@appsoftwareltd/etherpk-mcp 0.8.0 → 0.8.1

package/dist/main.js

@@ -3,7 +3,7 @@ import { createInterface } from "node:readline/promises";
 import { availableParallelism, homedir, hostname, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
-import { access, chmod, mkdir, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { access, chmod, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { x25519 } from "@noble/curves/ed25519.js";
 import "@noble/hashes/argon2.js";
@@ -29,9 +29,12 @@ import { languages } from "@codemirror/language-data";
 import MarkdownIt from "markdown-it";
 import katex from "katex";
 import Mustache from "mustache";
+import { lookup } from "node:dns";
+import { request } from "node:https";
+import { BlockList, isIP } from "node:net";
 var package_default = {
 	name: "@appsoftwareltd/etherpk-mcp",
-	version: "0.8.0",
+	version: "0.8.1",
 	license: "Elastic-2.0",
 	description: "EtherPK Headless Client: an MCP server over a synced knowledge graph, run beside the agent on the user's own machine.",
 	type: "module",
@@ -52,20 +55,20 @@ var package_default = {
 		"@huggingface/tokenizers": "0.2.0",
 		"@lezer/highlight": "^1.2.3",
 		"@lezer/markdown": "^1.6.4",
-		"@modelcontextprotocol/sdk": "^1.30.0",
-		"@noble/curves": "^2.2.0",
-		"@noble/hashes": "^2.2.0",
+		"@modelcontextprotocol/sdk": "1.30.0",
+		"@noble/curves": "2.2.0",
+		"@noble/hashes": "2.2.0",
 		"@sqlite.org/sqlite-wasm": "3.53.0-build1",
 		"fake-indexeddb": "^6.2.5",
 		"katex": "^0.17.0",
-		"lib0": "^0.2.117",
+		"lib0": "0.2.117",
 		"markdown-it": "15.0.2",
 		"mermaid": "^11.16.1",
 		"mustache": "4.2.0",
 		"playwright-core": "1.59.1",
-		"y-protocols": "^1.0.7",
+		"y-protocols": "1.0.7",
 		"yaml": "^2.9.0",
-		"yjs": "^13.6.31",
+		"yjs": "13.6.31",
 		"zod": "^4.3.6"
 	},
 	devDependencies: {
@@ -3926,7 +3929,7 @@ function indexFile(dir) {
 function vectorsFile(dir) {
 	return join(dir, VECTORS_FILE_NAME);
 }
-function request(req) {
+function request$1(req) {
 	return new Promise((resolve, reject) => {
 		req.onsuccess = () => resolve(req.result);
 		req.onerror = () => reject(req.error);
@@ -3941,7 +3944,7 @@ function done(tx) {
 }
 /** Open the cache database the sync engine already created; never creates or upgrades it. */
 async function openCacheDb() {
-	const db = await request(indexedDB.open(CACHE_DB, CACHE_DB_VERSION));
+	const db = await request$1(indexedDB.open(CACHE_DB, CACHE_DB_VERSION));
 	for (const store of CACHE_STORES) if (!db.objectStoreNames.contains(store)) {
 		db.close();
 		throw new Error(`Local Cache database has no "${store}" store; open the graph cache before restoring it.`);
@@ -3979,7 +3982,7 @@ async function captureLocalCache(graphId) {
 	try {
 		const tx = db.transaction([...CACHE_STORES], "readonly");
 		const rows = {};
-		for (const store of CACHE_STORES) rows[store] = (await request(tx.objectStore(store).getAll())).filter((row) => row.graphId === graphId).map(withStandaloneBuffers);
+		for (const store of CACHE_STORES) rows[store] = (await request$1(tx.objectStore(store).getAll())).filter((row) => row.graphId === graphId).map(withStandaloneBuffers);
 		await done(tx);
 		return {
 			version: CACHE_DB_VERSION,
@@ -9003,6 +9006,32 @@ function assetHashFromName(fileName) {
 		ext: (match[3] ?? "").toLowerCase()
 	};
 }
+/**
+* Whether a decoded asset name is one file inside `assets/`, and so safe to join onto a folder.
+*
+* An asset reference comes from a document, and a document can come from a collaborator, an
+* import or an agent, so the name it decodes to is untrusted: `../assets/..%2Fpages%2FSecret.md`
+* decodes to a path that leaves `assets/`. Every place that turns a reference into a file path
+* (the asset stores, the publisher's bundle) checks this first, before any directory adapter
+* or site writer sees the name.
+*/
+function isSafeAssetName(name) {
+	if (!isSingleFileName(name)) return false;
+	for (const char of name) {
+		const code = char.codePointAt(0) ?? 0;
+		if (code < 32 || code === 127) return false;
+	}
+	return true;
+}
+/**
+* Whether `name` is one entry of a directory rather than a path: not empty, not `.` or `..`, and
+* free of separators and NUL. What a directory adapter requires of every name it is handed, which
+* is looser than {@link isSafeAssetName}: a file already on disk may carry other odd characters.
+*/
+function isSingleFileName(name) {
+	if (name === "" || name === "." || name === "..") return false;
+	return !name.includes("/") && !name.includes("\\") && !name.includes("\0");
+}
 //#endregion
 //#region ../client/src/lib/storage/fs/asset-store.ts
 /**
@@ -9103,11 +9132,22 @@ var MIME_TYPES = {
 function mimeTypeForExt(ext) {
 	return MIME_TYPES[ext.replace(/^\./, "").toLowerCase()] ?? "";
 }
-/** The on-disk name referenced by a doc-relative asset ref, or `null` if `ref` is not an asset reference. */
+/**
+* The on-disk name referenced by a doc-relative asset ref, or `null` if `ref` is not an asset
+* reference. A reference whose name decodes to anything but one file inside `assets/`, or does not
+* decode at all, is not one: it can never name a file on disk (see `isSafeAssetName`).
+*/
 function assetNameFromRef(ref) {
 	const clean = ref.split(/[?#]/)[0];
 	const match = ASSET_REF$1.exec(clean);
-	return match ? decodeURIComponent(match[1]) : null;
+	if (!match) return null;
+	let name;
+	try {
+		name = decodeURIComponent(match[1]);
+	} catch {
+		return null;
+	}
+	return isSafeAssetName(name) ? name : null;
 }
 /**
 * The markdown to embed a saved asset: an inline image, or a plain link that downloads on click.
