@graphmemory/server 1.3.2 → 1.3.3

package/dist/api/tools/knowledge/search-notes.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('search_notes', {
         description: 'Semantic search over the knowledge graph (facts and notes). ' +
@@ -11,7 +12,7 @@ function register(server, mgr) {
             'Returns an array sorted by relevance score (0–1), each with: ' +
             'id, title, content, tags, score.',
         inputSchema: {
-            query: zod_1.z.string().describe('Natural language search query'),
+            query: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Natural language search query'),
             topK: zod_1.z.number().min(1).max(500).optional().describe('How many top similar notes to use as seeds (default 5)'),
             bfsDepth: zod_1.z.number().min(0).max(10).optional().describe('How many hops to follow relations from each seed (default 1; 0 = no expansion)'),
             maxResults: zod_1.z.number().min(1).max(500).optional().describe('Maximum number of results to return (default 20)'),

package/dist/api/tools/knowledge/update-note.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
 const manager_types_1 = require("../../../graphs/manager-types");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('update_note', {
         description: 'Update an existing note in the knowledge graph. ' +
@@ -10,17 +11,17 @@ function register(server, mgr) {
             'Re-embeds automatically if title or content changes. ' +
             'Pass expectedVersion to enable optimistic locking.',
         inputSchema: {
-            noteId: zod_1.z.string().describe('ID of the note to update'),
-            title: zod_1.z.string().optional().describe('New title'),
-            content: zod_1.z.string().optional().describe('New content'),
-            tags: zod_1.z.array(zod_1.z.string()).optional().describe('New tags (replaces existing)'),
+            noteId: zod_1.z.string().max(500).describe('ID of the note to update'),
+            title: zod_1.z.string().max(defaults_1.MAX_TITLE_LEN).optional().describe('New title'),
+            content: zod_1.z.string().max(defaults_1.MAX_NOTE_CONTENT_LEN).optional().describe('New content'),
+            tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional().describe('New tags (replaces existing)'),
             expectedVersion: zod_1.z.number().int().positive().optional().describe('Current version for optimistic locking — request fails with version_conflict if the note has been updated since'),
         },
     }, async ({ noteId, title, content, tags, expectedVersion }) => {
         try {
             const updated = await mgr.updateNote(noteId, { title, content, tags }, expectedVersion);
             if (!updated) {
-                return { content: [{ type: 'text', text: `Note not found: ${noteId}` }], isError: true };
+                return { content: [{ type: 'text', text: 'Note not found' }], isError: true };
             }
             return { content: [{ type: 'text', text: JSON.stringify({ noteId, updated: true }, null, 2) }] };
         }

package/dist/api/tools/skills/add-attachment.js

@@ -14,14 +14,36 @@ function register(server, mgr) {
             'The file is copied into the skill directory (.skills/{skillId}/). ' +
             'Returns attachment metadata (filename, mimeType, size).',
         inputSchema: {
-            skillId: zod_1.z.string().describe('ID of the skill to attach the file to'),
-            filePath: zod_1.z.string().describe('Absolute path to the file on disk'),
+            skillId: zod_1.z.string().max(500).describe('ID of the skill to attach the file to'),
+            filePath: zod_1.z.string().max(4096).describe('Absolute path to the file on disk'),
         },
     }, async ({ skillId, filePath }) => {
         const resolved = path_1.default.resolve(filePath);
+        const projectDir = mgr.projectDir;
+        if (!projectDir) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'No project directory configured' }) }], isError: true };
+        }
+        let realResolved;
+        try {
+            realResolved = fs_1.default.realpathSync(resolved);
+        }
+        catch {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'File not found' }) }], isError: true };
+        }
+        let realProject;
+        try {
+            realProject = fs_1.default.realpathSync(path_1.default.resolve(projectDir));
+        }
+        catch {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'Project directory not found' }) }], isError: true };
+        }
+        const normalizedProject = realProject + path_1.default.sep;
+        if (!realResolved.startsWith(normalizedProject) && realResolved !== realProject) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'File path must be within the project directory' }) }], isError: true };
+        }
         let stat;
         try {
-            stat = fs_1.default.statSync(resolved);
+            stat = fs_1.default.statSync(realResolved);
         }
         catch {
             return { content: [{ type: 'text', text: JSON.stringify({ error: 'File not found' }) }], isError: true };
@@ -32,7 +54,7 @@ function register(server, mgr) {
         if (stat.size > defaults_1.MAX_UPLOAD_SIZE) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: 'File exceeds 50 MB limit' }) }], isError: true };
         }
-        const data = fs_1.default.readFileSync(resolved);
+        const data = fs_1.default.readFileSync(realResolved);
         const filename = path_1.default.basename(resolved);
         const meta = mgr.addAttachment(skillId, filename, data);
         if (!meta) {

