@graphmemory/server 1.1.0 → 1.3.0

package/dist/graphs/code.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodeGraphManager = exports.createCodeGraph = void 0;
 exports.updateCodeFile = updateCodeFile;
 exports.resolvePendingImports = resolvePendingImports;
+exports.resolvePendingEdges = resolvePendingEdges;
 exports.removeCodeFile = removeCodeFile;
 exports.getFileSymbols = getFileSymbols;
 exports.getCodeFileMtime = getCodeFileMtime;
@@ -20,6 +21,7 @@ const manager_types_1 = require("../graphs/manager-types");
 const code_1 = require("../lib/search/code");
 const files_1 = require("../lib/search/files");
 const bm25_1 = require("../lib/search/bm25");
+const embedding_codec_1 = require("../lib/embedding-codec");
 // ---------------------------------------------------------------------------
 // CRUD
 // ---------------------------------------------------------------------------
@@ -30,19 +32,31 @@ function updateCodeFile(graph, parsed) {
         graph.addNode(id, attrs);
     }
     const pendingImports = [];
+    const pendingEdges = [];
     for (const { from, to, attrs } of parsed.edges) {
         if (!graph.hasNode(to)) {
-            if (attrs.kind === 'imports')
+            if (attrs.kind === 'imports') {
                 pendingImports.push(to);
+            }
+            else if (attrs.kind === 'extends' || attrs.kind === 'implements') {
+                // Target class/interface may be in another file — defer resolution
+                const toName = to.split('::').pop();
+                pendingEdges.push({ from, toName, kind: attrs.kind });
+            }
             continue;
         }
         if (graph.hasNode(from) && !graph.hasEdge(from, to)) {
             graph.addEdgeWithKey(`${from}→${to}`, from, to, attrs);
         }
     }
-    // Store pending imports on the file node for post-drain resolution
-    if (pendingImports.length > 0 && graph.hasNode(parsed.fileId)) {
-        graph.setNodeAttribute(parsed.fileId, 'pendingImports', pendingImports);
+    // Store pending data on the file node for post-drain resolution
+    if (graph.hasNode(parsed.fileId)) {
+        if (pendingImports.length > 0) {
+            graph.setNodeAttribute(parsed.fileId, 'pendingImports', pendingImports);
+        }
+        if (pendingEdges.length > 0) {
+            graph.setNodeAttribute(parsed.fileId, 'pendingEdges', pendingEdges);
+        }
     }
 }
 /**
@@ -71,6 +85,43 @@ function resolvePendingImports(graph) {
     });
     return created;
 }
+/**
+ * Resolve pending extends/implements edges after all files have been indexed.
+ * Searches the entire graph for nodes matching toName (by symbol name).
+ */
+function resolvePendingEdges(graph) {
+    // Build name → nodeId index for fast lookup
+    const nameIndex = new Map();
+    graph.forEachNode((id, attrs) => {
+        if (attrs.kind === 'class' || attrs.kind === 'interface') {
+            const list = nameIndex.get(attrs.name) ?? [];
+            list.push(id);
+            nameIndex.set(attrs.name, list);
+        }
+    });
+    let created = 0;
+    graph.forEachNode((id, attrs) => {
+        if (!attrs.pendingEdges || attrs.pendingEdges.length === 0)
+            return;
+        const remaining = [];
+        for (const edge of attrs.pendingEdges) {
+            const candidates = nameIndex.get(edge.toName);
+            if (candidates && candidates.length > 0 && graph.hasNode(edge.from)) {
+                // Use first match (ambiguity is rare in practice)
+                const toId = candidates[0];
+                if (toId !== edge.from && !graph.hasEdge(edge.from, toId)) {
+                    graph.addEdgeWithKey(`${edge.from}→${toId}`, edge.from, toId, { kind: edge.kind });
+                    created++;
+                }
+            }
+            else {
+                remaining.push(edge);
+            }
+        }
+        graph.setNodeAttribute(id, 'pendingEdges', remaining.length > 0 ? remaining : undefined);
+    });
+    return created;
+}
 /** Remove all nodes (and their incident edges) belonging to a file. */
 function removeCodeFile(graph, fileId) {
     const toRemove = graph.filterNodes((_, attrs) => attrs.fileId === fileId);
@@ -112,8 +163,19 @@ function saveCodeGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'code.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadCodeGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = (0, code_types_1.createCodeGraph)();
@@ -129,6 +191,7 @@ function loadCodeGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[code-graph] Embedding config changed, re-indexing code graph\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[code-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }
@@ -144,7 +207,7 @@ class CodeGraphManager {
     _graph;
     embedFns;
     ext;
-    _bm25Index = new bm25_1.BM25Index((attrs) => `${attrs.name} ${attrs.signature} ${attrs.docComment}`);
+    _bm25Index = new bm25_1.BM25Index((attrs) => `${attrs.name} ${attrs.signature} ${attrs.docComment} ${attrs.body}`);
     constructor(_graph, embedFns, ext = {}) {
         this._graph = _graph;
         this.embedFns = embedFns;