@@ -11854,6 +11894,16 @@ function isTransient(error) {
 function kebabStem(name) {
 	return name.replace(/\.[^.]+$/, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "asset";
 }
+/**
+* The MIME type a downloaded asset is given: its extension's, from the same short list the
+* Filesystem Backend uses, or `application/octet-stream`. Never the type recorded in the asset's
+* metadata, which is whatever the uploader's client sent: a collaborator could type an asset
+* `text/html`, and a blob opened in its own tab would then be a same-origin HTML document. The
+* extension is the reference's, the one the viewers are chosen by.
+*/
+function assetTypeFor(ref) {
+	return mimeTypeForExt(extOf(ref)) || "application/octet-stream";
+}
 function extOf(name) {
 	const m = /\.([^.]+)$/.exec(name);
 	return m ? m[1].toLowerCase() : "bin";
@@ -11947,7 +11997,7 @@ function createServerAssetStore(deps) {
 		return {
 			bytes: joined,
 			name: metadata.name,
-			type: metadata.type
+			type: assetTypeFor(ref)
 		};
 	}
 	return {
@@ -13815,15 +13865,22 @@ function wikilinkRule(md, resolve) {
 */
 /** A document-relative asset reference: any number of `../`, `assets/`, the name. */
 var ASSET_REF = /^(?:\.\.\/)*assets\/(.+)$/;
+/**
+* The asset a reference names, decoded, or null when it names none. A name that decodes to
+* anything but one file inside `assets/` is not an asset: it would become a bundle path, and a site
+* folder, outside `assets/` (see `isSafeAssetName`). The link is then left as the author wrote it.
+*/
 function assetNameOf(ref) {
 	const match = ASSET_REF.exec(ref);
 	if (!match) return null;
 	const raw = match[1].split(/[?#]/)[0];
+	let name;
 	try {
-		return decodeURIComponent(raw);
+		name = decodeURIComponent(raw);
 	} catch {
-		return raw;
+		name = raw;
 	}
+	return isSafeAssetName(name) ? name : null;
 }
 function escapeHtml$3(text) {
 	return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
@@ -14031,7 +14088,7 @@ function linkTargetPattern(excluded = "") {
 * A regex may not repeat a group name, so compose this **once** per pattern. Wrap it in a group of
 * your own where you need the whole link as one capture.
 */
-var MARKDOWN_LINK = `(?<bang>!?)\\[(?<label>[^\\]]*)\\]\\((?<target>${linkTargetPattern()})\\)`;
+var MARKDOWN_LINK = `(?<bang>!?)\\[(?<label>(?:[^\\[\\]]|\\[[^\\[\\]]*\\])*)\\]\\((?<target>${linkTargetPattern()})\\)`;
 /** A match's groups, typed. Every {@link MARKDOWN_LINK} match has all three. */
 function linkGroups(match) {
 	return match.groups;
@@ -14133,6 +14190,24 @@ function contentOf(block) {
 	return first.replace(/^-\s+/, "").trim();
 }
 var WHOLE_LINK = new RegExp(`^${MARKDOWN_LINK}$`);
+/** The schemes an outline link may carry onto a published page; a target with no scheme is a path on the site. */
+var NAV_LINK_SCHEMES = new Set([
+	"http",
+	"https",
+	"mailto"
+]);
+/**
+* An outline link's target, or null when a published page must not carry it. Links in page bodies
+* go through markdown-it's validateLink; the outline is parsed here, so it gets its own rule. The
+* scheme is read after removing the control characters and spaces a browser would ignore, so
+* '\u0001javascript:' is read as javascript.
+*/
+function navLinkTarget(target) {
+	const visible = [...target].filter((c) => c.charCodeAt(0) > 32 && c.charCodeAt(0) !== 127).join("");
+	const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(visible);
+	if (!scheme) return target;
+	return NAV_LINK_SCHEMES.has(scheme[1].toLowerCase()) ? target : null;
+}
 function buildNav(outline, resolver) {
 	const issues = [];
 	function convert(blocks) {
@@ -14166,10 +14241,24 @@ function buildNav(outline, resolver) {
 				const link = WHOLE_LINK.exec(content);
 				if (link && !linkGroups(link).bang) {
 					const { label, target } = linkGroups(link);
+					const href = navLinkTarget(target);
+					if (href === null) {
+						issues.push({
+							level: "warning",
+							code: "nav-link-unsafe",
+							message: `The navigation links "${label}" to a target a published page does not carry (only http, https, mailto and site paths); the entry is shown without its link.`
+						});
+						out.push({
+							label,
+							labelHtml: escapeHtml$1(label),
+							children
+						});
+						continue;
+					}
 					out.push({
 						label,
 						labelHtml: escapeHtml$1(label),
-						href: target,
+						href,
 						external: true,
 						children
 					});
@@ -14781,7 +14870,7 @@ async function publishPublication(source, publication, env, options = {}) {
 	let assetsDone = 0;
 	for (const [name, from] of wanted) {
 		progress("assets", assetsDone++, wanted.size);
-		const asset = await source.readAsset(`../assets/${name}`);
+		const asset = await source.readAsset(`../assets/${encodeURIComponent(name)}`);
 		if (!asset) {
 			report.assets.missing.push({
 				name,
@@ -14931,6 +15020,8 @@ function themeFilesOfBundled(theme) {
 		files
 	};
 }
+/** Far more files than any theme uses, and a bound on the fetches one publish can trigger. */
+var MAX_URL_THEME_FILES = 500;
 /** Fetch a theme from its manifest URL; every file the manifest lists, relative to it. */
 async function fetchTheme(url, fetchText) {
 	let json;
@@ -14942,10 +15033,12 @@ async function fetchTheme(url, fetchText) {
 	const { manifest, errors } = parseThemeManifest(json);
 	if (!manifest) throw new Error(`The theme at ${url} cannot be used: ${errors.join(" ")}`);
 	if (manifest.files.length === 0) throw new Error(`The theme at ${url} lists no files in its manifest, so nothing can be fetched.`);
+	if (manifest.files.length > MAX_URL_THEME_FILES) throw new Error(`The theme at ${url} lists ${manifest.files.length} files; a theme may list at most ${MAX_URL_THEME_FILES}.`);
 	const base = new URL(url);
 	const files = /* @__PURE__ */ new Map();
 	for (const path of manifest.files) {
 		const fileUrl = new URL(path, base).toString();
+		if (!isThemeFilePath(path) || new URL(fileUrl).origin !== base.origin) throw new Error(`The theme at ${url} lists "${path}", which is not a theme file beside its manifest (layouts/, partials/ or assets/).`);
 		try {
 			files.set(path, await fetchText(fileUrl));
 		} catch (error) {
@@ -15277,6 +15370,150 @@ async function openDiagramRenderer(env) {
 	};
 }
 //#endregion
+//#region src/public-fetch.ts
+/**
+* Fetching text from the public internet, and nowhere else: the only network reads a tool makes
+* with an address it did not choose itself (a theme published at a URL, and every file its
+* manifest lists). The URL comes from a document or a tool argument, so a collaborator or a
+* prompt-injected agent could otherwise point this process at a service on the local machine or
+* the network it sits on, and read the answer back through `read_theme_file`.
