@bitbonsai/mcpvault 0.18.0 → 0.18.2

package/README.md

@@ -998,7 +998,7 @@ Only grant write access to clients and conversations you trust. Use `--read-only
 - `server.ts` - MCP server entry point
 - `src/cli.ts` - CLI option parsing for vault path, read-only mode, and default exclusions
 - `src/createServer.ts` - MCP tool registration, request routing, and discovery defaults
-- `src/frontmatter.ts` - YAML frontmatter handling with gray-matter
+- `src/frontmatter.ts` - YAML frontmatter handling with gray-matter, preserving formatting and CRLF line endings; executable JavaScript frontmatter stays inert as note content
 - `src/filesystem.ts` - File operations with path validation
 - `src/pathfilter.ts` - Directory and file filtering
 - `src/search.ts` - Note search functionality with content and frontmatter support

package/dist/src/filesystem.d.ts

@@ -15,6 +15,7 @@ export declare class FileSystemService {
     private vaultPath;
     private frontmatterHandler;
     private pathFilter;
+    private writeChains;
     constructor(vaultPath: string, pathFilter?: PathFilter, frontmatterHandler?: FrontmatterHandler);
     /**
      * Normalize an incoming path to be vault-relative. Strips leading slashes
@@ -23,6 +24,8 @@ export declare class FileSystemService {
      */
     private normalizePath;
     private resolvePath;
+    private withPathLock;
+    private atomicWrite;
     readNote(path: string): Promise<ParsedNote>;
     writeNote(params: NoteWriteParams): Promise<void>;
     patchNote(params: PatchNoteParams): Promise<PatchNoteResult>;

package/dist/src/filesystem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../src/filesystem.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,uBAAuB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE3V;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAiBtE;AAoBD,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,SAAS;IAJnB,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,UAAU,CAAa;IAE/B,YACU,SAAS,EAAE,MAAM,EACzB,UAAU,CAAC,EAAE,UAAU,EACvB,kBAAkB,CAAC,EAAE,kBAAkB,EAWxC;IAED;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAsBrB,OAAO,CAAC,WAAW;IAgDb,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+BhD;IAEK,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EtD;IAEK,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CA4FjE;IAEK,aAAa,CAAC,IAAI,GAAE,MAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4DhE;IAEK,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAc3C;IAEK,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAchD;IAEK,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAyGhE;IAEK,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CA4H1D;IAEK,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CA+H1D;IAEK,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CA+CzE;IAEK,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCtE;IAEK,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CA0CvD;IAEK,UAAU,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqG1E;IAED,YAAY,IAAI,MAAM,CAErB;IAED;;;;;;;;;;;;;;OAcG;IACG,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA+CjE;IAEK,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA+EzD;IAEK,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAehE;IAEK,aAAa,CAAC,WAAW,GAAE,MAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAuDhE;IAEK,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAiDlE;CACF"}
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../src/filesystem.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,uBAAuB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE3V;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAiBtE;AAoBD,qBAAa,iBAAiB;IAO1B,OAAO,CAAC,SAAS;IANnB,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,UAAU,CAAa;IAE/B,OAAO,CAAC,WAAW,CAAoC;IAEvD,YACU,SAAS,EAAE,MAAM,EACzB,UAAU,CAAC,EAAE,UAAU,EACvB,kBAAkB,CAAC,EAAE,kBAAkB,EAWxC;IAED;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAsBrB,OAAO,CAAC,WAAW;YAuDL,YAAY;YAiBZ,WAAW;IAgCnB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+BhD;IAEK,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA4EtD;IAEK,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CA2FjE;IAEK,aAAa,CAAC,IAAI,GAAE,MAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4DhE;IAEK,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAc3C;IAEK,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAchD;IAEK,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAyGhE;IAEK,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CA4H1D;IAEK,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CA+H1D;IAEK,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CA+CzE;IAEK,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBtE;IAEK,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CA0CvD;IAEK,UAAU,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqG1E;IAED,YAAY,IAAI,MAAM,CAErB;IAED;;;;;;;;;;;;;;OAcG;IACG,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA+CjE;IAEK,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA+EzD;IAEK,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAehE;IAEK,aAAa,CAAC,WAAW,GAAE,MAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAuDhE;IAEK,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAiDlE;CACF"}

package/dist/src/filesystem.js

@@ -1,6 +1,7 @@
 import { join, resolve, relative, dirname } from 'path';
 import { homedir } from 'os';
-import { readdir, stat, readFile, writeFile, unlink, mkdir, access, rename, copyFile } from 'node:fs/promises';
+import { readdir, stat, readFile, writeFile, open, unlink, mkdir, access, rename, copyFile } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
 import { constants, lstatSync, realpathSync } from 'node:fs';
 import trash from 'trash';
 import { FrontmatterHandler } from './frontmatter.js';
@@ -54,6 +55,8 @@ export class FileSystemService {
     vaultPath;
     frontmatterHandler;
     pathFilter;
+    // shortcut: instance-local locks only, add cross-process coordination if shared-vault writers need it.