package/dist/api/tools/skills/bump-usage.js

@@ -7,12 +7,12 @@ function register(server, mgr) {
         description: 'Record that a skill was used. Increments usageCount and updates lastUsedAt timestamp. ' +
             'Call this after successfully applying a skill.',
         inputSchema: {
-            skillId: zod_1.z.string().describe('Skill ID to bump usage for'),
+            skillId: zod_1.z.string().max(500).describe('Skill ID to bump usage for'),
         },
     }, async ({ skillId }) => {
         const ok = mgr.bumpUsage(skillId);
         if (!ok) {
-            return { content: [{ type: 'text', text: `Skill "${skillId}" not found.` }], isError: true };
+            return { content: [{ type: 'text', text: 'Skill not found' }], isError: true };
         }
         return { content: [{ type: 'text', text: JSON.stringify({ skillId, bumped: true }, null, 2) }] };
     });

package/dist/api/tools/skills/create-skill-link.js

@@ -2,23 +2,24 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('create_skill_link', {
         description: 'Link a skill to a node in the docs, code, files, knowledge, or tasks graph. ' +
             'Creates a cross-graph relation from the skill to the target node. ' +
             'The kind is a free-form string, e.g. "references", "implements", "documents".',
         inputSchema: {
-            skillId: zod_1.z.string().describe('Source skill ID'),
-            targetId: zod_1.z.string().describe('Target node ID in the external graph (e.g. "src/auth.ts::login", "api.md::Setup", "my-note", "my-task")'),
+            skillId: zod_1.z.string().max(500).describe('Source skill ID'),
+            targetId: zod_1.z.string().max(defaults_1.MAX_TARGET_NODE_ID_LEN).describe('Target node ID in the external graph (e.g. "src/auth.ts::login", "api.md::Setup", "my-note", "my-task")'),
             targetGraph: zod_1.z.enum(['docs', 'code', 'files', 'knowledge', 'tasks'])
                 .describe('Which graph the target belongs to'),
-            kind: zod_1.z.string().describe('Relation type, e.g. "references", "implements", "documents"'),
-            projectId: zod_1.z.string().optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
+            kind: zod_1.z.string().max(defaults_1.MAX_LINK_KIND_LEN).describe('Relation type, e.g. "references", "implements", "documents"'),
+            projectId: zod_1.z.string().max(defaults_1.MAX_PROJECT_ID_LEN).optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
         },
     }, async ({ skillId, targetId, targetGraph, kind, projectId }) => {
         const created = mgr.createCrossLink(skillId, targetId, targetGraph, kind, projectId);
         if (!created) {
-            return { content: [{ type: 'text', text: `Could not create cross-graph link — skill not found, target not found in ${targetGraph} graph, or link already exists.` }], isError: true };
+            return { content: [{ type: 'text', text: 'Could not create cross-graph link — skill not found, target not found, or link already exists.' }], isError: true };
         }
         return { content: [{ type: 'text', text: JSON.stringify({ skillId, targetId, targetGraph, kind, created: true }, null, 2) }] };
     });