+*
+* The rules: https only, no credentials in the URL, every address the host resolves to must be
+* public, redirects are followed by hand and each hop checked the same way, and a response is cut
+* off by a deadline and a size cap. The address check runs inside the socket's own DNS lookup, so
+* the address connected to is the address checked; resolving first and connecting afterwards
+* would let a second resolution answer differently.
+*/
+/** Ranges no theme is served from: loopback, private, link-local, shared, reserved, documentation, multicast. */
+var blocked = new BlockList();
+for (const [network, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.0.2.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["198.51.100.0", 24],
+	["203.0.113.0", 24],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) blocked.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+	["::", 128],
+	["::1", 128],
+	["64:ff9b::", 96],
+	["100::", 64],
+	["2001:db8::", 32],
+	["fc00::", 7],
+	["fe80::", 10],
+	["ff00::", 8]
+]) blocked.addSubnet(network, prefix, "ipv6");
+/** Whether an IP address is one on the public internet. Anything that is not an address is not. */
+function isPublicAddress(address) {
+	const family = isIP(address);
+	if (family === 4) return !blocked.check(address, "ipv4");
+	if (family !== 6) return false;
+	const dotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(address);
+	if (dotted) return isPublicAddress(dotted[1]);
+	const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(address);
+	if (hex) {
+		const [high, low] = [parseInt(hex[1], 16), parseInt(hex[2], 16)];
+		return isPublicAddress(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
+	}
+	return !blocked.check(address, "ipv6");
+}
+var DEFAULT_TIMEOUT_MS = 15e3;
+/** Far above any real theme file, and a bound on what one response can hold in memory. */
+var DEFAULT_MAX_BYTES = 2 * 1024 * 1024;
+var DEFAULT_MAX_REDIRECTS = 3;
+var NotPublicError = class extends Error {
+	code = "ENOTPUBLIC";
+};
+/** A lookup that answers only when every address the name resolves to is public. */
+function publicOnly(lookup) {
+	return (hostname, options, callback) => {
+		lookup(hostname, { all: true }, (error, addresses) => {
+			if (error) return callback(error);
+			const refused = addresses.find((entry) => !isPublicAddress(entry.address));
+			if (refused || addresses.length === 0) return callback(new NotPublicError(`${hostname} resolves to ${refused?.address ?? "no address"}, which is not a public address.`));
+			if (options.all) callback(null, addresses);
+			else callback(null, addresses[0].address, addresses[0].family);
+		});
+	};
+}
+function checkUrl(url) {
+	if (url.protocol !== "https:") throw new Error(`Only https URLs can be fetched, not ${url.protocol}//${url.host}.`);
+	if (url.username || url.password) throw new Error("A URL with credentials in it cannot be fetched.");
+}
+function fetchOnce(url, deps, deadline) {
+	return new Promise((resolve, reject) => {
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) return reject(/* @__PURE__ */ new Error(`Fetching ${url.href} took longer than ${deps.timeoutMs / 1e3} seconds.`));
+		const req = deps.request(url, {
+			method: "GET",
+			lookup: publicOnly(deps.lookup),
+			headers: {
+				accept: "*/*",
+				"user-agent": "etherpk-mcp"
+			}
+		}, (res) => {
+			const status = res.statusCode ?? 0;
+			if (status >= 300 && status < 400 && res.headers.location) {
+				res.resume();
+				return resolve({ redirect: new URL(res.headers.location, url) });
+			}
+			if (status < 200 || status >= 300) {
+				res.resume();
+				return reject(new Error(`${status} ${res.statusMessage ?? ""}`.trim()));
+			}
+			const chunks = [];
+			let size = 0;
+			res.on("data", (chunk) => {
+				size += chunk.byteLength;
+				if (size > deps.maxBytes) {
+					req.destroy(/* @__PURE__ */ new Error(`${url.href} is larger than ${deps.maxBytes} bytes.`));
+					return;
+				}
+				chunks.push(chunk);
+			});
+			res.on("end", () => {
+				clearTimeout(timer);
+				if (size <= deps.maxBytes) resolve({ text: Buffer.concat(chunks).toString("utf8") });
+			});
+			res.on("error", reject);
+		});
+		const timer = setTimeout(() => req.destroy(/* @__PURE__ */ new Error(`Fetching ${url.href} took longer than ${deps.timeoutMs / 1e3} seconds.`)), remaining);
+		req.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+		req.end();
+	});
+}
+/** The text at a public https URL, under the rules at the top of this module. */
+async function fetchPublicText(href, options = {}) {
+	const deps = {
+		lookup: options.lookup ?? lookup,
+		request: options.request ?? request,
+		timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+		maxBytes: options.maxBytes ?? DEFAULT_MAX_BYTES,
+		maxRedirects: options.maxRedirects ?? DEFAULT_MAX_REDIRECTS
+	};
+	const deadline = Date.now() + deps.timeoutMs;
+	let url = new URL(href);
+	for (let hops = 0;; hops += 1) {
+		checkUrl(url);
+		const hop = await fetchOnce(url, deps, deadline);
+		if ("text" in hop) return hop.text;
+		if (hops >= deps.maxRedirects) throw new Error(`${href} redirected more than ${deps.maxRedirects} times.`);
+		url = hop.redirect;
+	}
+}
+//#endregion
 //#region src/publish-environment.ts
 /**
 * The publisher's environment in Node (ADR 0082, ADR 0084): themes resolved the way the Client
@@ -15286,11 +15523,8 @@ async function openDiagramRenderer(env) {
 * counterpart of `host/browser-environment.ts`; the core is shared.