+    writeChains = new Map();
     constructor(vaultPath, pathFilter, frontmatterHandler) {
         this.vaultPath = vaultPath;
         const resolved = resolve(vaultPath);
@@ -96,7 +99,7 @@ export class FileSystemService {
         }
         return p;
     }
-    resolvePath(relativePath) {
+    resolvePath(relativePath, followSymlinks = false) {
         const normalizedPath = this.normalizePath(relativePath);
         const fullPath = resolve(join(this.vaultPath, normalizedPath));
         // Security check: ensure path is within vault (lexical)
@@ -112,6 +115,13 @@ export class FileSystemService {
                 if (relative(this.vaultPath, realPath).startsWith('..')) {
                     throw new Error(`Symlink target is outside vault: ${relativePath}. Symbolic links must resolve to a path within the vault directory.`);
                 }
+                if (followSymlinks) {
+                    const target = resolve(realPath, relative(candidate, fullPath));
+                    if (!this.pathFilter.isAllowed(relative(this.vaultPath, target))) {
+                        throw new Error(`Access denied: ${relativePath}. The resolved target is restricted.`);
+                    }
+                    return target;
+                }
                 break;
             }
             catch (err) {
@@ -146,6 +156,61 @@ export class FileSystemService {
         }
         return fullPath;
     }
+    async withPathLock(path, fn) {
+        const fullPath = this.resolvePath(path, true);
+        const previous = this.writeChains.get(fullPath) ?? Promise.resolve();
+        let release;
+        const current = new Promise((resolve) => { release = resolve; });
+        this.writeChains.set(fullPath, current);
+        await previous;
+        try {
+            return await fn(fullPath);
+        }
+        finally {
+            release();
+            if (this.writeChains.get(fullPath) === current) {
+                this.writeChains.delete(fullPath);
+            }
+        }
+    }
+    async atomicWrite(fullPath, content) {
+        let mode;
+        try {
+            const target = await stat(fullPath);
+            if (!target.isFile()) {
+                throw new Error(`Cannot write non-regular file: ${relative(this.vaultPath, fullPath) || '/'}`);
+            }
+            mode = target.mode & 0o777;
+            await access(fullPath, constants.W_OK);
+        }
+        catch (error) {
+            if (!(error instanceof Error) || !('code' in error) || error.code !== 'ENOENT')
+                throw error;
+        }
+        await mkdir(dirname(fullPath), { recursive: true });
+        const tmpPath = join(dirname(fullPath), `.mcpvault-${randomUUID()}.tmp`);
+        const file = await open(tmpPath, 'wx', mode ?? 0o666);
+        try {
+            try {
+                await file.writeFile(content, 'utf-8');
+                // Creation applies umask; existing notes must retain their exact permissions.
+                if (mode !== undefined)
+                    await file.chmod(mode);
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+            await rename(tmpPath, fullPath);
+        }
+        catch (error) {
+            try {
+                await unlink(tmpPath);
+            }
+            catch { /* best effort */ }
+            throw error;
+        }
+    }
     async readNote(path) {
         path = this.normalizePath(path);
         const fullPath = this.resolvePath(path);
@@ -179,7 +244,6 @@ export class FileSystemService {
     async writeNote(params) {
         const { content, frontmatter, mode = 'overwrite' } = params;
         const path = this.normalizePath(params.path);
-        const fullPath = this.resolvePath(path);
         if (!this.pathFilter.isAllowed(path)) {
             throw new Error(`Access denied: ${path}. This path is restricted (system files like .obsidian, .git, and dotfiles are not accessible).`);
         }
@@ -194,50 +258,54 @@ export class FileSystemService {
                 throw new Error(`Invalid frontmatter: ${validation.errors.join(', ')}`);
             }
         }
-        try {
-            let finalContent;
-            if (mode === 'overwrite') {
-                // Original behavior - replace entire content
-                finalContent = frontmatter
-                    ? this.frontmatterHandler.stringify(frontmatter, content)
-                    : content;
-            }
-            else {
-                // For append/prepend, we need to read existing content
-                let existingNote;
-                try {
-                    existingNote = await this.readNote(path);
-                }
-                catch (error) {
-                    // File doesn't exist, treat as overwrite
+        // Serialize the read-modify-write against concurrent writers of the same file,
+        // and replace the file atomically so a torn/partial file is never observed.