package/dist/api/tools/skills/create-skill.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('create_skill', {
         description: 'Create a new skill (reusable recipe/procedure) in the skill graph. ' +
@@ -9,13 +10,13 @@ function register(server, mgr) {
             'Returns the generated skillId (slug from title). ' +
             'Use link_skill to connect skills, or create_skill_link to link to docs/code/files/knowledge/tasks.',
         inputSchema: {
-            title: zod_1.z.string().describe('Short title for the skill, e.g. "Deploy to staging"'),
-            description: zod_1.z.string().describe('Full description of the skill (markdown)'),
-            steps: zod_1.z.array(zod_1.z.string()).optional().describe('Ordered steps to execute this skill (default [])'),
-            triggers: zod_1.z.array(zod_1.z.string()).optional().describe('Conditions or cues that suggest using this skill (default [])'),
-            inputHints: zod_1.z.array(zod_1.z.string()).optional().describe('Expected inputs or prerequisites (default [])'),
-            filePatterns: zod_1.z.array(zod_1.z.string()).optional().describe('Glob patterns for files this skill applies to (default [])'),
-            tags: zod_1.z.array(zod_1.z.string()).optional().describe('Optional tags for filtering, e.g. ["deploy", "ci"]'),
+            title: zod_1.z.string().max(defaults_1.MAX_TITLE_LEN).describe('Short title for the skill, e.g. "Deploy to staging"'),
+            description: zod_1.z.string().max(defaults_1.MAX_DESCRIPTION_LEN).describe('Full description of the skill (markdown)'),
+            steps: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_STEP_LEN)).max(defaults_1.MAX_SKILL_STEPS_COUNT).optional().describe('Ordered steps to execute this skill (default [])'),
+            triggers: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_TRIGGER_LEN)).max(defaults_1.MAX_SKILL_TRIGGERS_COUNT).optional().describe('Conditions or cues that suggest using this skill (default [])'),
+            inputHints: zod_1.z.array(zod_1.z.string().max(500)).max(100).optional().describe('Expected inputs or prerequisites (default [])'),
+            filePatterns: zod_1.z.array(zod_1.z.string().max(500)).max(100).optional().describe('Glob patterns for files this skill applies to (default [])'),
+            tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional().describe('Optional tags for filtering, e.g. ["deploy", "ci"]'),
             source: zod_1.z.enum(['user', 'learned']).optional().describe('How this skill was created (default "user")'),
             confidence: zod_1.z.number().min(0).max(1).optional().describe('Confidence score 0–1 (default 1)'),
         },

package/dist/api/tools/skills/delete-skill-link.js

@@ -2,16 +2,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('delete_skill_link', {
         description: 'Remove a cross-graph link from a skill to a node in the docs, code, files, knowledge, or tasks graph. ' +
             'Orphaned proxy nodes are cleaned up automatically.',
         inputSchema: {
-            skillId: zod_1.z.string().describe('Source skill ID'),
-            targetId: zod_1.z.string().describe('Target node ID in the external graph'),
+            skillId: zod_1.z.string().max(500).describe('Source skill ID'),
+            targetId: zod_1.z.string().max(defaults_1.MAX_TARGET_NODE_ID_LEN).describe('Target node ID in the external graph'),
             targetGraph: zod_1.z.enum(['docs', 'code', 'files', 'knowledge', 'tasks'])
                 .describe('Which graph the target belongs to'),
-            projectId: zod_1.z.string().optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
+            projectId: zod_1.z.string().max(defaults_1.MAX_PROJECT_ID_LEN).optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
         },
     }, async ({ skillId, targetId, targetGraph, projectId }) => {
         const deleted = mgr.deleteCrossLink(skillId, targetId, targetGraph, projectId);

package/dist/api/tools/skills/delete-skill.js

@@ -8,12 +8,12 @@ function register(server, mgr) {
             'Orphaned proxy nodes are cleaned up automatically. ' +
             'This action is irreversible.',
         inputSchema: {
-            skillId: zod_1.z.string().describe('Skill ID to delete'),
+            skillId: zod_1.z.string().max(500).describe('Skill ID to delete'),
         },
     }, async ({ skillId }) => {
         const deleted = mgr.deleteSkill(skillId);
         if (!deleted) {
-            return { content: [{ type: 'text', text: `Skill "${skillId}" not found.` }], isError: true };
+            return { content: [{ type: 'text', text: 'Skill not found' }], isError: true };
         }
         return { content: [{ type: 'text', text: JSON.stringify({ skillId, deleted: true }, null, 2) }] };
     });