 */
 var require = createRequire(import.meta.url);
-async function fetchText$1(url) {
-	const response = await fetch(url);
-	if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
-	return response.text();
-}
+/** A url theme's files, from public https hosts only (see public-fetch.ts). */
+var fetchText$1 = (url) => fetchPublicText(url);
 var katexAssetsPromise = null;
 /** `katex.min.css` plus its woff2 fonts under `fonts/`, as the stylesheet references them. */
 async function katexAssets() {
@@ -15445,6 +15679,56 @@ function withPublishFolder(folders, graphKey, publicationId, folder) {
 	} };
 }
 //#endregion
+//#region src/local-folders.ts
+/**
+* Where the tools may write on this machine. A tool argument is chosen by the agent, and the agent
+* can be steered by what it reads in the notes, so a folder it names is only ever a place under
+* the graph's downloads directory (ADR 0086 keeps even that choice from `publish`). A name that
+* resolves outside it, directly or through a symbolic link, is refused.
+*/
+/** A folder the agent named that is not under the base; the tools report it as `invalid_argument`. */
+var FolderRefused = class extends Error {};
+/** Whether `child` is `parent` or a path beneath it; both already resolved. */
+function within(parent, child) {
+	return child === parent || child.startsWith(parent.endsWith(sep) ? parent : parent + sep);
+}
+/** The nearest part of `path` that exists on disk: the path itself, or its closest existing parent. */
+async function existingPart(path) {
+	let at = path;
+	for (;;) try {
+		await lstat(at);
+		return at;
+	} catch {
+		const up = dirname(at);
+		if (up === at) return at;
+		at = up;
+	}
+}
+/**
+* The folder the agent asked for under `base`, or `fallback` (a path relative to `base`) when it
+* named none. A relative name is taken relative to `base`; an absolute one must already be under
+* it. Checked twice: as written, and after resolving every symbolic link in the part that exists.
+*/
+async function folderUnder(base, requested, fallback) {
+	const root = resolve(base);
+	const wanted = requested?.trim() ? requested.trim() : fallback;
+	const target = resolve(root, wanted);
+	if (!within(root, target)) throw new FolderRefused(`"${wanted}" is outside ${root}. Name a folder under it, or leave it out for the default.`);
+	await mkdir(root, { recursive: true });
+	if (!within(await realpath(root), await realpath(await existingPart(target)))) throw new FolderRefused(`"${wanted}" leads outside ${root} through a symbolic link.`);
+	return target;
+}
+/**
+* Whether a preview page may load `url`: its own files and inline data, nothing else. A theme's
+* script runs when the preview is photographed, and a theme can come from a collaborator or a URL,
+* so the page is kept off the network and away from the rest of the disk.
+*/
+function previewRequestAllowed(url, folder) {
+	if (url.startsWith("data:") || url.startsWith("blob:") || url === "about:blank") return true;
+	const own = pathToFileURL(folder.endsWith(sep) ? folder : folder + sep).href;
+	return url.startsWith(own);
+}
+//#endregion
 //#region src/headless-assets.ts
 /**
 * What the asset tools need from a graph's [[Asset]]s, behind one seam for both backends
@@ -15455,9 +15739,46 @@ function withPublishFolder(folders, graphKey, publicationId, folder) {
 * reference names an asset (`identify`), which is what the index is asked about when the tools
 * decide whether an asset is reachable from a document the agent can read.
 */
-/** A local file as `upload_asset` reads it. */
-async function readLocalFile(path) {
-	const buffer = await readFile(path);
+/**
+* The largest file `upload_asset` reads. The Sync Server applies its own, usually smaller, limit;
+* this one bounds what a single call can pull into memory whatever the backend.
+*/
+var MAX_UPLOAD_BYTES = 100 * 1024 * 1024;
+async function realOrResolved(path) {
+	try {
+		return await realpath(path);
+	} catch {
+		return resolve(path);
+	}
+}
+/**
+* Refuse a file an agent should not be able to put into a graph. The path is a tool argument, and
+* an agent can be steered by what it reads, so an upload is a way to copy a local file somewhere
+* collaborators can read it. Refused: the Headless Client's cache (the graph's decrypted
+* contents) and config (sign-in tokens), and anything hidden (a dot-file, or a file inside a
+* dot-folder such as `.ssh` or `.aws`), which is where credentials and settings live. `real` has
+* every link resolved, so a link is judged by the file it leads to.
+*/
+async function refuseProtected(path, real, rules) {
+	if (within(await realOrResolved(rules.downloadsDir), real)) return;
+	if (within(await realOrResolved(cacheRoot(rules.env)), real)) throw new Error(`${path} is in the Headless Client's cache, which holds the graph's decrypted contents.`);
+	const configFile = await realOrResolved(defaultConfigPath(rules.env));
+	const configDir = await realOrResolved(dirname(defaultConfigPath({
+		...rules.env,
+		ETHERPK_MCP_CONFIG: void 0
+	})));
+	if (real === configFile || within(configDir, real)) throw new Error(`${path} is the Headless Client's config, which holds its sign-in tokens.`);
+	const hidden = real.split(sep).find((part) => part.startsWith("."));
+	if (hidden) throw new Error(`${path} is hidden (${hidden}), where credentials and settings are kept. Copy it to an ordinary folder to upload it.`);
+}
+/** A local file as `upload_asset` reads it: an ordinary file, not refused above, within the size limit. */
+async function readLocalFile(path, rules) {
+	const real = await realpath(path);
+	await refuseProtected(path, real, rules);
+	const info = await stat(real);
+	if (!info.isFile()) throw new Error(`${path} is not a file.`);
+	if (info.size > 104857600) throw new Error(`${path} is larger than ${MAX_UPLOAD_BYTES / (1024 * 1024)} MiB.`);
+	const buffer = await readFile(real);
 	const bytes = new Uint8Array(new ArrayBuffer(buffer.byteLength));
 	bytes.set(buffer);
 	return {
@@ -15465,24 +15786,54 @@ async function readLocalFile(path) {
 		bytes
 	};
 }
-/**
-* Write an asset's bytes under `directory` as `name`, never over a different file of the same
-* name: a second asset that happens to share a display name lands beside it with a suffix, so
-* an agent reading two `diagram.png`s from two pages gets both.