package/dist/graphs/docs.js

@@ -20,6 +20,7 @@ const manager_types_1 = require("../graphs/manager-types");
 const docs_1 = require("../lib/search/docs");
 const files_1 = require("../lib/search/files");
 const bm25_1 = require("../lib/search/bm25");
+const embedding_codec_1 = require("../lib/embedding-codec");
 function createGraph() {
     return new graphology_1.DirectedGraph({ multi: false, allowSelfLoops: false });
 }
@@ -133,8 +134,19 @@ function saveGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'docs.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = createGraph();
@@ -150,6 +162,7 @@ function loadGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[graph] Embedding config changed, re-indexing docs graph\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }

package/dist/graphs/file-index.js

@@ -19,6 +19,7 @@ const file_index_types_1 = require("../graphs/file-index-types");
 const file_lang_1 = require("../graphs/file-lang");
 const manager_types_1 = require("../graphs/manager-types");
 const file_index_1 = require("../lib/search/file-index");
+const embedding_codec_1 = require("../lib/embedding-codec");
 // ---------------------------------------------------------------------------
 // CRUD
 // ---------------------------------------------------------------------------
@@ -121,6 +122,9 @@ function cleanEmptyDirs(graph, dir) {
         return;
     if (graph.getNodeAttribute(dir, 'kind') !== 'directory')
         return;
+    // Never remove root
+    if (dir === '.')
+        return;
     // Count outgoing `contains` edges
     const children = graph.outDegree(dir);
     if (children > 0)
@@ -128,9 +132,6 @@ function cleanEmptyDirs(graph, dir) {
     // No children — remove this directory
     const parent = graph.getNodeAttribute(dir, 'directory');
     graph.dropNode(dir);
-    // Don't remove root
-    if (dir === '.')
-        return;
     cleanEmptyDirs(graph, parent);
 }
 /**
@@ -157,7 +158,8 @@ function listAllFiles(graph, options = {}) {
             return [];
         graph.forEachOutNeighbor(dirId, (childId) => {
             const attrs = graph.getNodeAttributes(childId);
-            if (graph.getEdgeAttribute(graph.edge(dirId, childId), 'kind') !== 'contains')
+            const edgeKey = graph.edge(dirId, childId);
+            if (!edgeKey || graph.getEdgeAttribute(edgeKey, 'kind') !== 'contains')
                 return;
             if (extension && attrs.extension !== extension)
                 return;
@@ -240,8 +242,19 @@ function saveFileIndexGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'file-index.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadFileIndexGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = (0, file_index_types_1.createFileIndexGraph)();
@@ -257,6 +270,7 @@ function loadFileIndexGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[file-index] Embedding config changed, re-indexing file index\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[file-index] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }

package/dist/graphs/file-lang.js

@@ -15,7 +15,7 @@ exports.EXT_TO_LANGUAGE = {
     '.mjs': 'javascript',
     '.cjs': 'javascript',
     '.ts': 'typescript',
-    '.tsx': 'typescript',
+    '.tsx': 'tsx',
     '.mts': 'typescript',
     '.cts': 'typescript',
     // Web

package/dist/graphs/knowledge.js

@@ -28,6 +28,7 @@ const manager_types_1 = require("../graphs/manager-types");
 const knowledge_1 = require("../lib/search/knowledge");
 const bm25_1 = require("../lib/search/bm25");
 const file_mirror_1 = require("../lib/file-mirror");
+const embedding_codec_1 = require("../lib/embedding-codec");
 const attachment_types_1 = require("../graphs/attachment-types");
 const file_import_1 = require("../lib/file-import");
 // ---------------------------------------------------------------------------
@@ -329,8 +330,19 @@ function saveKnowledgeGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'knowledge.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadKnowledgeGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = (0, knowledge_types_1.createKnowledgeGraph)();
@@ -346,6 +358,7 @@ function loadKnowledgeGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[knowledge-graph] Embedding config changed, re-indexing knowledge graph\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[knowledge-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }
@@ -552,7 +565,9 @@ class KnowledgeGraphManager {
         try {
             const actualToId = targetGraph ? proxyId(targetGraph, toId, pid) : toId;
             if (this._graph.hasEdge(fromId, actualToId)) {
-                kind = this._graph.getEdgeAttribute(this._graph.edge(fromId, actualToId), 'kind') ?? '';
+                const ek = this._graph.edge(fromId, actualToId);
+                if (ek)
+                    kind = this._graph.getEdgeAttribute(ek, 'kind') ?? '';
             }
         }
         catch { /* ignore */ }
@@ -628,6 +643,8 @@ class KnowledgeGraphManager {
             return;
         const attachments = (0, attachment_types_1.scanAttachments)(path_1.default.join(dir, noteId));
         this._graph.setNodeAttribute(noteId, 'attachments', attachments);
+        this._graph.setNodeAttribute(noteId, 'updatedAt', Date.now());
+        this._graph.setNodeAttribute(noteId, 'version', (this._graph.getNodeAttribute(noteId, 'version') ?? 0) + 1);
         this.ctx.markDirty();
     }
     listAttachments(noteId) {

package/dist/graphs/manager-types.js

@@ -16,7 +16,7 @@ class VersionConflictError extends Error {
     }
 }
 exports.VersionConflictError = VersionConflictError;
-/** No-op context for tests and single-project stdio mode. */
+/** No-op context for tests. */
 function noopContext(projectId = '') {
     return {
         markDirty: () => { },