package/dist/api/tools/skills/find-linked-skills.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('find_linked_skills', {
         description: 'Find all skills that link to a specific node in the docs, code, files, knowledge, or tasks graph. ' +
@@ -11,9 +12,9 @@ function register(server, mgr) {
         inputSchema: {
             targetGraph: zod_1.z.enum(['docs', 'code', 'files', 'knowledge', 'tasks'])
                 .describe('Which graph the target belongs to'),
-            targetNodeId: zod_1.z.string().describe('Target node ID in the external graph'),
-            kind: zod_1.z.string().optional().describe('Filter by relation kind. If omitted, returns all relations.'),
-            projectId: zod_1.z.string().optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
+            targetNodeId: zod_1.z.string().max(defaults_1.MAX_TARGET_NODE_ID_LEN).describe('Target node ID in the external graph'),
+            kind: zod_1.z.string().max(defaults_1.MAX_LINK_KIND_LEN).optional().describe('Filter by relation kind. If omitted, returns all relations.'),
+            projectId: zod_1.z.string().max(defaults_1.MAX_PROJECT_ID_LEN).optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
         },
     }, async ({ targetGraph, targetNodeId, kind, projectId }) => {
         const results = mgr.findLinkedSkills(targetGraph, targetNodeId, kind, projectId);

package/dist/api/tools/skills/get-skill.js

@@ -9,12 +9,12 @@ function register(server, mgr) {
             'Returns: id, title, description, steps, triggers, inputHints, filePatterns, tags, ' +
             'source, confidence, usageCount, lastUsedAt, createdAt, updatedAt, crossLinks[].',
         inputSchema: {
-            skillId: zod_1.z.string().describe('Skill ID to retrieve'),
+            skillId: zod_1.z.string().max(500).describe('Skill ID to retrieve'),
         },
     }, async ({ skillId }) => {
         const skill = mgr.getSkill(skillId);
         if (!skill) {
-            return { content: [{ type: 'text', text: `Skill "${skillId}" not found.` }], isError: true };
+            return { content: [{ type: 'text', text: 'Skill not found' }], isError: true };
         }
         return { content: [{ type: 'text', text: JSON.stringify(skill, null, 2) }] };
     });

package/dist/api/tools/skills/link-skill.js

@@ -9,8 +9,8 @@ function register(server, mgr) {
             '"related_to": free association between skills. ' +
             '"variant_of": fromId is a variant of toId.',
         inputSchema: {
-            fromId: zod_1.z.string().describe('Source skill ID'),
-            toId: zod_1.z.string().describe('Target skill ID'),
+            fromId: zod_1.z.string().max(500).describe('Source skill ID'),
+            toId: zod_1.z.string().max(500).describe('Target skill ID'),
             kind: zod_1.z.enum(['depends_on', 'related_to', 'variant_of']).describe('Relation type'),
         },
     }, async ({ fromId, toId, kind }) => {

package/dist/api/tools/skills/list-skills.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('list_skills', {
         description: 'List skills with optional filters. ' +
@@ -9,9 +10,9 @@ function register(server, mgr) {
             'Use search_skills for semantic search.',
         inputSchema: {
             source: zod_1.z.enum(['user', 'learned']).optional().describe('Filter by source'),
-            tag: zod_1.z.string().optional().describe('Filter by tag (exact match, case-insensitive)'),
-            filter: zod_1.z.string().optional().describe('Substring match on title or ID'),
-            limit: zod_1.z.number().optional().describe('Max results (default 50)'),
+            tag: zod_1.z.string().max(defaults_1.MAX_TAG_LEN).optional().describe('Filter by tag (exact match, case-insensitive)'),
+            filter: zod_1.z.string().max(500).optional().describe('Substring match on title or ID'),
+            limit: zod_1.z.number().max(1000).optional().describe('Max results (default 50)'),
         },
     }, async ({ source, tag, filter, limit }) => {
         const results = mgr.listSkills({ source, tag, filter, limit });

package/dist/api/tools/skills/recall-skills.js

@@ -2,12 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('recall_skills', {
         description: 'Recall relevant skills for a given task context. Like search_skills but with lower ' +
             'minScore default (0.3) for higher recall. Use at the start of a task to find applicable recipes.',
         inputSchema: {
-            context: zod_1.z.string().describe('Description of the current task or context to match skills against'),
+            context: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Description of the current task or context to match skills against'),
             topK: zod_1.z.number().min(1).max(500).optional().describe('How many top similar skills to use as seeds (default 5)'),
             minScore: zod_1.z.number().min(0).max(1).optional().describe('Minimum relevance score 0–1 (default 0.3)'),
         },