+/** Names Windows reserves for devices, whatever the extension. */
+var RESERVED = /^(con|prn|aux|nul|com\d|lpt\d)$/i;
+var MAX_NAME_LENGTH = 120;
+/**
+* A file name for an asset's stored name. The stored name is metadata any collaborator can set,
+* so it is reduced to one plain file: the last path segment, letters, digits, marks, spaces and
+* `. _ - ( )` kept and everything else replaced, no leading dot (so never hidden, never `..`),
+* no trailing dot or space (Windows drops them), not a Windows device name, and short.
+*/
+function downloadName(name) {
+	let safe = (name.split(/[\\/]/).pop() ?? "").replace(/[^\p{L}\p{M}\p{N} ._()-]/gu, "_").replace(/^[.\s]+/, "").replace(/[.\s]+$/, "");
+	if (safe === "") return "asset";
+	if (RESERVED.test(safe.split(".")[0])) safe = `_${safe}`;
+	if (Array.from(safe).length <= MAX_NAME_LENGTH) return safe;
+	const dot = safe.lastIndexOf(".");
+	const ext = dot > 0 && safe.length - dot <= 20 ? safe.slice(dot) : "";
+	return Array.from(safe.slice(0, safe.length - ext.length)).slice(0, MAX_NAME_LENGTH - ext.length).join("") + ext;
+}
+/** Whether `path` is an ordinary file (not a link) holding exactly `bytes`. */
+async function holds(path, bytes) {
+	const info = await lstat(path);
+	if (!info.isFile() || info.size !== bytes.byteLength) return false;
+	return (await readFile(path)).equals(bytes);
+}
+/**
+* Write an asset's bytes under `directory`, named by {@link downloadName}, and never over
+* anything already there: the write fails rather than replace a file or follow a link left in
+* its place, and the next candidate is tried. A second asset that shares a display name lands
+* beside the first with a suffix, so an agent reading two `diagram.png`s from two pages gets
+* both; the same bytes again answer the file already written.
 */
 async function writeDownload(directory, name, bytes) {
 	await mkdir(directory, { recursive: true });
-	const dot = name.lastIndexOf(".");
-	const stem = dot > 0 ? name.slice(0, dot) : name;
-	const ext = dot > 0 ? name.slice(dot) : "";
-	let candidate = join(directory, name);
-	for (let n = 2; existsSync(candidate); n += 1) {
-		const existing = await readFile(candidate);
-		if (existing.byteLength === bytes.byteLength && existing.every((b, i) => b === bytes[i])) return candidate;
-		candidate = join(directory, `${stem}-${n}${ext}`);
-	}
-	await writeFile(candidate, bytes);
-	return candidate;
+	const safe = downloadName(name);
+	const dot = safe.lastIndexOf(".");
+	const stem = dot > 0 ? safe.slice(0, dot) : safe;
+	const ext = dot > 0 ? safe.slice(dot) : "";
+	for (let n = 1; n <= 1e3; n += 1) {
+		const candidate = join(directory, n === 1 ? safe : `${stem}-${n}${ext}`);
+		try {
+			await writeFile(candidate, bytes, { flag: "wx" });
+			return candidate;
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+		}
+		if (await holds(candidate, bytes)) return candidate;
+	}
+	throw new Error(`${directory} already holds a thousand files named like ${safe}.`);
 }
 /** UTF-16 units of document text returned before `truncated` is set. */
 var READ_TEXT_CAP = 2e5;
@@ -16029,7 +16380,10 @@ async function uploadAsset(graph, args) {
 	if (!args.path || args.path.trim() === "") throw new ToolError("invalid_argument", "path must name a file on this machine.");
 	let file;
 	try {
-		file = await readLocalFile(args.path.trim());
+		file = await readLocalFile(args.path.trim(), {
+			env: process.env,
+			downloadsDir: assets.downloadsDir
+		});
 	} catch (error) {
 		throw new ToolError("invalid_argument", `Cannot read "${args.path}": ${error instanceof Error ? error.message : String(error)}`);
 	}
@@ -16074,8 +16428,15 @@ async function readAsset(graph, args) {
 	if (!documents) throw new ToolError("asset_not_found", `No document you can read references "${displayNameOf(ref)}", so it is not available here.`);
 	const asset = await assets.store.readBytes(ref);
 	if (!asset) throw new ToolError("asset_not_found", `The graph does not hold "${displayNameOf(ref)}" (the reference may be broken).`);
+	let directory;
+	try {
+		directory = await folderUnder(assets.downloadsDir, args.out_dir, ".");
+	} catch (error) {
+		if (error instanceof FolderRefused) throw new ToolError("invalid_argument", error.message);
+		throw error;
+	}
 	return {
-		path: await writeDownload(args.out_dir?.trim() || assets.downloadsDir, asset.name || displayNameOf(ref), asset.bytes),
+		path: await writeDownload(directory, asset.name || displayNameOf(ref), asset.bytes),
 		name: asset.name || displayNameOf(ref),
 		type: asset.type,
 		bytes: asset.bytes.byteLength,
@@ -16626,15 +16987,25 @@ function hostOf(host) {
 		cmd: host?.cmd ?? "etherpk-mcp"
 	};
 }
+/** The graph's downloads directory: every folder these tools write to, or read a theme back from, is under it. */
+function downloadsOf(graph) {
+	return graph.assets?.downloadsDir ?? join(process.cwd(), "etherpk-downloads");
+}
+/** A folder under the downloads directory, or the tool's refusal. */
+async function toolFolder(graph, requested, fallback) {
+	try {
+		return await folderUnder(downloadsOf(graph), requested, fallback);
+	} catch (error) {
