@graphmemory/server 1.2.0 → 1.3.1

package/dist/api/rest/index.js

@@ -24,6 +24,7 @@ const graph_1 = require("../../api/rest/graph");
 const tools_1 = require("../../api/rest/tools");
 const embed_1 = require("../../api/rest/embed");
 const team_1 = require("../../lib/team");
+const defaults_1 = require("../../lib/defaults");
 /**
  * Express middleware: reject if accessLevel (set by requireGraphAccess) is not 'rw'.
  * Use on POST/PUT/DELETE routes inside domain routers.
@@ -46,7 +47,7 @@ function createRestApp(projectManager, options) {
     const users = options?.users ?? {};
     const hasUsers = Object.keys(users).length > 0;
     const corsOrigins = serverConfig?.corsOrigins;
-    app.use((0, cors_1.default)(corsOrigins?.length ? { origin: corsOrigins, credentials: true } : { credentials: true }));
+    app.use((0, cors_1.default)(corsOrigins?.length ? { origin: corsOrigins, credentials: true } : {}));
     app.use(express_1.default.json({ limit: '10mb' }));
     app.use((0, cookie_parser_1.default)());
     // Security headers
@@ -59,10 +60,10 @@ function createRestApp(projectManager, options) {
     const rl = serverConfig?.rateLimit;
     const rateLimitMsg = { error: 'Too many requests, please try again later' };
     if (rl && rl.global > 0) {
-        app.use('/api/', (0, express_rate_limit_1.default)({ windowMs: 60_000, max: rl.global, standardHeaders: true, legacyHeaders: false, message: rateLimitMsg }));
+        app.use('/api/', (0, express_rate_limit_1.default)({ windowMs: defaults_1.RATE_LIMIT_WINDOW_MS, max: rl.global, standardHeaders: true, legacyHeaders: false, message: rateLimitMsg }));
     }
     if (rl && rl.search > 0) {
-        const searchLimiter = (0, express_rate_limit_1.default)({ windowMs: 60_000, max: rl.search, standardHeaders: true, legacyHeaders: false, message: rateLimitMsg });
+        const searchLimiter = (0, express_rate_limit_1.default)({ windowMs: defaults_1.RATE_LIMIT_WINDOW_MS, max: rl.search, standardHeaders: true, legacyHeaders: false, message: rateLimitMsg });
         app.use('/api/projects/:projectId/knowledge/search', searchLimiter);
         app.use('/api/projects/:projectId/tasks/search', searchLimiter);
         app.use('/api/projects/:projectId/skills/search', searchLimiter);
@@ -72,7 +73,7 @@ function createRestApp(projectManager, options) {
         app.use('/api/embed', searchLimiter);
     }
     if (rl && rl.auth > 0) {
-        app.use('/api/auth/login', (0, express_rate_limit_1.default)({ windowMs: 60_000, max: rl.auth, standardHeaders: true, legacyHeaders: false, message: rateLimitMsg }));
+        app.use('/api/auth/login', (0, express_rate_limit_1.default)({ windowMs: defaults_1.RATE_LIMIT_WINDOW_MS, max: rl.auth, standardHeaders: true, legacyHeaders: false, message: rateLimitMsg }));
     }
     const jwtSecret = serverConfig?.jwtSecret;
     const accessTokenTtl = serverConfig?.accessTokenTtl ?? '15m';
@@ -89,7 +90,7 @@ function createRestApp(projectManager, options) {
                 const payload = (0, jwt_1.verifyToken)(accessToken, jwtSecret);
                 if (payload?.type === 'access' && users[payload.userId]) {
                     const user = users[payload.userId];
-                    return res.json({ required: true, authenticated: true, userId: payload.userId, name: user.name });
+                    return res.json({ required: true, authenticated: true, userId: payload.userId, name: user.name, apiKey: user.apiKey });
                 }
             }
         }
@@ -170,7 +171,7 @@ function createRestApp(projectManager, options) {
             }
             // 2. Bearer apiKey (from MCP/API clients)
             const auth = req.headers.authorization;
-            if (auth?.startsWith('Bearer ')) {
+            if (auth?.startsWith('Bearer ') && auth.length > 7) {
                 const apiKey = auth.slice(7);
                 const result = (0, access_1.resolveUserFromApiKey)(apiKey, users);
                 if (result) {
@@ -178,6 +179,7 @@ function createRestApp(projectManager, options) {
                     req.user = result.user;
                     return next();
                 }
+                // Invalid Bearer token — reject (explicit auth attempt should not fall through)
                 return _res.status(401).json({ error: 'Invalid API key' });
             }
             // 3. No auth = anonymous (uses defaultAccess)
@@ -200,13 +202,16 @@ function createRestApp(projectManager, options) {
             const p = projectManager.getProject(id);
             const gc = p.config.graphConfigs;
             const ws = p.workspaceId ? projectManager.getWorkspace(p.workspaceId) : undefined;