package/dist/api/tools/skills/remove-attachment.js

@@ -6,7 +6,7 @@ function register(server, mgr) {
     server.registerTool('remove_skill_attachment', {
         description: 'Remove an attachment from a skill. The file is deleted from disk.',
         inputSchema: {
-            skillId: zod_1.z.string().describe('ID of the skill'),
+            skillId: zod_1.z.string().max(500).describe('ID of the skill'),
             filename: zod_1.z.string().min(1).max(255)
                 .refine(s => !/[/\\]/.test(s), 'Filename must not contain path separators')
                 .refine(s => !s.includes('..'), 'Filename must not contain ..')

package/dist/api/tools/skills/search-skills.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('search_skills', {
         description: 'Semantic search over the skill graph. ' +
@@ -11,7 +12,7 @@ function register(server, mgr) {
             'Returns an array sorted by relevance score (0–1), each with: ' +
             'id, title, description, tags, source, confidence, usageCount, score.',
         inputSchema: {
-            query: zod_1.z.string().describe('Natural language search query'),
+            query: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Natural language search query'),
             topK: zod_1.z.number().min(1).max(500).optional().describe('How many top similar skills to use as seeds (default 5)'),
             bfsDepth: zod_1.z.number().min(0).max(10).optional().describe('How many hops to follow relations from each seed (default 1; 0 = no expansion)'),
             maxResults: zod_1.z.number().min(1).max(500).optional().describe('Maximum number of results to return (default 20)'),

package/dist/api/tools/skills/update-skill.js

@@ -3,20 +3,21 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
 const manager_types_1 = require("../../../graphs/manager-types");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('update_skill', {
         description: 'Update an existing skill. Only provided fields are changed. ' +
             'Re-embeds automatically when title or description changes. ' +
             'Pass expectedVersion to enable optimistic locking.',
         inputSchema: {
-            skillId: zod_1.z.string().describe('Skill ID to update'),
-            title: zod_1.z.string().optional().describe('New title'),
-            description: zod_1.z.string().optional().describe('New description'),
-            steps: zod_1.z.array(zod_1.z.string()).optional().describe('Replace steps array'),
-            triggers: zod_1.z.array(zod_1.z.string()).optional().describe('Replace triggers array'),
-            inputHints: zod_1.z.array(zod_1.z.string()).optional().describe('Replace inputHints array'),
-            filePatterns: zod_1.z.array(zod_1.z.string()).optional().describe('Replace filePatterns array'),
-            tags: zod_1.z.array(zod_1.z.string()).optional().describe('Replace tags array'),
+            skillId: zod_1.z.string().max(500).describe('Skill ID to update'),
+            title: zod_1.z.string().max(defaults_1.MAX_TITLE_LEN).optional().describe('New title'),
+            description: zod_1.z.string().max(defaults_1.MAX_DESCRIPTION_LEN).optional().describe('New description'),
+            steps: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_STEP_LEN)).max(defaults_1.MAX_SKILL_STEPS_COUNT).optional().describe('Replace steps array'),
+            triggers: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_SKILL_TRIGGER_LEN)).max(defaults_1.MAX_SKILL_TRIGGERS_COUNT).optional().describe('Replace triggers array'),
+            inputHints: zod_1.z.array(zod_1.z.string().max(500)).max(100).optional().describe('Replace inputHints array'),
+            filePatterns: zod_1.z.array(zod_1.z.string().max(500)).max(100).optional().describe('Replace filePatterns array'),
+            tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional().describe('Replace tags array'),
             source: zod_1.z.enum(['user', 'learned']).optional().describe('New source'),
             confidence: zod_1.z.number().min(0).max(1).optional().describe('New confidence score 0–1'),
             expectedVersion: zod_1.z.number().int().positive().optional().describe('Current version for optimistic locking — request fails with version_conflict if the skill has been updated since'),
@@ -44,7 +45,7 @@ function register(server, mgr) {
         try {
             const updated = await mgr.updateSkill(skillId, patch, expectedVersion);
             if (!updated) {
-                return { content: [{ type: 'text', text: `Skill "${skillId}" not found.` }], isError: true };
+                return { content: [{ type: 'text', text: 'Skill not found' }], isError: true };
             }
             return { content: [{ type: 'text', text: JSON.stringify({ skillId, updated: true }, null, 2) }] };
         }