package/dist/graphs/skill.js

@@ -30,6 +30,7 @@ const manager_types_1 = require("../graphs/manager-types");
 const skills_1 = require("../lib/search/skills");
 const bm25_1 = require("../lib/search/bm25");
 const file_mirror_1 = require("../lib/file-mirror");
+const embedding_codec_1 = require("../lib/embedding-codec");
 const attachment_types_1 = require("../graphs/attachment-types");
 const file_import_1 = require("../lib/file-import");
 // ---------------------------------------------------------------------------
@@ -473,8 +474,19 @@ function saveSkillGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'skills.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadSkillGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = (0, skill_types_1.createSkillGraph)();
@@ -490,6 +502,7 @@ function loadSkillGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[skill-graph] Embedding config changed, re-indexing skill graph\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[skill-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }
@@ -760,7 +773,9 @@ class SkillGraphManager {
         try {
             const proxyNodeId = proxyId(targetGraph, targetId, pid);
             if (this._graph.hasEdge(skillId, proxyNodeId)) {
-                kind = this._graph.getEdgeAttribute(this._graph.edge(skillId, proxyNodeId), 'kind') ?? '';
+                const ek = this._graph.edge(skillId, proxyNodeId);
+                if (ek)
+                    kind = this._graph.getEdgeAttribute(ek, 'kind') ?? '';
             }
         }
         catch { /* ignore */ }
@@ -788,7 +803,9 @@ class SkillGraphManager {
         let kind = '';
         try {
             if (this._graph.hasEdge(fromId, toId)) {
-                kind = this._graph.getEdgeAttribute(this._graph.edge(fromId, toId), 'kind') ?? '';
+                const ek = this._graph.edge(fromId, toId);
+                if (ek)
+                    kind = this._graph.getEdgeAttribute(ek, 'kind') ?? '';
             }
         }
         catch { /* ignore */ }
@@ -856,6 +873,8 @@ class SkillGraphManager {
             return;
         const attachments = (0, attachment_types_1.scanAttachments)(path_1.default.join(dir, skillId));
         this._graph.setNodeAttribute(skillId, 'attachments', attachments);
+        this._graph.setNodeAttribute(skillId, 'updatedAt', Date.now());
+        this._graph.setNodeAttribute(skillId, 'version', (this._graph.getNodeAttribute(skillId, 'version') ?? 0) + 1);
         this.ctx.markDirty();
     }
     listAttachments(skillId) {

package/dist/graphs/task.js

@@ -30,6 +30,7 @@ const manager_types_1 = require("../graphs/manager-types");
 const tasks_1 = require("../lib/search/tasks");
 const bm25_1 = require("../lib/search/bm25");
 const file_mirror_1 = require("../lib/file-mirror");
+const embedding_codec_1 = require("../lib/embedding-codec");
 const attachment_types_1 = require("../graphs/attachment-types");
 const file_import_1 = require("../lib/file-import");
 // ---------------------------------------------------------------------------
@@ -494,8 +495,19 @@ function saveTaskGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'tasks.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadTaskGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = (0, task_types_1.createTaskGraph)();
@@ -511,6 +523,7 @@ function loadTaskGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[task-graph] Embedding config changed, re-indexing task graph\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[task-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }
@@ -733,7 +746,9 @@ class TaskGraphManager {
         try {
             const proxyNodeId = proxyId(targetGraph, targetId, pid);
             if (this._graph.hasEdge(taskId, proxyNodeId)) {
-                kind = this._graph.getEdgeAttribute(this._graph.edge(taskId, proxyNodeId), 'kind') ?? '';
+                const ek = this._graph.edge(taskId, proxyNodeId);
+                if (ek)
+                    kind = this._graph.getEdgeAttribute(ek, 'kind') ?? '';
             }
         }
         catch { /* ignore */ }
@@ -759,7 +774,9 @@ class TaskGraphManager {
         let kind = '';
         try {
             if (this._graph.hasEdge(fromId, toId)) {
-                kind = this._graph.getEdgeAttribute(this._graph.edge(fromId, toId), 'kind') ?? '';
+                const ek = this._graph.edge(fromId, toId);
+                if (ek)
+                    kind = this._graph.getEdgeAttribute(ek, 'kind') ?? '';
             }
         }
         catch { /* ignore */ }
@@ -827,6 +844,8 @@ class TaskGraphManager {
             return;
         const attachments = (0, attachment_types_1.scanAttachments)(path_1.default.join(dir, taskId));
         this._graph.setNodeAttribute(taskId, 'attachments', attachments);
+        this._graph.setNodeAttribute(taskId, 'updatedAt', Date.now());
+        this._graph.setNodeAttribute(taskId, 'version', (this._graph.getNodeAttribute(taskId, 'version') ?? 0) + 1);
         this.ctx.markDirty();
     }
     listAttachments(taskId) {