-            // Per-graph info: enabled + access level for current user
+            // Per-graph info: enabled, readonly, access level for current user
             const graphs = {};
             for (const gn of multi_config_1.GRAPH_NAMES) {
-                const access = serverConfig
+                let access = serverConfig
                     ? (0, access_1.resolveAccess)(userId, gn, p.config, serverConfig, ws?.config)
                     : 'rw';
-                graphs[gn] = { enabled: gc[gn].enabled, access: gc[gn].enabled ? access : null };
+                // Cap access for readonly graphs
+                if (access === 'rw' && gc[gn].readonly)
+                    access = 'r';
+                graphs[gn] = { enabled: gc[gn].enabled, readonly: gc[gn].readonly, access: gc[gn].enabled ? access : null };
             }
             return {
                 id,
@@ -280,14 +285,23 @@ function createRestApp(projectManager, options) {
     // Middleware: check access level for a graph (read or read-write)
     function requireGraphAccess(graphName, level) {
         return (req, _res, next) => {
+            const p = req.project;
+            // Graph-level readonly: enforce even without auth config
+            const isReadonly = p?.config.graphConfigs[graphName]?.readonly;
+            if (isReadonly) {
+                req.accessLevel = 'r';
+            }
             if (!serverConfig)
                 return next(); // no config = no auth enforcement
-            const p = req.project;
             if (!p)
                 return next();
             const userId = req.userId;
             const ws = p.workspaceId ? projectManager.getWorkspace(p.workspaceId) : undefined;
-            const access = (0, access_1.resolveAccess)(userId, graphName, p.config, serverConfig, ws?.config);
+            let access = (0, access_1.resolveAccess)(userId, graphName, p.config, serverConfig, ws?.config);
+            // Graph-level readonly: cap to 'r' regardless of user permissions
+            if (access === 'rw' && p.config.graphConfigs[graphName]?.readonly) {
+                access = 'r';
+            }
             if (!(0, access_1.canRead)(access)) {
                 return _res.status(403).json({ error: 'Access denied' });
             }
@@ -329,7 +343,9 @@ function createRestApp(projectManager, options) {
             return true;
         const userId = req.userId;
         const ws = p.workspaceId ? projectManager.getWorkspace(p.workspaceId) : undefined;
-        const access = (0, access_1.resolveAccess)(userId, graphName, p.config, serverConfig, ws?.config);
+        let access = (0, access_1.resolveAccess)(userId, graphName, p.config, serverConfig, ws?.config);
+        if (access === 'rw' && p.config.graphConfigs[graphName]?.readonly)
+            access = 'r';
         if (level === 'rw')
             return (0, access_1.canWrite)(access);
         return (0, access_1.canRead)(access);
@@ -338,16 +354,21 @@ function createRestApp(projectManager, options) {
     if (serverConfig?.embeddingApi?.enabled && options?.embeddingApiModelName) {
         app.use('/api/embed', (0, embed_1.createEmbedRouter)(serverConfig.embeddingApi, options.embeddingApiModelName));
     }
-    // Serve UI static files — check dist/ui/ (npm package) then ui/dist/ (dev)
+    // Serve UI at /ui/ path — check dist/ui/ (npm package) then ui/dist/ (dev)
     const uiDistPkg = path_1.default.resolve(__dirname, '../../ui');
     const uiDistDev = path_1.default.resolve(__dirname, '../../../ui/dist');
     const uiDist = fs_1.default.existsSync(uiDistPkg) ? uiDistPkg : uiDistDev;
-    app.use(express_1.default.static(uiDist));
-    // SPA fallback: serve index.html for non-API routes
-    app.get('/{*splat}', (_req, res, next) => {
-        if (_req.path.startsWith('/api/'))
+    // Redirect root to /ui/
+    app.get('/', (_req, res) => { res.redirect('/ui/'); });
+    // Static files under /ui/
+    app.use('/ui', express_1.default.static(uiDist, { redirect: false, index: false }));
+    // SPA fallback: serve index.html for all /ui/* routes
+    const indexHtml = path_1.default.join(uiDist, 'index.html');
+    app.use('/ui', (_req, res, next) => {
+        // Skip requests for actual files (assets with extensions like .js, .css, .png)
+        if (_req.path.includes('.') && !_req.path.endsWith('.html'))
             return next();
-        res.sendFile(path_1.default.join(uiDist, 'index.html'), (err) => {
+        res.sendFile(indexHtml, (err) => {
             if (err)
                 next();
         });