package/dist/api/tools/tasks/add-attachment.js

@@ -14,14 +14,36 @@ function register(server, mgr) {
             'The file is copied into the task directory (.tasks/{taskId}/). ' +
             'Returns attachment metadata (filename, mimeType, size).',
         inputSchema: {
-            taskId: zod_1.z.string().describe('ID of the task to attach the file to'),
-            filePath: zod_1.z.string().describe('Absolute path to the file on disk'),
+            taskId: zod_1.z.string().max(500).describe('ID of the task to attach the file to'),
+            filePath: zod_1.z.string().max(4096).describe('Absolute path to the file on disk'),
         },
     }, async ({ taskId, filePath }) => {
         const resolved = path_1.default.resolve(filePath);
+        const projectDir = mgr.projectDir;
+        if (!projectDir) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'No project directory configured' }) }], isError: true };
+        }
+        let realResolved;
+        try {
+            realResolved = fs_1.default.realpathSync(resolved);
+        }
+        catch {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'File not found' }) }], isError: true };
+        }
+        let realProject;
+        try {
+            realProject = fs_1.default.realpathSync(path_1.default.resolve(projectDir));
+        }
+        catch {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'Project directory not found' }) }], isError: true };
+        }
+        const normalizedProject = realProject + path_1.default.sep;
+        if (!realResolved.startsWith(normalizedProject) && realResolved !== realProject) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'File path must be within the project directory' }) }], isError: true };
+        }
         let stat;
         try {
-            stat = fs_1.default.statSync(resolved);
+            stat = fs_1.default.statSync(realResolved);
         }
         catch {
             return { content: [{ type: 'text', text: JSON.stringify({ error: 'File not found' }) }], isError: true };
@@ -32,7 +54,7 @@ function register(server, mgr) {
         if (stat.size > defaults_1.MAX_UPLOAD_SIZE) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: 'File exceeds 50 MB limit' }) }], isError: true };
         }
-        const data = fs_1.default.readFileSync(resolved);
+        const data = fs_1.default.readFileSync(realResolved);
         const filename = path_1.default.basename(resolved);
         const meta = mgr.addAttachment(taskId, filename, data);
         if (!meta) {

package/dist/api/tools/tasks/create-task-link.js

@@ -2,23 +2,24 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('create_task_link', {
         description: 'Link a task to a node in the docs, code, files, or knowledge graph. ' +
             'Creates a cross-graph relation from the task to the target node. ' +
             'The kind is a free-form string, e.g. "references", "fixes", "implements", "documents".',
         inputSchema: {
-            taskId: zod_1.z.string().describe('Source task ID'),
-            targetId: zod_1.z.string().describe('Target node ID in the external graph (e.g. "src/auth.ts::login", "api.md::Setup", "my-note")'),
+            taskId: zod_1.z.string().max(500).describe('Source task ID'),
+            targetId: zod_1.z.string().max(defaults_1.MAX_TARGET_NODE_ID_LEN).describe('Target node ID in the external graph (e.g. "src/auth.ts::login", "api.md::Setup", "my-note")'),
             targetGraph: zod_1.z.enum(['docs', 'code', 'files', 'knowledge', 'skills'])
                 .describe('Which graph the target belongs to'),
-            kind: zod_1.z.string().describe('Relation type, e.g. "references", "fixes", "implements"'),
-            projectId: zod_1.z.string().optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
+            kind: zod_1.z.string().max(defaults_1.MAX_LINK_KIND_LEN).describe('Relation type, e.g. "references", "fixes", "implements"'),
+            projectId: zod_1.z.string().max(defaults_1.MAX_PROJECT_ID_LEN).optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
         },
     }, async ({ taskId, targetId, targetGraph, kind, projectId }) => {
         const created = mgr.createCrossLink(taskId, targetId, targetGraph, kind, projectId);
         if (!created) {
-            return { content: [{ type: 'text', text: `Could not create cross-graph link — task not found, target not found in ${targetGraph} graph, or link already exists.` }], isError: true };
+            return { content: [{ type: 'text', text: 'Could not create cross-graph link — task not found, target not found, or link already exists.' }], isError: true };
         }
         return { content: [{ type: 'text', text: JSON.stringify({ taskId, targetId, targetGraph, kind, created: true }, null, 2) }] };
     });