package/dist/lib/embedding-codec.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * Encode/decode embedding vectors as Base64 for compact JSON serialization.
+ * Float32Array → Base64 string saves ~3x vs JSON number arrays.
+ * Backwards compatible: detects old format (number[]) on load.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compressEmbeddings = compressEmbeddings;
+exports.decompressEmbeddings = decompressEmbeddings;
+const EMBEDDING_FIELDS = ['embedding', 'fileEmbedding'];
+/** Convert a number[] to a Base64-encoded Float32Array. */
+function float32ToBase64(arr) {
+    const f32 = new Float32Array(arr);
+    const bytes = new Uint8Array(f32.buffer);
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++)
+        binary += String.fromCharCode(bytes[i]);
+    return Buffer.from(binary, 'binary').toString('base64');
+}
+/** Convert a Base64-encoded Float32Array back to number[]. */
+function base64ToFloat32(b64) {
+    const buf = Buffer.from(b64, 'base64');
+    // Copy to aligned buffer to guarantee 4-byte alignment for Float32Array
+    const aligned = new Uint8Array(buf.byteLength);
+    aligned.set(new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength));
+    const f32 = new Float32Array(aligned.buffer, 0, aligned.byteLength / 4);
+    return Array.from(f32);
+}
+/**
+ * Compress embedding fields in a graphology export object (mutates in place).
+ * Converts number[] → Base64 string for fields named 'embedding' or 'fileEmbedding'.
+ */
+function compressEmbeddings(exported) {
+    if (!exported?.nodes)
+        return;
+    for (const node of exported.nodes) {
+        const attrs = node.attributes;
+        if (!attrs)
+            continue;
+        for (const field of EMBEDDING_FIELDS) {
+            if (Array.isArray(attrs[field]) && attrs[field].length > 0) {
+                attrs[field] = float32ToBase64(attrs[field]);
+            }
+        }
+    }
+}
+/**
+ * Decompress embedding fields in a graphology export object (mutates in place).
+ * Converts Base64 string → number[]. Handles both old format (number[]) and new (string).
+ */
+function decompressEmbeddings(exported) {
+    if (!exported?.nodes)
+        return;
+    for (const node of exported.nodes) {
+        const attrs = node.attributes;
+        if (!attrs)
+            continue;
+        for (const field of EMBEDDING_FIELDS) {
+            if (typeof attrs[field] === 'string' && attrs[field].length > 0) {
+                attrs[field] = base64ToFloat32(attrs[field]);
+            }
+            // number[] stays as-is (backwards compatible with old format)
+        }
+    }
+}

package/dist/lib/file-mirror.js

@@ -422,14 +422,14 @@ function deleteMirrorDir(dir, id) {
 // ---------------------------------------------------------------------------
 // Attachment file helpers (paths now go through attachments/ subdir)
 // ---------------------------------------------------------------------------
-/** Sanitize a filename: strip path separators, .., and null bytes. */
+/** Sanitize a filename: extract basename, strip null bytes and path traversal. */
 function sanitizeFilename(name) {
-    const sanitized = name
-        .replace(/\0/g, '')
-        .replace(/\.\./g, '')
-        .replace(/[/\\]/g, '')
-        .trim();
-    return sanitized; // empty string is a valid return — callers must check
+    // Normalize backslashes to forward slashes (path.basename on Unix doesn't treat \ as separator)
+    const base = path.basename(name.replace(/\0/g, '').replace(/\\/g, '/')).trim();
+    // Reject pure traversal names
+    if (base === '.' || base === '..')
+        return '';
+    return base;
 }
 /** Write an attachment file to the entity's attachments/ subdirectory. */
 function writeAttachment(baseDir, entityId, filename, data) {