package/dist/api/rest/knowledge.js

@@ -11,7 +11,8 @@ const multer_1 = __importDefault(require("multer"));
 const validation_1 = require("../../api/rest/validation");
 const index_1 = require("../../api/rest/index");
 const manager_types_1 = require("../../graphs/manager-types");
-const upload = (0, multer_1.default)({ storage: multer_1.default.memoryStorage(), limits: { fileSize: 50 * 1024 * 1024 } });
+const defaults_1 = require("../../lib/defaults");
+const upload = (0, multer_1.default)({ storage: multer_1.default.memoryStorage(), limits: { fileSize: defaults_1.MAX_UPLOAD_SIZE } });
 function createKnowledgeRouter() {
     const router = (0, express_1.Router)({ mergeParams: true });
     function getProject(req) {
@@ -52,7 +53,8 @@ function createKnowledgeRouter() {
             const note = p.knowledgeManager.getNote(req.params.noteId);
             if (!note)
                 return res.status(404).json({ error: 'Note not found' });
-            res.json(note);
+            const { embedding: _, ...rest } = note;
+            res.json(rest);
         }
         catch (err) {
             next(err);

package/dist/api/rest/skills.js

@@ -11,7 +11,8 @@ const multer_1 = __importDefault(require("multer"));
 const validation_1 = require("../../api/rest/validation");
 const index_1 = require("../../api/rest/index");
 const manager_types_1 = require("../../graphs/manager-types");
-const upload = (0, multer_1.default)({ storage: multer_1.default.memoryStorage(), limits: { fileSize: 50 * 1024 * 1024 } });
+const defaults_1 = require("../../lib/defaults");
+const upload = (0, multer_1.default)({ storage: multer_1.default.memoryStorage(), limits: { fileSize: defaults_1.MAX_UPLOAD_SIZE } });
 function createSkillsRouter() {
     const router = (0, express_1.Router)({ mergeParams: true });
     function getProject(req) {

package/dist/api/rest/tasks.js

@@ -11,7 +11,8 @@ const multer_1 = __importDefault(require("multer"));
 const validation_1 = require("../../api/rest/validation");
 const index_1 = require("../../api/rest/index");
 const manager_types_1 = require("../../graphs/manager-types");
-const upload = (0, multer_1.default)({ storage: multer_1.default.memoryStorage(), limits: { fileSize: 50 * 1024 * 1024 } });
+const defaults_1 = require("../../lib/defaults");
+const upload = (0, multer_1.default)({ storage: multer_1.default.memoryStorage(), limits: { fileSize: defaults_1.MAX_UPLOAD_SIZE } });
 function createTasksRouter() {
     const router = (0, express_1.Router)({ mergeParams: true });
     function getProject(req) {

package/dist/api/rest/tools.js

@@ -5,6 +5,7 @@ const express_1 = require("express");
 const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
 const inMemory_js_1 = require("@modelcontextprotocol/sdk/inMemory.js");
 const index_1 = require("../../api/index");
+const multi_config_1 = require("../../lib/multi-config");
 // Tool category detection based on tool name
 const TOOL_CATEGORIES = {
     get_context: 'context',
@@ -49,8 +50,14 @@ async function getClient(p, pm) {
         workspaceId: ws?.id,
         workspaceProjects: ws?.config.projects,
     };
+    // Build readonly set from config for defense-in-depth
+    const readonlyGraphs = new Set();
+    for (const gn of multi_config_1.GRAPH_NAMES) {
+        if (p.config.graphConfigs[gn].readonly)
+            readonlyGraphs.add(gn);
+    }
     const [serverTransport, clientTransport] = inMemory_js_1.InMemoryTransport.createLinkedPair();
-    const server = (0, index_1.createMcpServer)(p.docGraph, p.codeGraph, p.knowledgeGraph, p.fileIndexGraph, p.taskGraph, p.embedFns, p.mutationQueue, p.config.projectDir, p.skillGraph, sessionCtx);
+    const server = (0, index_1.createMcpServer)(p.docGraph, p.codeGraph, p.knowledgeGraph, p.fileIndexGraph, p.taskGraph, p.embedFns, p.mutationQueue, p.config.projectDir, p.skillGraph, sessionCtx, readonlyGraphs.size > 0 ? readonlyGraphs : undefined);
     await server.connect(serverTransport);
     const client = new index_js_1.Client({ name: 'tools-explorer', version: '1.0.0' });
     await client.connect(clientTransport);