+        return this.withPathLock(path, async (fullPath) => {
+            try {
+                let finalContent;
+                if (mode === 'overwrite') {
+                    // Original behavior - replace entire content
                     finalContent = frontmatter
                         ? this.frontmatterHandler.stringify(frontmatter, content)
                         : content;
                 }
-                if (existingNote) {
-                    // Merge frontmatter if provided
-                    const mergedFrontmatter = frontmatter
-                        ? { ...existingNote.frontmatter, ...frontmatter }
-                        : existingNote.frontmatter;
-                    const mergedContent = mode === 'append'
-                        ? existingNote.content + content
-                        : content + existingNote.content;
-                    if (existingNote.matter && existingNote.matter.trim() !== '') {
-                        // Preserve raw formatting for unmodified fields by only applying explicit updates
-                        finalContent = this.frontmatterHandler.preserveStringify(existingNote.matter, frontmatter || {}, mergedContent);
+                else {
+                    // For append/prepend, we need to read existing content
+                    let existingNote;
+                    try {
+                        existingNote = this.frontmatterHandler.parse(await readFile(fullPath, 'utf-8'));
                     }
-                    else {
-                        finalContent = this.frontmatterHandler.stringify(mergedFrontmatter, mergedContent);
+                    catch (error) {
+                        if (!(error instanceof Error) || !('code' in error) || error.code !== 'ENOENT')
+                            throw error;
+                        // File doesn't exist, treat as overwrite
+                        finalContent = frontmatter
+                            ? this.frontmatterHandler.stringify(frontmatter, content)
+                            : content;
+                    }
+                    if (existingNote) {
+                        // Merge frontmatter if provided
+                        const mergedFrontmatter = frontmatter
+                            ? { ...existingNote.frontmatter, ...frontmatter }
+                            : existingNote.frontmatter;
+                        const mergedContent = mode === 'append'
+                            ? existingNote.content + content
+                            : content + existingNote.content;
+                        if (existingNote.matter && existingNote.matter.trim() !== '') {
+                            // Preserve raw formatting for unmodified fields by only applying explicit updates
+                            finalContent = this.frontmatterHandler.preserveStringify(existingNote.matter, frontmatter || {}, mergedContent);
+                        }
+                        else {
+                            finalContent = this.frontmatterHandler.stringify(mergedFrontmatter, mergedContent);
+                        }
                     }
                 }
+                await this.atomicWrite(fullPath, finalContent);
             }
-            // Create directories if they don't exist
-            await mkdir(dirname(fullPath), { recursive: true });
-            await writeFile(fullPath, finalContent, 'utf-8');
-        }
-        catch (error) {
-            throw classifyWriteError(error, path);
-        }
+            catch (error) {
+                throw classifyWriteError(error, path);
+            }
+        });
     }
     async patchNote(params) {
         const { oldString, newString, replaceAll = false } = params;
@@ -273,44 +341,44 @@ export class FileSystemService {
             };
         }
         try {
-            // Read the existing note
-            const note = await this.readNote(path);
-            // Get the full content with frontmatter
-            const fullContent = note.originalContent;
-            // Count occurrences of oldString
-            const occurrences = fullContent.split(oldString).length - 1;
-            if (occurrences === 0) {
-                return {
-                    success: false,
-                    path,
-                    message: `String not found in note: "${oldString.substring(0, 50)}${oldString.length > 50 ? '...' : ''}"`,
-                    matchCount: 0
-                };
-            }
-            // If not replaceAll and multiple occurrences exist, fail
-            if (!replaceAll && occurrences > 1) {
+            return await this.withPathLock(path, async (fullPath) => {
+                const note = await this.readNote(fullPath);
+                // Get the full content with frontmatter
+                const fullContent = note.originalContent;
+                // Count occurrences of oldString
+                const occurrences = fullContent.split(oldString).length - 1;
+                if (occurrences === 0) {
+                    return {
+                        success: false,
+                        path,
+                        message: `String not found in note: "${oldString.substring(0, 50)}${oldString.length > 50 ? '...' : ''}"`,
+                        matchCount: 0
+                    };
+                }
+                // If not replaceAll and multiple occurrences exist, fail
+                if (!replaceAll && occurrences > 1) {
+                    return {
+                        success: false,
+                        path,
+                        message: `Found ${occurrences} occurrences of the string. Use replaceAll=true to replace all occurrences, or provide a more specific string to match exactly one occurrence.`,
+                        matchCount: occurrences
+                    };