package/dist/lib/frontmatter.js

@@ -8,9 +8,10 @@ function serializeMarkdown(frontmatter, body) {
     return `---\n${yamlStr}\n---\n\n${body}\n`;
 }
 function parseMarkdown(raw) {
-    const match = raw.match(/^---\n([\s\S]*?)\n---\n\n?([\s\S]*)$/);
+    const normalized = raw.replace(/\r\n/g, '\n');
+    const match = normalized.match(/^---\n([\s\S]*?)\n---\n\n?([\s\S]*)$/);
     if (!match)
-        return { frontmatter: {}, body: raw };
+        return { frontmatter: {}, body: normalized };
     const frontmatter = (0, yaml_1.parse)(match[1], { maxAliasCount: 10 }) ?? {};
     const body = match[2].replace(/\n$/, '');
     return { frontmatter, body };

package/dist/lib/jwt.js

@@ -85,15 +85,15 @@ function parseTtl(ttl) {
 }
 function signAccessToken(userId, secret, ttl) {
     const payload = { userId, type: 'access' };
-    return jsonwebtoken_1.default.sign(payload, secret, { expiresIn: parseTtl(ttl) });
+    return jsonwebtoken_1.default.sign(payload, secret, { algorithm: 'HS256', expiresIn: parseTtl(ttl) });
 }
 function signRefreshToken(userId, secret, ttl) {
     const payload = { userId, type: 'refresh' };
-    return jsonwebtoken_1.default.sign(payload, secret, { expiresIn: parseTtl(ttl) });
+    return jsonwebtoken_1.default.sign(payload, secret, { algorithm: 'HS256', expiresIn: parseTtl(ttl) });
 }
 function verifyToken(token, secret) {
     try {
-        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        const decoded = jsonwebtoken_1.default.verify(token, secret, { algorithms: ['HS256'] });
         if (!decoded.userId || !decoded.type)
             return null;
         return { userId: decoded.userId, type: decoded.type };
@@ -108,7 +108,7 @@ function verifyToken(token, secret) {
 const ACCESS_COOKIE = 'mgm_access';
 const REFRESH_COOKIE = 'mgm_refresh';
 function setAuthCookies(res, accessToken, refreshToken, accessTtl, refreshTtl) {
-    const secure = process.env.NODE_ENV === 'production';
+    const secure = process.env.NODE_ENV !== 'development';
     res.cookie(ACCESS_COOKIE, accessToken, {
         httpOnly: true,
         secure,

package/dist/lib/mirror-watcher.js

@@ -51,6 +51,7 @@ const frontmatter_1 = require("./frontmatter");
  * this tracker lets us detect our own writes and skip them.
  */
 class MirrorWriteTracker {
+    /** Map from filePath → { mtimeMs (for comparison), recordedAt (for eviction) } */
     recentWrites = new Map();
     static STALE_MS = 10_000; // entries older than 10s are stale
     static MAX_ENTRIES = 10_000;
@@ -59,7 +60,7 @@ class MirrorWriteTracker {
         try {
             const stat = fs.statSync(filePath, { throwIfNoEntry: false });
             if (stat)
-                this.recentWrites.set(filePath, stat.mtimeMs);
+                this.recentWrites.set(filePath, { mtimeMs: stat.mtimeMs, recordedAt: Date.now() });
         }
         catch { /* ignore */ }
         // Prevent unbounded growth — evict stale entries periodically
@@ -75,7 +76,7 @@ class MirrorWriteTracker {
             const stat = fs.statSync(filePath, { throwIfNoEntry: false });
             if (!stat)
                 return false;
-            if (Math.abs(stat.mtimeMs - recorded) < 100) {
+            if (Math.abs(stat.mtimeMs - recorded.mtimeMs) < 100) {
                 this.recentWrites.delete(filePath);
                 return true;
             }
@@ -86,8 +87,8 @@ class MirrorWriteTracker {
     }
     evictStale() {
         const now = Date.now();
-        for (const [filePath, mtime] of this.recentWrites) {
-            if (now - mtime > MirrorWriteTracker.STALE_MS)
+        for (const [filePath, entry] of this.recentWrites) {
+            if (now - entry.recordedAt > MirrorWriteTracker.STALE_MS)
                 this.recentWrites.delete(filePath);
         }
     }