package/dist/api/rest/validation.js

@@ -4,6 +4,7 @@ exports.attachmentFilenameSchema = exports.linkedQuerySchema = exports.graphExpo
 exports.validateBody = validateBody;
 exports.validateQuery = validateQuery;
 const zod_1 = require("zod");
+const defaults_1 = require("../../lib/defaults");
 function validateBody(schema) {
     return (req, _res, next) => {
         req.body = schema.parse(req.body);
@@ -20,14 +21,14 @@ function validateQuery(schema) {
 // Knowledge schemas
 // ---------------------------------------------------------------------------
 exports.createNoteSchema = zod_1.z.object({
-    title: zod_1.z.string().min(1).max(500),
-    content: zod_1.z.string().max(1_000_000),
-    tags: zod_1.z.array(zod_1.z.string().max(100)).max(100).optional().default([]),
+    title: zod_1.z.string().min(1).max(defaults_1.MAX_TITLE_LEN),
+    content: zod_1.z.string().max(defaults_1.MAX_NOTE_CONTENT_LEN),
+    tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional().default([]),
 });
 exports.updateNoteSchema = zod_1.z.object({
-    title: zod_1.z.string().min(1).max(500).optional(),
-    content: zod_1.z.string().max(1_000_000).optional(),
-    tags: zod_1.z.array(zod_1.z.string().max(100)).max(100).optional(),
+    title: zod_1.z.string().min(1).max(defaults_1.MAX_TITLE_LEN).optional(),
+    content: zod_1.z.string().max(defaults_1.MAX_NOTE_CONTENT_LEN).optional(),
+    tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional(),
     version: zod_1.z.number().int().positive().optional(),
 });
 exports.createRelationSchema = zod_1.z.object({
@@ -38,8 +39,8 @@ exports.createRelationSchema = zod_1.z.object({
     projectId: zod_1.z.string().min(1).optional(),
 });
 exports.noteSearchSchema = zod_1.z.object({
-    q: zod_1.z.string().min(1).max(2000),
-    topK: zod_1.z.coerce.number().int().positive().max(500).optional(),
+    q: zod_1.z.string().min(1).max(defaults_1.MAX_SEARCH_QUERY_LEN),
+    topK: zod_1.z.coerce.number().int().positive().max(defaults_1.MAX_SEARCH_TOP_K).optional(),
     minScore: zod_1.z.coerce.number().min(0).max(1).optional(),
     searchMode: zod_1.z.enum(['hybrid', 'vector', 'keyword']).optional(),
 });
@@ -52,24 +53,24 @@ exports.noteListSchema = zod_1.z.object({
 // Task schemas
 // ---------------------------------------------------------------------------
 exports.createTaskSchema = zod_1.z.object({
-    title: zod_1.z.string().min(1).max(500),
-    description: zod_1.z.string().max(500_000).default(''),
+    title: zod_1.z.string().min(1).max(defaults_1.MAX_TITLE_LEN),
+    description: zod_1.z.string().max(defaults_1.MAX_DESCRIPTION_LEN).default(''),
     status: zod_1.z.enum(['backlog', 'todo', 'in_progress', 'review', 'done', 'cancelled']).default('todo'),
     priority: zod_1.z.enum(['critical', 'high', 'medium', 'low']).default('medium'),
-    tags: zod_1.z.array(zod_1.z.string().max(100)).max(100).optional().default([]),
+    tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional().default([]),
     dueDate: zod_1.z.number().nullable().optional(),
     estimate: zod_1.z.number().nullable().optional(),
-    assignee: zod_1.z.string().max(100).nullable().optional(),
+    assignee: zod_1.z.string().max(defaults_1.MAX_ASSIGNEE_LEN).nullable().optional(),
 });
 exports.updateTaskSchema = zod_1.z.object({
-    title: zod_1.z.string().min(1).max(500).optional(),
-    description: zod_1.z.string().max(500_000).optional(),
+    title: zod_1.z.string().min(1).max(defaults_1.MAX_TITLE_LEN).optional(),
+    description: zod_1.z.string().max(defaults_1.MAX_DESCRIPTION_LEN).optional(),
     status: zod_1.z.enum(['backlog', 'todo', 'in_progress', 'review', 'done', 'cancelled']).optional(),
     priority: zod_1.z.enum(['critical', 'high', 'medium', 'low']).optional(),
-    tags: zod_1.z.array(zod_1.z.string().max(100)).max(100).optional(),
+    tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional(),
     dueDate: zod_1.z.number().nullable().optional(),
     estimate: zod_1.z.number().nullable().optional(),
-    assignee: zod_1.z.string().max(100).nullable().optional(),
+    assignee: zod_1.z.string().max(defaults_1.MAX_ASSIGNEE_LEN).nullable().optional(),
     version: zod_1.z.number().int().positive().optional(),
 });
 exports.moveTaskSchema = zod_1.z.object({
@@ -84,8 +85,8 @@ exports.createTaskLinkSchema = zod_1.z.object({
     projectId: zod_1.z.string().min(1).optional(),
 });
 exports.taskSearchSchema = zod_1.z.object({
-    q: zod_1.z.string().min(1).max(2000),
-    topK: zod_1.z.coerce.number().int().positive().max(500).optional(),
+    q: zod_1.z.string().min(1).max(defaults_1.MAX_SEARCH_QUERY_LEN),
+    topK: zod_1.z.coerce.number().int().positive().max(defaults_1.MAX_SEARCH_TOP_K).optional(),
     minScore: zod_1.z.coerce.number().min(0).max(1).optional(),
     searchMode: zod_1.z.enum(['hybrid', 'vector', 'keyword']).optional(),
 });
@@ -101,8 +102,8 @@ exports.taskListSchema = zod_1.z.object({
 // Search schemas (docs, code, files)
 // ---------------------------------------------------------------------------
 exports.searchQuerySchema = zod_1.z.object({
-    q: zod_1.z.string().min(1).max(2000),
-    topK: zod_1.z.coerce.number().int().positive().max(500).optional(),
+    q: zod_1.z.string().min(1).max(defaults_1.MAX_SEARCH_QUERY_LEN),
