // Dynamic import keeps fs/path/cwd out of the route boundary the NFT
+  // tracer inspects — this is what finally clears the warning (#59).
+  const { applyClassEdit } = await import('@/lib/workspace/design-edit-fs')
+  const result = await applyClassEdit(loc, oldClasses, newClasses)
 
-  let abs: string
-  try {
-    abs = safeResolve(file)
-  } catch {
-    return NextResponse.json({ error: "Invalid path" }, { status: 400 })
+  if (!result.ok) {
+    return NextResponse.json({ error: result.error }, { status: result.status })
   }
-
-  let content: string
-  try {
-    content = await /*turbopackIgnore: true*/ fs.readFile(abs, "utf8")
-  } catch {
-    return NextResponse.json({ error: "File not found" }, { status: 404 })
-  }
-
-  const lines = content.split("\n")
-  const from = Math.max(0, lineNo - 3)
-  const to = Math.min(lines.length, lineNo + 5)
-  let patched = false
-
-  for (let i = from; i < to; i++) {
-    if (lines[i].includes(oldClasses)) {
-      lines[i] = lines[i].replace(oldClasses, newClasses)
-      patched = true
-      break
-    }
-  }
-
-  if (!patched) {
-    return NextResponse.json(
-      { error: "Could not locate the class string near the reported line." },
-      { status: 409 },
-    )
-  }
-
-  await /*turbopackIgnore: true*/ fs.writeFile(abs, lines.join("\n"), "utf8")
-  const relativeFilePath = file
-  const tagName = "div" // or get from the request context
-  await pushEntry({
-    file: relativeFilePath,
-    line: lineNo,
-    oldValue: oldClasses,
-    newValue: newClasses,
-    description: `Changed ${tagName} class to '${newClasses.slice(0, 60)}'`,
-  })
-  return NextResponse.json({ ok: true, file, line: lineNo })
+  return NextResponse.json({ ok: true, file: result.file, line: result.line })
 }