+                }
+                // Perform the replacement
+                // Use a replacer function so newString is inserted literally,
+                // without $ replacement pattern expansion ($$, $&, $`, $')
+                const updatedContent = replaceAll
+                    ? fullContent.split(oldString).join(newString)
+                    : fullContent.replace(oldString, () => newString);
+                // Write the updated content atomically
+                await this.atomicWrite(fullPath, updatedContent);
                 return {
-                    success: false,
+                    success: true,
                     path,
-                    message: `Found ${occurrences} occurrences of the string. Use replaceAll=true to replace all occurrences, or provide a more specific string to match exactly one occurrence.`,
+                    message: `Successfully replaced ${replaceAll ? occurrences : 1} occurrence${occurrences > 1 ? 's' : ''}`,
                     matchCount: occurrences
                 };
-            }
-            // Perform the replacement
-            // Use a replacer function so newString is inserted literally,
-            // without $ replacement pattern expansion ($$, $&, $`, $')
-            const updatedContent = replaceAll
-                ? fullContent.split(oldString).join(newString)
-                : fullContent.replace(oldString, () => newString);
-            // Write the updated content
-            const fullPath = this.resolvePath(path);
-            await writeFile(fullPath, updatedContent, 'utf-8');
-            return {
-                success: true,
-                path,
-                message: `Successfully replaced ${replaceAll ? occurrences : 1} occurrence${occurrences > 1 ? 's' : ''}`,
-                matchCount: occurrences
-            };
+            });
         }
         catch (error) {
             return {
@@ -791,31 +859,20 @@ export class FileSystemService {
         if (!this.pathFilter.isAllowed(path)) {
             throw new Error(`Access denied: ${path}. This path is restricted (system files like .obsidian, .git, and dotfiles are not accessible).`);
         }
-        // Read the existing note
-        const note = await this.readNote(path);
-        // Prepare new frontmatter
-        const newFrontmatter = merge
-            ? { ...note.frontmatter, ...frontmatter }
-            : frontmatter;
-        // Validate the new frontmatter
-        const validation = this.frontmatterHandler.validate(newFrontmatter);
-        if (!validation.isValid) {
-            throw new Error(`Invalid frontmatter: ${validation.errors.join(', ')}`);
-        }
-        const fullPath = this.resolvePath(path);
-        if (merge && note.matter && note.matter.trim() !== '') {
-            // Preserve raw formatting for unmodified fields
-            const updatedContent = this.frontmatterHandler.preserveStringify(note.matter, frontmatter, note.content);
-            await writeFile(fullPath, updatedContent, 'utf-8');
-        }
-        else {
-            // Replace frontmatter entirely (or no existing matter to preserve)
-            await this.writeNote({
-                path,
-                content: note.content,
-                frontmatter: newFrontmatter
-            });
-        }
+        return this.withPathLock(path, async (fullPath) => {
+            const note = await this.readNote(fullPath);
+            const newFrontmatter = merge
+                ? { ...note.frontmatter, ...frontmatter }
+                : frontmatter;
+            const validation = this.frontmatterHandler.validate(newFrontmatter);
+            if (!validation.isValid) {
+                throw new Error(`Invalid frontmatter: ${validation.errors.join(', ')}`);
+            }
+            const updatedContent = merge && note.matter && note.matter.trim() !== ''
+                ? this.frontmatterHandler.preserveStringify(note.matter, frontmatter, note.content)
+                : this.frontmatterHandler.stringify(newFrontmatter, note.content);
+            await this.atomicWrite(fullPath, updatedContent);
+        });
     }
     async getNotesInfo(paths) {
         const results = await Promise.allSettled(paths.map(async (rawPath) => {
@@ -866,72 +923,73 @@ export class FileSystemService {
             };
         }
         try {
-            const note = await this.readNote(path);
-            let currentTags = [];
-            // Extract tags from frontmatter
-            if (note.frontmatter.tags) {
-                if (Array.isArray(note.frontmatter.tags)) {
-                    currentTags = note.frontmatter.tags;
+            return await this.withPathLock(path, async (fullPath) => {
+                const note = await this.readNote(fullPath);
+                let currentTags = [];
+                // Extract tags from frontmatter
+                if (note.frontmatter.tags) {
+                    if (Array.isArray(note.frontmatter.tags)) {
+                        currentTags = note.frontmatter.tags;
+                    }
+                    else if (typeof note.frontmatter.tags === 'string') {
+                        currentTags = [note.frontmatter.tags];
+                    }
                 }
-                else if (typeof note.frontmatter.tags === 'string') {
-                    currentTags = [note.frontmatter.tags];
+                // Also extract inline tags from content
+                const inlineTagMatches = note.content.match(/#[a-zA-Z0-9_-]+/g) || [];
+                const inlineTags = inlineTagMatches.map(tag => tag.slice(1)); // Remove #
+                currentTags = [...new Set([...currentTags, ...inlineTags])]; // Deduplicate
+                if (operation === 'list') {
+                    return {
+                        path,
+                        operation,