+    topK: zod_1.z.coerce.number().int().positive().max(defaults_1.MAX_SEARCH_TOP_K).optional(),
     minScore: zod_1.z.coerce.number().min(0).max(1).optional(),
     searchMode: zod_1.z.enum(['hybrid', 'vector', 'keyword']).optional(),
 });
@@ -127,24 +128,24 @@ exports.fileListSchema = zod_1.z.object({
 // Skill schemas
 // ---------------------------------------------------------------------------
 exports.createSkillSchema = zod_1.z.object({
-    title: zod_1.z.string().min(1).max(500),
-    description: zod_1.z.string().max(500_000).default(''),
-    steps: zod_1.z.array(zod_1.z.string().max(10_000)).max(100).optional().default([]),
-    triggers: zod_1.z.array(zod_1.z.string().max(500)).max(50).optional().default([]),
-    inputHints: zod_1.z.array(zod_1.z.string().max(500)).max(50).optional().default([]),
-    filePatterns: zod_1.z.array(zod_1.z.string().max(500)).max(50).optional().default([]),
-    tags: zod_1.z.array(zod_1.z.string().max(100)).max(100).optional().default([]),
+    title: zod_1.z.string().min(1).max(defaults_1.MAX_TITLE_LEN),
+    description: zod_1.z.string().max(defaults_1.MAX_DESCRIPTION_LEN).default(''),
+    steps: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_STEP_LEN)).max(defaults_1.MAX_SKILL_STEPS_COUNT).optional().default([]),
+    triggers: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_TRIGGER_LEN)).max(defaults_1.MAX_SKILL_TRIGGERS_COUNT).optional().default([]),
+    inputHints: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_TRIGGER_LEN)).max(defaults_1.MAX_SKILL_TRIGGERS_COUNT).optional().default([]),
+    filePatterns: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_TRIGGER_LEN)).max(defaults_1.MAX_SKILL_TRIGGERS_COUNT).optional().default([]),
+    tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional().default([]),
     source: zod_1.z.enum(['user', 'learned']).default('user'),
     confidence: zod_1.z.number().min(0).max(1).default(1),
 });
 exports.updateSkillSchema = zod_1.z.object({
-    title: zod_1.z.string().min(1).max(500).optional(),
-    description: zod_1.z.string().max(500_000).optional(),
-    steps: zod_1.z.array(zod_1.z.string().max(10_000)).max(100).optional(),
-    triggers: zod_1.z.array(zod_1.z.string().max(500)).max(50).optional(),
-    inputHints: zod_1.z.array(zod_1.z.string().max(500)).max(50).optional(),
-    filePatterns: zod_1.z.array(zod_1.z.string().max(500)).max(50).optional(),
-    tags: zod_1.z.array(zod_1.z.string().max(100)).max(100).optional(),
+    title: zod_1.z.string().min(1).max(defaults_1.MAX_TITLE_LEN).optional(),
+    description: zod_1.z.string().max(defaults_1.MAX_DESCRIPTION_LEN).optional(),
+    steps: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_STEP_LEN)).max(defaults_1.MAX_SKILL_STEPS_COUNT).optional(),
+    triggers: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_TRIGGER_LEN)).max(defaults_1.MAX_SKILL_TRIGGERS_COUNT).optional(),
+    inputHints: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_TRIGGER_LEN)).max(defaults_1.MAX_SKILL_TRIGGERS_COUNT).optional(),
+    filePatterns: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_TRIGGER_LEN)).max(defaults_1.MAX_SKILL_TRIGGERS_COUNT).optional(),
+    tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional(),
     source: zod_1.z.enum(['user', 'learned']).optional(),
     confidence: zod_1.z.number().min(0).max(1).optional(),
     version: zod_1.z.number().int().positive().optional(),
@@ -157,8 +158,8 @@ exports.createSkillLinkSchema = zod_1.z.object({
     projectId: zod_1.z.string().min(1).optional(),
 });
 exports.skillSearchSchema = zod_1.z.object({
-    q: zod_1.z.string().min(1).max(2000),
-    topK: zod_1.z.coerce.number().int().positive().max(500).optional(),
+    q: zod_1.z.string().min(1).max(defaults_1.MAX_SEARCH_QUERY_LEN),
+    topK: zod_1.z.coerce.number().int().positive().max(defaults_1.MAX_SEARCH_TOP_K).optional(),
     minScore: zod_1.z.coerce.number().min(0).max(1).optional(),
     searchMode: zod_1.z.enum(['hybrid', 'vector', 'keyword']).optional(),
 });
@@ -179,9 +180,9 @@ exports.graphExportSchema = zod_1.z.object({
 // ---------------------------------------------------------------------------
 exports.linkedQuerySchema = zod_1.z.object({
     targetGraph: zod_1.z.enum(['docs', 'code', 'files', 'knowledge', 'tasks', 'skills']),
-    targetNodeId: zod_1.z.string().min(1).max(500),
-    kind: zod_1.z.string().max(100).optional(),
-    projectId: zod_1.z.string().max(200).optional(),
+    targetNodeId: zod_1.z.string().min(1).max(defaults_1.MAX_TARGET_NODE_ID_LEN),
+    kind: zod_1.z.string().max(defaults_1.MAX_LINK_KIND_LEN).optional(),
+    projectId: zod_1.z.string().max(defaults_1.MAX_PROJECT_ID_LEN).optional(),
 });
 // ---------------------------------------------------------------------------
 // Attachment schemas
@@ -189,7 +190,7 @@ exports.linkedQuerySchema = zod_1.z.object({
 /** Validates an attachment filename (path param). No path separators, no .., no dangerous chars. */
 exports.attachmentFilenameSchema = zod_1.z.string()
     .min(1)
-    .max(255)
+    .max(defaults_1.MAX_ATTACHMENT_FILENAME_LEN)
     .refine(s => !/[/\\]/.test(s), 'Filename must not contain path separators')
     .refine(s => !s.includes('..'), 'Filename must not contain ..')
     .refine(s => !s.includes('\0'), 'Filename must not contain null bytes')