+		if (error instanceof FolderRefused) throw new ToolError("invalid_argument", error.message);
+		throw error;
+	}
+}
 async function settle(graph) {
 	const result = await graph.settle();
 	if (!result.settled) throw new ToolError("not_settled", result.message);
 }
-async function fetchText(url) {
-	const response = await fetch(url);
-	if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
-	return response.text();
-}
+/** A url theme's files, from public https hosts only (see public-fetch.ts). */
+var fetchText = (url) => fetchPublicText(url);
 /** The publications whose saved mapping names a theme: what makes it undeletable. */
 async function publicationsUsing(graph, themeId) {
 	const { source } = await graph.publishing.readSource();
@@ -16731,12 +17102,11 @@ async function readTheme(graph, args) {
 	await graph.store.refresh();
 	const ref = args.ref.trim();
 	const { source, files, theme } = await filesOf(graph, ref);
-	const folder = resolve(args.out_dir?.trim() || join(graph.assets?.downloadsDir ?? join(process.cwd(), "etherpk-downloads"), "themes", ref.replace(/[^A-Za-z0-9._-]/g, "_")));
+	const folder = await toolFolder(graph, args.out_dir, join("themes", ref.replace(/[^A-Za-z0-9._-]/g, "_")));
+	const site = nodeSiteFolder(folder);
 	const written = [];
 	for (const [path, text] of [...files.entries()].sort(([a], [b]) => a.localeCompare(b))) {
-		const full = join(folder, ...path.split("/"));
-		await mkdir(dirname(full), { recursive: true });
-		await writeFile(full, text);
+		await site.writeFile(path, text);
 		written.push({
 			path,
 			bytes: Buffer.byteLength(text)
@@ -16888,22 +17258,43 @@ async function deleteThemeFile(graph, args) {
 		errors: validationOf(after)
 	};
 }
-/** Every allowed file under a directory, as the theme's whole file set. */
-async function filesUnder(dir) {
-	const base = resolve(dir);
+/** Bounds on a theme folder: far beyond a real theme, and short of a whole disk. */
+var THEME_FOLDER_LIMITS = {
+	files: 500,
+	depth: 6,
+	fileBytes: 1024 * 1024,
+	totalBytes: 8 * 1024 * 1024
+};
+/**
+* Every allowed file under a directory, as the theme's whole file set. Symbolic links are not
+* followed, so a folder cannot pull in a file from elsewhere on disk, and the walk stops at the
+* limits above rather than reading whatever tree it was pointed at.
+*/
+async function filesUnder(base) {
 	const files = /* @__PURE__ */ new Map();
-	const walk = async (at) => {
+	let seen = 0;
+	let total = 0;
+	const walk = async (at, depth) => {
+		if (depth > THEME_FOLDER_LIMITS.depth) return;
 		for (const entry of await readdir(at, { withFileTypes: true })) {
+			if (entry.isSymbolicLink()) continue;
 			const full = join(at, entry.name);
 			if (entry.isDirectory()) {
-				if (entry.name !== ".git" && entry.name !== "node_modules") await walk(full);
+				if (entry.name !== ".git" && entry.name !== "node_modules") await walk(full, depth + 1);
 				continue;
 			}
+			if (!entry.isFile()) continue;
+			if (++seen > THEME_FOLDER_LIMITS.files) throw new Error(`it holds more than ${THEME_FOLDER_LIMITS.files} files`);
 			const path = relative(base, full).split(sep).join("/");
-			if (isThemeFilePath(path)) files.set(path, await readFile(full, "utf8"));
+			if (!isThemeFilePath(path)) continue;
+			const { size } = await lstat(full);
+			if (size > THEME_FOLDER_LIMITS.fileBytes) throw new Error(`${path} is larger than ${THEME_FOLDER_LIMITS.fileBytes} bytes`);
+			total += size;
+			if (total > THEME_FOLDER_LIMITS.totalBytes) throw new Error(`its theme files come to more than ${THEME_FOLDER_LIMITS.totalBytes} bytes`);
+			files.set(path, await readFile(full, "utf8"));
 		}
 	};
-	await walk(base);
+	await walk(base, 0);
 	return files;
 }
 /**
@@ -16914,9 +17305,11 @@ async function filesUnder(dir) {
 async function importThemeFolder(graph, args) {
 	await graph.store.refresh();
 	const theme = await requireEditable(graph, args.id.trim());
+	if (!args.dir?.trim()) throw new ToolError("invalid_argument", "dir must name the theme folder, as read_theme returned it.");
+	const dir = await toolFolder(graph, args.dir, "");
 	let files;
 	try {
-		files = await filesUnder(args.dir);
+		files = await filesUnder(dir);
 	} catch (error) {
 		throw new ToolError("invalid_argument", `Cannot read "${args.dir}": ${error instanceof Error ? error.message : String(error)}`);
 	}
@@ -16953,8 +17346,8 @@ async function deleteTheme(graph, args) {
 /**
 * Render a theme to a folder on this machine and say where: the publication's real site when
 * one is named, the sample site the Theme editor previews over otherwise. A preview is scratch,
-* not a [[Publish Folder]]: the default location is under the graph's downloads directory and is
-* emptied first; a named `out_dir` is written into as it is. With `screenshots`, the browser
+* not a [[Publish Folder]]: it is always under the graph's downloads directory, the default folder
+* there is emptied first, and a named `out_dir` (also under it) is written into as it is. With `screenshots`, the browser
 * photographs the front page and the first other page at desktop and phone widths, so the agent
 * can look at what it changed.