+                        tags: currentTags,
+                        success: true
+                    };
                 }
-            }
-            // Also extract inline tags from content
-            const inlineTagMatches = note.content.match(/#[a-zA-Z0-9_-]+/g) || [];
-            const inlineTags = inlineTagMatches.map(tag => tag.slice(1)); // Remove #
-            currentTags = [...new Set([...currentTags, ...inlineTags])]; // Deduplicate
-            if (operation === 'list') {
-                return {
-                    path,
-                    operation,
-                    tags: currentTags,
-                    success: true
-                };
-            }
-            let newTags = [...currentTags];
-            if (operation === 'add') {
-                for (const tag of tags) {
-                    if (!newTags.includes(tag)) {
-                        newTags.push(tag);
+                let newTags = [...currentTags];
+                if (operation === 'add') {
+                    for (const tag of tags) {
+                        if (!newTags.includes(tag)) {
+                            newTags.push(tag);
+                        }
                     }
                 }
-            }
-            else if (operation === 'remove') {
-                newTags = newTags.filter(tag => !tags.includes(tag));
-            }
-            // Build tag updates for preserveStringify
-            const tagUpdates = {};
-            if (newTags.length > 0) {
-                tagUpdates.tags = newTags;
-            }
-            else {
-                tagUpdates.tags = undefined;
-            }
-            // Write back the note with updated frontmatter, preserving raw formatting for unmodified fields
-            let updatedContent;
-            if (note.matter && note.matter.trim() !== '') {
-                updatedContent = this.frontmatterHandler.preserveStringify(note.matter, tagUpdates, note.content);
-            }
-            else {
-                const updatedFrontmatter = { ...note.frontmatter };
+                else if (operation === 'remove') {
+                    newTags = newTags.filter(tag => !tags.includes(tag));
+                }
+                // Build tag updates for preserveStringify
+                const tagUpdates = {};
                 if (newTags.length > 0) {
-                    updatedFrontmatter.tags = newTags;
+                    tagUpdates.tags = newTags;
                 }
                 else {
-                    delete updatedFrontmatter.tags;
+                    tagUpdates.tags = undefined;
                 }
-                updatedContent = this.frontmatterHandler.stringify(updatedFrontmatter, note.content);
-            }
-            const fullPath = this.resolvePath(path);
-            await writeFile(fullPath, updatedContent, 'utf-8');
-            return {
-                path,
-                operation,
-                tags: newTags,
-                success: true,
-                message: `Successfully ${operation === 'add' ? 'added' : 'removed'} tags`
-            };
+                // Write back the note with updated frontmatter, preserving raw formatting for unmodified fields
+                let updatedContent;
+                if (note.matter && note.matter.trim() !== '') {
+                    updatedContent = this.frontmatterHandler.preserveStringify(note.matter, tagUpdates, note.content);
+                }
+                else {
+                    const updatedFrontmatter = { ...note.frontmatter };
+                    if (newTags.length > 0) {
+                        updatedFrontmatter.tags = newTags;
+                    }
+                    else {
+                        delete updatedFrontmatter.tags;
+                    }
+                    updatedContent = this.frontmatterHandler.stringify(updatedFrontmatter, note.content);
+                }
+                await this.atomicWrite(fullPath, updatedContent);
+                return {
+                    path,
+                    operation,
+                    tags: newTags,
+                    success: true,
+                    message: `Successfully ${operation === 'add' ? 'added' : 'removed'} tags`
+                };
+            });
         }
         catch (error) {
             return {

package/dist/src/frontmatter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../src/frontmatter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAkB1E;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAmB5E;AAED,qBAAa,kBAAkB;IAC7B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAkBjC;IAED,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAWvE;IAED,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,2BAA2B,CAmB1E;IAED,OAAO,CAAC,yBAAyB;IAmDjC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAuB1F;IAED,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAGvD;IAED,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAUvE;CACF"}
+{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../src/frontmatter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AA0C1E;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAmB5E;AAED,qBAAa,kBAAkB;IAC7B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAkBjC;IAED,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAcvE;IAED,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,2BAA2B,CAmB1E;IAED,OAAO,CAAC,yBAAyB;IAmDjC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAyB1F;IAED,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAGvD;IAED,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAUvE;CACF"}

package/dist/src/frontmatter.js

@@ -8,11 +8,32 @@ const yamlEngine = {
     // YAML 1.2 schema (default). Dates stay as strings, but this avoids the
     // yaml-1.1 bug where single-letter keys like 'y'/'n' become booleans.