package/dist/api/rest/websocket.js

@@ -3,10 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.attachWebSocket = attachWebSocket;
 const ws_1 = require("ws");
 const jwt_1 = require("../../lib/jwt");
+const defaults_1 = require("../../lib/defaults");
 /**
  * Attach a WebSocket server to the HTTP server at /api/ws.
  * Broadcasts all ProjectManager events to connected clients.
  * Each event includes projectId — clients filter on their side.
+ * Returns a handle with a cleanup function to remove all listeners.
  */
 function attachWebSocket(httpServer, projectManager, options) {
     const wss = new ws_1.WebSocketServer({ noServer: true });
@@ -55,7 +57,8 @@ function attachWebSocket(httpServer, projectManager, options) {
             }
         }
     }
-    // Subscribe to ProjectManager events
+    // Subscribe to ProjectManager events (track handlers for cleanup)
+    const listeners = [];
     const events = [
         'note:created', 'note:updated', 'note:deleted',
         'note:attachment:added', 'note:attachment:deleted',
@@ -66,14 +69,16 @@ function attachWebSocket(httpServer, projectManager, options) {
         'project:indexed',
     ];
     for (const eventType of events) {
-        projectManager.on(eventType, (data) => {
+        const handler = (data) => {
             broadcast({ projectId: data.projectId, type: eventType, data });
-        });
+        };
+        projectManager.on(eventType, handler);
+        listeners.push([eventType, handler]);
     }
     // Debounced graph:updated from indexer
     let graphUpdateTimer;
     let pendingGraphUpdates = new Map();
-    projectManager.on('graph:updated', (data) => {
+    const graphHandler = (data) => {
         const key = data.projectId;
         if (!pendingGraphUpdates.has(key))
             pendingGraphUpdates.set(key, []);
@@ -85,8 +90,20 @@ function attachWebSocket(httpServer, projectManager, options) {
                 }
                 pendingGraphUpdates = new Map();
                 graphUpdateTimer = undefined;
-            }, 1000);
+            }, defaults_1.WS_DEBOUNCE_MS);
         }
-    });
-    return wss;
+    };
+    projectManager.on('graph:updated', graphHandler);
+    listeners.push(['graph:updated', graphHandler]);
+    function cleanup() {
+        for (const [event, handler] of listeners) {
+            projectManager.removeListener(event, handler);
+        }
+        if (graphUpdateTimer) {
+            clearTimeout(graphUpdateTimer);
+            graphUpdateTimer = undefined;
+        }
+        pendingGraphUpdates.clear();
+    }
+    return { wss, cleanup };
 }