 */
@@ -16987,7 +17380,7 @@ async function previewTheme(graph, args, host) {
 		});
 		const { bundle, report } = await publishPublication(source, publication, environment);
 		const scratch = !args.out_dir?.trim();
-		const folder = resolve(args.out_dir?.trim() || join(graph.assets?.downloadsDir ?? join(process.cwd(), "etherpk-downloads"), "previews", themeRef.replace(/[^A-Za-z0-9._-]/g, "_")));
+		const folder = await toolFolder(graph, args.out_dir, join("previews", themeRef.replace(/[^A-Za-z0-9._-]/g, "_")));
 		if (scratch) await rm(folder, {
 			recursive: true,
 			force: true
@@ -17018,12 +17411,10 @@ async function previewTheme(graph, args, host) {
 		await renderer?.dispose();
 	}
 }
+/** The rendered site into the folder, through the writer `publish` uses: no path may leave the folder. */
 async function writeBundle(folder, bundle) {
-	for (const [path, content] of bundle) {
-		const full = join(folder, ...path.split("/"));
-		await mkdir(dirname(full), { recursive: true });
-		await writeFile(full, content);
-	}
+	const site = nodeSiteFolder(folder);
+	for (const [path, content] of bundle) await site.writeFile(path, content);
 }
 /** The front page and the first other page, desktop and phone, as PNGs beside the site. */
 async function photograph(env, folder, pages) {
@@ -17033,12 +17424,16 @@ async function photograph(env, folder, pages) {
 		const shots = [];
 		const targets = ["index.html", ...pages.filter((p) => p !== "index.html" && p !== "404.html").slice(0, 1)];
 		for (const page of targets) for (const width of [1280, 390]) {
-			const context = await browser.newContext({ viewport: {
-				width,
-				height: width === 390 ? 844 : 800
-			} });
+			const context = await browser.newContext({
+				viewport: {
+					width,
+					height: width === 390 ? 844 : 800
+				},
+				offline: true
+			});
+			await context.route("**/*", (route) => previewRequestAllowed(route.request().url(), folder) ? route.continue() : route.abort());
 			const tab = await context.newPage();
-			await tab.goto(`file://${join(folder, page)}`, { waitUntil: "load" });
+			await tab.goto(pathToFileURL(join(folder, page)).href, { waitUntil: "load" });
 			const out = join(folder, `preview-${page.replace(/\.html$/, "")}-${width}.png`);
 			await tab.screenshot({
 				path: out,
@@ -17118,7 +17513,7 @@ function createMcpServer(graph, info) {
 		"Start with graph_info to see what you are connected to. read_documents reads several documents in one call; tasks lists tasks and set_task changes one (status, priority, due and scheduled dates) by document and line.",
 		"Publishing: list_publications shows the publications this graph defines (a publication is a page whose frontmatter defines it; its outline is the site navigation) and the public documents none takes; a document is on a site when its frontmatter has public: true and names the publication in publications. create_publication and update_publication change the settings; publish writes the site into the publish folder the user set for it on this machine with the etherpk-mcp publish command (the tool cannot choose a folder) and returns the report. Diagrams need a browser the user installs once with \"diagrams setup\".",
 		"Themes: a publication's look is a theme - Mustache templates, a stylesheet, a script and a manifest. list_themes shows the bundled ones (read-only) and the graph's own; read_theme writes a theme's files to a folder on this machine to read and edit; customise_publication_theme copies a publication's bundled theme into the graph and points the publication at the copy (create_theme copies any theme); write_theme_file, delete_theme_file and import_theme_folder change a graph theme; preview_theme renders a theme to a folder (with screenshots when a browser is set up) to check before publish. For a snippet such as an analytics script, an include slot (update_publication includes, e.g. head) filled by a page may be lighter than a theme copy.",
-		"Images and files are assets: upload_asset adds a file from this machine and returns the markdown to paste into a document; read_asset writes an asset to a local file you can open; list_assets shows the assets documents reference. An asset is available only where a document you can read references it (or you uploaded it this session).",
+		"Images and files are assets: upload_asset adds a file from this machine and returns the markdown to paste into a document; read_asset writes an asset to a local file you can open; list_assets shows the assets documents reference. An asset is available only where a document you can read references it (or you uploaded it this session). read_asset, read_theme and preview_theme write under the graph's downloads directory and return the path; name a folder relative to it, never elsewhere.",
 		"The user documentation is at https://docs.etherpk.com."
 	].join("\n") });
 	server.registerTool("list_documents", {
@@ -17277,18 +17672,18 @@ function createMcpServer(graph, info) {
 	}, async (args) => run(() => setFrontmatter(graph, args)));
 	server.registerTool("upload_asset", {
 		title: "Upload an asset",
-		description: "Add a file on this machine (an image, a PDF, any file) to the graph as an asset. Returns the reference and the markdown to paste into a document (an image tag for an image, a link otherwise). Bytes the graph already holds are not stored twice: the result then says reused: true and points at the existing asset. The file is stored as it is, without image optimisation. Refused with error \"asset_refused\" when the server declines it on a quota.",
+		description: "Add a file on this machine (an image, a PDF, any file) to the graph as an asset. Returns the reference and the markdown to paste into a document (an image tag for an image, a link otherwise). Bytes the graph already holds are not stored twice: the result then says reused: true and points at the existing asset. The file is stored as it is, without image optimisation. Refused with error \"invalid_argument\" for a folder, a file over 100 MiB, a hidden file or one in a hidden folder (.ssh, .env), and the Headless Client's own config and cache; with error \"asset_refused\" when the server declines it on a quota.",
 		inputSchema: {
-			path: z.string().min(1).describe("Absolute path of the file on this machine."),
+			path: z.string().min(1).describe("Absolute path of an ordinary file on this machine."),
 			name: z.string().min(1).optional().describe("The name to store it under; the file's own name by default.")
 		}
 	}, async (args) => run(() => uploadAsset(graph, args)));
 	server.registerTool("read_asset", {
 		title: "Read an asset",
-		description: "Write an asset's bytes to a file on this machine and return the path, so you can open or view it. Pass the reference as a document shows it (\"../assets/<name>\") or the name alone. Available only where a document you can read references the asset (or you uploaded it this session); otherwise error \"asset_not_found\".",
+		description: "Write an asset's bytes to a file on this machine and return the path, so you can open or view it. Pass the reference as a document shows it (\"../assets/<name>\") or the name alone. Available only where a document you can read references the asset (or you uploaded it this session); otherwise error \"asset_not_found\". The file is written under the graph's downloads directory, named after the asset, and never over an existing file.",
 		inputSchema: {
 			ref: z.string().min(1),
-			out_dir: z.string().min(1).optional().describe("Directory to write into; the graph's downloads directory by default.")