     // Merge keys (<<) are not resolved, which is fine for Obsidian frontmatter.
-    parse: (str) => parse(str),
+    parse: (str) => parse(toLf(str)),
     stringify: (data) => stringify(data),
 };
 function withYamlEngine(options = {}) {
-    return { ...options, engines: { yaml: yamlEngine } };
+    return {
+        ...options,
+        engines: {
+            yaml: yamlEngine,
+            // gray-matter merges default engines; override JavaScript to prevent eval, including its js alias.
+            javascript: {
+                parse: () => { throw new Error('JavaScript frontmatter is not supported'); },
+            },
+        },
+    };
+}
+/** Use CRLF when present, otherwise LF. */
+function detectEol(text) {
+    return text.includes('\r\n') ? '\r\n' : '\n';
+}
+// gray-matter leaves a trailing CR before the closing delimiter; normalize before YAML parsing.
+function toLf(text) {
+    return text.replace(/\r\n?/g, '\n');
+}
+/** Re-apply CRLF to LF-only text. */
+function applyEol(text, eol) {
+    return eol === '\r\n' ? text.replace(/\n/g, '\r\n') : text;
 }
 /**
  * Parse a frontmatter value that may be a JSON string (LLM clients sometimes
@@ -67,7 +88,10 @@ export class FrontmatterHandler {
             if (!frontmatterData || Object.keys(frontmatterData).length === 0) {
                 return content;
             }
-            return matter.stringify(content, frontmatterData, withYamlEngine());
+            const eol = detectEol(content);
+            // Serialize only the header so body bytes stay untouched; drop gray-matter's empty-body newline.
+            const header = matter.stringify('', frontmatterData, withYamlEngine()).slice(0, -1);
+            return applyEol(header, eol) + content + (content.endsWith('\n') ? '' : eol);
         }
         catch (error) {
             throw new Error(`Failed to stringify frontmatter: ${error instanceof Error ? error.message : 'Unknown error'}`);
@@ -137,9 +161,11 @@ export class FrontmatterHandler {
                 if (!updates || Object.keys(updates).length === 0) {
                     return content;
                 }
-                return matter.stringify(content, updates, withYamlEngine());
+                return this.stringify(updates, content);
             }
-            const doc = parseDocument(rawMatter.trimStart());
+            // Normalize only YAML; preserve the body's original bytes.
+            const eol = rawMatter.includes('\r\n') ? '\r\n' : detectEol(content);
+            const doc = parseDocument(toLf(rawMatter).trimStart());
             for (const [key, value] of Object.entries(updates)) {
                 if (value === undefined) {
                     doc.delete(key);
@@ -148,8 +174,8 @@ export class FrontmatterHandler {
                     doc.set(key, value);
                 }
             }
-            const yamlContent = doc.toString();
-            return `---\n${yamlContent}---\n${content}`;
+            const yamlContent = applyEol(doc.toString(), eol);
+            return `---${eol}${yamlContent}---${eol}${content}`;
         }
         catch (error) {
             throw new Error(`Failed to stringify frontmatter: ${error instanceof Error ? error.message : 'Unknown error'}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitbonsai/mcpvault",
-  "version": "0.18.0",
+  "version": "0.18.2",
   "description": "Universal AI bridge for Obsidian vaults - connect any MCP-compatible assistant",
   "homepage": "https://mcpvault.org",
   "author": "bitbonsai",