package/dist/api/tools/code/search-code.js

@@ -5,23 +5,26 @@ const zod_1 = require("zod");
 function register(server, mgr) {
     server.registerTool('search_code', {
         description: 'Semantic search over the indexed source code. ' +
-            'Finds the most relevant symbols (functions, classes, types) by matching ' +
-            'against their signatures and doc comments using vector similarity, ' +
+            'Supports three modes: hybrid (default, combines BM25 keyword + vector similarity), ' +
+            'vector (embedding only), keyword (BM25 text matching only). ' +
+            'Finds the most relevant symbols (functions, classes, constructors, types) by matching ' +
+            'against name, signature, doc comments, and body text, ' +
             'then expands results by following graph edges (imports, contains, extends). ' +
             'Returns an array sorted by relevance score (0–1), each with: ' +
             'id, fileId, kind, name, signature, docComment, startLine, endLine, score. ' +
-            'Pass an id to get_symbol to read the full implementation.',
+            'Set includeBody=true to include full source code in results (avoids extra get_symbol calls).',
         inputSchema: {
             query: zod_1.z.string().describe('Natural language or code search query, e.g. "function that loads the graph from disk"'),
-            topK: zod_1.z.number().optional().describe('How many top similar symbols to use as seeds (default 5)'),
-            bfsDepth: zod_1.z.number().optional().describe('How many hops to follow graph edges from each seed (default 1; 0 = no expansion)'),
-            maxResults: zod_1.z.number().optional().describe('Maximum number of results to return (default 20)'),
-            minScore: zod_1.z.number().min(0).max(1).optional().describe('Minimum relevance score 0–1; lower values return more results (default 0.5)'),
+            topK: zod_1.z.number().min(1).max(500).optional().describe('How many top similar symbols to use as seeds (default 5)'),
+            bfsDepth: zod_1.z.number().min(0).max(10).optional().describe('How many hops to follow graph edges from each seed (default 1; 0 = no expansion)'),
+            maxResults: zod_1.z.number().min(1).max(500).optional().describe('Maximum number of results to return (default 20)'),
+            minScore: zod_1.z.number().min(0).max(1).optional().describe('Minimum relevance score 0–1; lower values return more results (default 0.3)'),
             bfsDecay: zod_1.z.number().min(0).max(1).optional().describe('Score multiplier per graph hop (default 0.8)'),
             searchMode: zod_1.z.enum(['hybrid', 'vector', 'keyword']).optional().describe('Search mode: hybrid (default, BM25 + vector), vector (embedding only), keyword (BM25 only)'),
+            includeBody: zod_1.z.boolean().optional().describe('Include full source code body in results (default false)'),
         },
-    }, async ({ query, topK, bfsDepth, maxResults, minScore, bfsDecay, searchMode }) => {
-        const results = await mgr.search(query, { topK, bfsDepth, maxResults, minScore, bfsDecay, searchMode });
+    }, async ({ query, topK, bfsDepth, maxResults, minScore, bfsDecay, searchMode, includeBody }) => {
+        const results = await mgr.search(query, { topK, bfsDepth, maxResults, minScore, bfsDecay, searchMode, includeBody });
         return { content: [{ type: 'text', text: JSON.stringify(results, null, 2) }] };
     });
 }

package/dist/api/tools/code/search-files.js

@@ -12,7 +12,7 @@ function register(server, mgr) {
             'Use this to discover which source files are relevant before diving into symbols with get_file_symbols or search_code.',
         inputSchema: {
             query: zod_1.z.string().describe('Natural language or path search query, e.g. "graph persistence" or "search module"'),
-            topK: zod_1.z.number().optional().describe('Maximum number of results to return (default 10)'),
+            topK: zod_1.z.number().min(1).max(500).optional().describe('Maximum number of results to return (default 10)'),
             minScore: zod_1.z.number().min(0).max(1).optional().describe('Minimum relevance score 0–1 (default 0.3)'),
         },
     }, async ({ query, topK, minScore }) => {

package/dist/api/tools/docs/cross-references.js

@@ -17,8 +17,9 @@ function register(server, docMgr, codeMgr) {
     }, async ({ symbol }) => {
         // 1. Search CodeGraph for definitions
         const definitions = [];
+        const symbolLower = symbol.toLowerCase();
         codeGraph.forEachNode((id, attrs) => {
-            if (attrs.name === symbol) {
+            if (attrs.name === symbol || attrs.name.toLowerCase() === symbolLower) {
                 definitions.push({
                     id,
                     fileId: attrs.fileId,
@@ -38,7 +39,7 @@ function register(server, docMgr, codeMgr) {
         docGraph.forEachNode((id, attrs) => {
             if (attrs.symbols.length === 0)
                 return;
-            if (!attrs.symbols.includes(symbol))
+            if (!attrs.symbols.some(s => s === symbol || s.toLowerCase() === symbolLower))
                 return;
             examples.push({
                 id,

package/dist/api/tools/docs/explain-symbol.js

@@ -14,13 +14,14 @@ function register(server, mgr) {
             limit: zod_1.z.number().optional().describe('Max results to return (default 10)'),
         },
     }, async ({ symbol, limit = 10 }) => {
+        const symbolLower = symbol.toLowerCase();
         const results = [];
         graph.forEachNode((id, attrs) => {
             if (results.length >= limit)
                 return;
             if (attrs.symbols.length === 0)
                 return;
-            if (!attrs.symbols.includes(symbol))
+            if (!attrs.symbols.some(s => s === symbol || s.toLowerCase() === symbolLower))
                 return;
             // Find the parent text section
             const parent = findParentTextSection(graph, id, attrs);