package/dist/api/tools/tasks/create-task.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('create_task', {
         description: 'Create a new task in the task graph. ' +
@@ -9,15 +10,15 @@ function register(server, mgr) {
             'Returns the generated taskId (slug from title). ' +
             'Use link_task to connect tasks, or create_task_link to link to docs/code/files/knowledge.',
         inputSchema: {
-            title: zod_1.z.string().describe('Short title for the task, e.g. "Fix auth redirect loop"'),
-            description: zod_1.z.string().describe('Full description of the task (markdown)'),
+            title: zod_1.z.string().max(defaults_1.MAX_TITLE_LEN).describe('Short title for the task, e.g. "Fix auth redirect loop"'),
+            description: zod_1.z.string().max(defaults_1.MAX_DESCRIPTION_LEN).describe('Full description of the task (markdown)'),
             priority: zod_1.z.enum(['critical', 'high', 'medium', 'low']).describe('Task priority'),
             status: zod_1.z.enum(['backlog', 'todo', 'in_progress', 'review', 'done', 'cancelled']).optional()
                 .describe('Initial status (default "backlog")'),
-            tags: zod_1.z.array(zod_1.z.string()).optional().describe('Optional tags for filtering, e.g. ["bug", "auth"]'),
+            tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional().describe('Optional tags for filtering, e.g. ["bug", "auth"]'),
             dueDate: zod_1.z.number().optional().describe('Due date as Unix timestamp in milliseconds'),
             estimate: zod_1.z.number().optional().describe('Estimated effort in hours'),
-            assignee: zod_1.z.string().optional().describe('Team member ID to assign the task to'),
+            assignee: zod_1.z.string().max(defaults_1.MAX_ASSIGNEE_LEN).optional().describe('Team member ID to assign the task to'),
         },
     }, async ({ title, description, priority, status, tags, dueDate, estimate, assignee }) => {
         const taskId = await mgr.createTask(title, description, status ?? 'backlog', priority, tags ?? [], dueDate ?? null, estimate ?? null, assignee ?? null);

package/dist/api/tools/tasks/delete-task-link.js

@@ -2,16 +2,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('delete_task_link', {
         description: 'Remove a cross-graph link from a task to a node in the docs, code, files, or knowledge graph. ' +
             'Orphaned proxy nodes are cleaned up automatically.',
         inputSchema: {
-            taskId: zod_1.z.string().describe('Source task ID'),
-            targetId: zod_1.z.string().describe('Target node ID in the external graph'),
+            taskId: zod_1.z.string().max(500).describe('Source task ID'),
+            targetId: zod_1.z.string().max(defaults_1.MAX_TARGET_NODE_ID_LEN).describe('Target node ID in the external graph'),
             targetGraph: zod_1.z.enum(['docs', 'code', 'files', 'knowledge', 'skills'])
                 .describe('Which graph the target belongs to'),
-            projectId: zod_1.z.string().optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
+            projectId: zod_1.z.string().max(defaults_1.MAX_PROJECT_ID_LEN).optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
         },
     }, async ({ taskId, targetId, targetGraph, projectId }) => {
         const deleted = mgr.deleteCrossLink(taskId, targetId, targetGraph, projectId);

package/dist/api/tools/tasks/delete-task.js

@@ -8,12 +8,12 @@ function register(server, mgr) {
             'Orphaned proxy nodes are cleaned up automatically. ' +
             'This action is irreversible.',
         inputSchema: {
-            taskId: zod_1.z.string().describe('Task ID to delete'),
+            taskId: zod_1.z.string().max(500).describe('Task ID to delete'),
         },
     }, async ({ taskId }) => {
         const deleted = mgr.deleteTask(taskId);
         if (!deleted) {
-            return { content: [{ type: 'text', text: `Task "${taskId}" not found.` }], isError: true };
+            return { content: [{ type: 'text', text: 'Task not found' }], isError: true };
         }
         return { content: [{ type: 'text', text: JSON.stringify({ taskId, deleted: true }, null, 2) }] };
     });