+			out_dir: z.string().min(1).optional().describe("A folder under the graph's downloads directory, relative to it; the downloads directory itself by default. A folder outside it is refused.")
 		}
 	}, async (args) => run(() => readAsset(graph, args)));
 	server.registerTool("list_assets", {
@@ -17349,7 +17744,7 @@ function createMcpServer(graph, info) {
 		description: "Write a theme's files (theme.json, layouts/, partials/, assets/) to a folder on this machine and return the path and file list, so you can read and edit them with your own tools. ref is a graph theme id, a bundled theme name or a url. Editing the folder changes nothing until write_theme_file or import_theme_folder brings it back; a bundled or url theme cannot be edited in place at all (create_theme copies it).",
 		inputSchema: {
 			ref: z.string().min(1),
-			out_dir: z.string().min(1).optional().describe("Directory to write into; the graph's downloads directory by default.")
+			out_dir: z.string().min(1).optional().describe("A folder under the graph's downloads directory, relative to it; themes/<ref> there by default. A folder outside it is refused.")
 		}
 	}, async (args) => run(() => readTheme(graph, args)));
 	server.registerTool("read_theme_file", {
@@ -17397,7 +17792,7 @@ function createMcpServer(graph, info) {
 	}, async (args) => run(() => deleteThemeFile(graph, args)));
 	server.registerTool("import_theme_folder", {
 		title: "Import a theme folder",
-		description: "Replace a graph theme's files with a folder's contents - the way back after editing what read_theme wrote. Files the folder no longer has are removed from the theme; the folder needs a theme.json at its top. Validated afterwards.",
+		description: "Replace a graph theme's files with a folder's contents - the way back after editing what read_theme wrote. Files the folder no longer has are removed from the theme; the folder needs a theme.json at its top. dir is the folder read_theme returned, or another under the graph's downloads directory; a folder outside it is refused, and symbolic links in it are skipped. Validated afterwards.",
 		inputSchema: {
 			id: z.string().min(1),
 			dir: z.string().min(1)
@@ -17410,7 +17805,7 @@ function createMcpServer(graph, info) {
 	}, async (args) => run(() => deleteTheme(graph, args)));
 	server.registerTool("preview_theme", {
 		title: "Preview a theme",
-		description: "Render a theme to a folder on this machine and return where: a publication's real pages when a publication is given (with its own theme, or the theme named), or a sample site covering every construct when only a theme is given. Open the HTML to check markup and styles. With screenshots: true and a browser set up (diagrams setup or ETHERPK_CHROMIUM), the front page and one content page are photographed at desktop and phone widths as PNGs you can view. A preview is scratch, not the publish folder.",
+		description: "Render a theme to a folder on this machine and return where: a publication's real pages when a publication is given (with its own theme, or the theme named), or a sample site covering every construct when only a theme is given. Open the HTML to check markup and styles. With screenshots: true and a browser set up (diagrams setup or ETHERPK_CHROMIUM), the front page and one content page are photographed at desktop and phone widths as PNGs you can view. A preview is scratch, not the publish folder. The page loads nothing from the network while it is photographed. out_dir is a folder under the graph's downloads directory (previews/<name> there by default); a folder outside it is refused.",
 		inputSchema: {
 			theme: z.string().min(1).optional(),
 			publication: z.string().min(1).optional(),
@@ -17460,9 +17855,18 @@ function standalone(bytes) {
 	copy.set(bytes);
 	return copy;
 }
+/**
+* `name` as one file of `folder`, or a refusal. The store passes names that came from documents
+* (an asset reference decodes to one), and `join` would follow a `..` or a separator out of the
+* graph; the browser's directory handles refuse such names, and this keeps the two adapters alike.
+*/
+function fileIn(folder, name) {
+	if (!isSingleFileName(name)) throw new Error(`"${name}" is not a file name.`);
+	return join(folder, name);
+}
 function createNodeDirectoryAdapter(root) {
 	const dir = resolve(root);
-	const path = (subdir, name) => join(dir, subdir, name);
+	const path = (subdir, name) => fileIn(join(dir, subdir), name);
 	/**
 	* The file's mtime as integer milliseconds, as the browser's `File.lastModified` is. Node's
 	* `mtimeMs` is a float built from seconds plus nanoseconds, and on some filesystems the
@@ -17543,7 +17947,7 @@ function createNodeDirectoryAdapter(root) {
 			for (const subdir of SUBDIRS) await mkdir(join(dir, subdir), { recursive: true });
 		},
 		async readRootFile(name) {
-			const file = join(dir, name);
+			const file = fileIn(dir, name);
 			let text;
 			try {
 				text = await readFile(file, "utf8");
@@ -17557,7 +17961,7 @@ function createNodeDirectoryAdapter(root) {
 			};
 		},
 		async writeRootFile(name, text) {
-			const file = join(dir, name);
+			const file = fileIn(dir, name);
 			await writeFile(file, text, "utf8");
 			return {
 				text,
@@ -17670,9 +18074,9 @@ var USAGE = `etherpk-mcp - EtherPK Headless Client (an MCP server over one synce
   ${CMD} diagrams status
       Which browser a publish would use, if any.
 
-This machine can be signed in to several Sync Servers at once (a self-hosted one beside the
-managed service, say); --sync-server says which one a command means, and can be left out
-while only one is signed in. The config file is ${defaultConfigPath()} (override with
+This machine can be signed in to several Sync Servers at once; --sync-server says which one
+a command means, and can be left out while only one is signed in. The config file is
+${defaultConfigPath()} (override with
 ETHERPK_MCP_CONFIG); cached graphs live under ~/.cache/etherpk/mcp (override with
 ETHERPK_MCP_CACHE_DIR).
 Docs: https://docs.etherpk.com/using-ai-agents-with-your-notes