package/dist/api/tools/docs/find-examples.js

@@ -14,13 +14,14 @@ function register(server, mgr) {
             limit: zod_1.z.number().optional().describe('Max results to return (default 20)'),
         },
     }, async ({ symbol, limit = 20 }) => {
+        const symbolLower = symbol.toLowerCase();
         const results = [];
         graph.forEachNode((id, attrs) => {
             if (results.length >= limit)
                 return;
             if (attrs.symbols.length === 0)
                 return;
-            if (!attrs.symbols.includes(symbol))
+            if (!attrs.symbols.some(s => s === symbol || s.toLowerCase() === symbolLower))
                 return;
             // Find parent text section (previous node with lower level and no language)
             const parentId = findParentSection(graph, id, attrs);

package/dist/api/tools/docs/search-files.js

@@ -12,7 +12,7 @@ function register(server, mgr) {
             'Use this to discover which doc files are relevant before diving into content with search or get_toc.',
         inputSchema: {
             query: zod_1.z.string().describe('Natural language search query, e.g. "authentication setup" or "API endpoints"'),
-            topK: zod_1.z.number().optional().describe('Maximum number of results to return (default 10)'),
+            topK: zod_1.z.number().min(1).max(500).optional().describe('Maximum number of results to return (default 10)'),
             minScore: zod_1.z.number().min(0).max(1).optional().describe('Minimum relevance score 0–1 (default 0.3)'),
         },
     }, async ({ query, topK, minScore }) => {

package/dist/api/tools/docs/search-snippets.js

@@ -12,7 +12,7 @@ function register(server, mgr) {
             'Returns code block nodes sorted by relevance score.',
         inputSchema: {
             query: zod_1.z.string().describe('Natural language search query'),
-            topK: zod_1.z.number().optional().describe('Max results to return (default 10)'),
+            topK: zod_1.z.number().min(1).max(500).optional().describe('Max results to return (default 10)'),
             minScore: zod_1.z.number().min(0).max(1).optional().describe('Minimum relevance score 0–1 (default 0.3)'),
             language: zod_1.z.string().optional().describe('Filter by language, e.g. "typescript", "python"'),
         },

package/dist/api/tools/docs/search.js

@@ -5,7 +5,8 @@ const zod_1 = require("zod");
 function register(server, mgr) {
     server.registerTool('search', {
         description: 'Semantic search over the indexed documentation. ' +
-            'Finds the most relevant sections using vector similarity, then expands results ' +
+            'Supports three modes: hybrid (default, BM25 + vector), vector, keyword. ' +
+            'Finds the most relevant sections, then expands results ' +
             'by traversing links between documents (graph walk). ' +
             'Returns an array of chunks sorted by relevance score (0–1), each with: ' +
             'id, fileId, title, content, level, score. ' +
@@ -13,9 +14,9 @@ function register(server, mgr) {
             'Prefer this tool when looking for information without knowing which file contains it.',
         inputSchema: {
             query: zod_1.z.string().describe('Natural language search query'),
-            topK: zod_1.z.number().optional().describe('How many top similar sections to use as seeds for graph expansion (default 5)'),
-            bfsDepth: zod_1.z.number().optional().describe('How many hops to follow cross-document links from each seed (default 1; 0 = no expansion)'),
-            maxResults: zod_1.z.number().optional().describe('Maximum number of results to return (default 20)'),
+            topK: zod_1.z.number().min(1).max(500).optional().describe('How many top similar sections to use as seeds for graph expansion (default 5)'),
+            bfsDepth: zod_1.z.number().min(0).max(10).optional().describe('How many hops to follow cross-document links from each seed (default 1; 0 = no expansion)'),
+            maxResults: zod_1.z.number().min(1).max(500).optional().describe('Maximum number of results to return (default 20)'),
             minScore: zod_1.z.number().min(0).max(1).optional().describe('Minimum relevance score threshold 0–1; lower values return more results (default 0.5)'),
             bfsDecay: zod_1.z.number().min(0).max(1).optional().describe('Score multiplier applied per graph hop; controls how quickly relevance fades with distance (default 0.8)'),
             searchMode: zod_1.z.enum(['hybrid', 'vector', 'keyword']).optional().describe('Search mode: hybrid (default, BM25 + vector), vector (embedding only), keyword (BM25 only)'),

package/dist/api/tools/file-index/search-all-files.js

@@ -12,7 +12,7 @@ function register(server, mgr) {
             'Use this to discover which project files are relevant to a topic.',
         inputSchema: {
             query: zod_1.z.string().describe('Search query'),
-            topK: zod_1.z.number().optional().default(10)
+            topK: zod_1.z.number().min(1).max(500).optional().default(10)
                 .describe('Max results (default 10)'),
             minScore: zod_1.z.number().optional().default(0.3)
                 .describe('Minimum cosine similarity score (default 0.3)'),