package/dist/api/tools/tasks/find-linked-tasks.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('find_linked_tasks', {
         description: 'Find all tasks that link to a specific node in the docs, code, files, or knowledge graph. ' +
@@ -9,11 +10,11 @@ function register(server, mgr) {
             'Returns an array of { taskId, title, kind, status, priority, tags }. ' +
             'Use get_task to fetch full content of a returned task.',
         inputSchema: {
-            targetId: zod_1.z.string().describe('Target node ID in the external graph'),
+            targetId: zod_1.z.string().max(defaults_1.MAX_TARGET_NODE_ID_LEN).describe('Target node ID in the external graph'),
             targetGraph: zod_1.z.enum(['docs', 'code', 'files', 'knowledge', 'skills'])
                 .describe('Which graph the target belongs to'),
-            kind: zod_1.z.string().optional().describe('Filter by relation kind. If omitted, returns all relations.'),
-            projectId: zod_1.z.string().optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
+            kind: zod_1.z.string().max(defaults_1.MAX_LINK_KIND_LEN).optional().describe('Filter by relation kind. If omitted, returns all relations.'),
+            projectId: zod_1.z.string().max(defaults_1.MAX_PROJECT_ID_LEN).optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
         },
     }, async ({ targetId, targetGraph, kind, projectId }) => {
         const results = mgr.findLinkedTasks(targetGraph, targetId, kind, projectId);

package/dist/api/tools/tasks/get-task.js

@@ -8,12 +8,12 @@ function register(server, mgr) {
             'Returns: id, title, description, status, priority, tags, dueDate, estimate, ' +
             'completedAt, createdAt, updatedAt, subtasks[], blockedBy[], blocks[], related[], crossLinks[].',
         inputSchema: {
-            taskId: zod_1.z.string().describe('Task ID to retrieve'),
+            taskId: zod_1.z.string().max(500).describe('Task ID to retrieve'),
         },
     }, async ({ taskId }) => {
         const task = mgr.getTask(taskId);
         if (!task) {
-            return { content: [{ type: 'text', text: `Task "${taskId}" not found.` }], isError: true };
+            return { content: [{ type: 'text', text: 'Task not found' }], isError: true };
         }
         return { content: [{ type: 'text', text: JSON.stringify(task, null, 2) }] };
     });

package/dist/api/tools/tasks/link-task.js

@@ -9,8 +9,8 @@ function register(server, mgr) {
             '"blocks": fromId blocks toId. ' +
             '"related_to": free association between tasks.',
         inputSchema: {
-            fromId: zod_1.z.string().describe('Source task ID'),
-            toId: zod_1.z.string().describe('Target task ID'),
+            fromId: zod_1.z.string().max(500).describe('Source task ID'),
+            toId: zod_1.z.string().max(500).describe('Target task ID'),
             kind: zod_1.z.enum(['subtask_of', 'blocks', 'related_to']).describe('Relation type'),
         },
     }, async ({ fromId, toId, kind }) => {

package/dist/api/tools/tasks/list-tasks.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('list_tasks', {
         description: 'List tasks with optional filters. ' +
@@ -13,10 +14,10 @@ function register(server, mgr) {
                 .describe('Filter by status'),
             priority: zod_1.z.enum(['critical', 'high', 'medium', 'low']).optional()
                 .describe('Filter by priority'),
-            tag: zod_1.z.string().optional().describe('Filter by tag (exact match, case-insensitive)'),
-            filter: zod_1.z.string().optional().describe('Substring match on title or ID'),
-            assignee: zod_1.z.string().optional().describe('Filter by assignee (team member ID)'),
-            limit: zod_1.z.number().optional().describe('Max results (default 50)'),
+            tag: zod_1.z.string().max(defaults_1.MAX_TAG_LEN).optional().describe('Filter by tag (exact match, case-insensitive)'),
+            filter: zod_1.z.string().max(500).optional().describe('Substring match on title or ID'),
+            assignee: zod_1.z.string().max(defaults_1.MAX_ASSIGNEE_LEN).optional().describe('Filter by assignee (team member ID)'),
+            limit: zod_1.z.number().max(1000).optional().describe('Max results (default 50)'),
         },
     }, async ({ status, priority, tag, filter, assignee, limit }) => {
         const results = mgr.listTasks({ status, priority, tag, filter, assignee, limit });