@graphmemory/server 1.3.2 → 1.3.3

package/dist/api/tools/tasks/move-task.js

@@ -10,7 +10,7 @@ function register(server, mgr) {
             'Returns the updated task summary. ' +
             'Pass expectedVersion to enable optimistic locking.',
         inputSchema: {
-            taskId: zod_1.z.string().describe('Task ID to move'),
+            taskId: zod_1.z.string().max(500).describe('Task ID to move'),
             status: zod_1.z.enum(['backlog', 'todo', 'in_progress', 'review', 'done', 'cancelled'])
                 .describe('New status'),
             expectedVersion: zod_1.z.number().int().positive().optional().describe('Current version for optimistic locking — request fails with version_conflict if the task has been updated since'),
@@ -19,7 +19,7 @@ function register(server, mgr) {
         try {
             const moved = mgr.moveTask(taskId, status, expectedVersion);
             if (!moved) {
-                return { content: [{ type: 'text', text: `Task "${taskId}" not found.` }], isError: true };
+                return { content: [{ type: 'text', text: 'Task not found' }], isError: true };
             }
             const task = mgr.getTask(taskId);
             return { content: [{ type: 'text', text: JSON.stringify({

package/dist/api/tools/tasks/remove-attachment.js

@@ -6,7 +6,7 @@ function register(server, mgr) {
     server.registerTool('remove_task_attachment', {
         description: 'Remove an attachment from a task. The file is deleted from disk.',
         inputSchema: {
-            taskId: zod_1.z.string().describe('ID of the task'),
+            taskId: zod_1.z.string().max(500).describe('ID of the task'),
             filename: zod_1.z.string().min(1).max(255)
                 .refine(s => !/[/\\]/.test(s), 'Filename must not contain path separators')
                 .refine(s => !s.includes('..'), 'Filename must not contain ..')

package/dist/api/tools/tasks/search-tasks.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('search_tasks', {
         description: 'Semantic search over the task graph. ' +
@@ -11,7 +12,7 @@ function register(server, mgr) {
             'Returns an array sorted by relevance score (0–1), each with: ' +
             'id, title, description, status, priority, tags, score.',
         inputSchema: {
-            query: zod_1.z.string().describe('Natural language search query'),
+            query: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Natural language search query'),
             topK: zod_1.z.number().min(1).max(500).optional().describe('How many top similar tasks to use as seeds (default 5)'),
             bfsDepth: zod_1.z.number().min(0).max(10).optional().describe('How many hops to follow relations from each seed (default 1; 0 = no expansion)'),
             maxResults: zod_1.z.number().min(1).max(500).optional().describe('Maximum number of results to return (default 20)'),

package/dist/api/tools/tasks/update-task.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
 const manager_types_1 = require("../../../graphs/manager-types");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('update_task', {
         description: 'Update an existing task. Only provided fields are changed. ' +
@@ -11,16 +12,16 @@ function register(server, mgr) {
             'Use move_task for a simpler status-only change. ' +
             'Pass expectedVersion to enable optimistic locking.',
         inputSchema: {
-            taskId: zod_1.z.string().describe('Task ID to update'),
-            title: zod_1.z.string().optional().describe('New title'),
-            description: zod_1.z.string().optional().describe('New description'),
+            taskId: zod_1.z.string().max(500).describe('Task ID to update'),
+            title: zod_1.z.string().max(defaults_1.MAX_TITLE_LEN).optional().describe('New title'),
+            description: zod_1.z.string().max(defaults_1.MAX_DESCRIPTION_LEN).optional().describe('New description'),
             status: zod_1.z.enum(['backlog', 'todo', 'in_progress', 'review', 'done', 'cancelled']).optional()
                 .describe('New status'),
             priority: zod_1.z.enum(['critical', 'high', 'medium', 'low']).optional().describe('New priority'),
-            tags: zod_1.z.array(zod_1.z.string()).optional().describe('Replace tags array'),
+            tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional().describe('Replace tags array'),
             dueDate: zod_1.z.number().nullable().optional().describe('New due date (ms timestamp) or null to clear'),
             estimate: zod_1.z.number().nullable().optional().describe('New estimate (hours) or null to clear'),
-            assignee: zod_1.z.string().nullable().optional().describe('Team member ID to assign, or null to unassign'),
+            assignee: zod_1.z.string().max(defaults_1.MAX_ASSIGNEE_LEN).nullable().optional().describe('Team member ID to assign, or null to unassign'),
             expectedVersion: zod_1.z.number().int().positive().optional().describe('Current version for optimistic locking — request fails with version_conflict if the task has been updated since'),
         },
     }, async ({ taskId, title, description, status, priority, tags, dueDate, estimate, assignee, expectedVersion }) => {
@@ -44,7 +45,7 @@ function register(server, mgr) {
         try {
             const updated = await mgr.updateTask(taskId, patch, expectedVersion);
             if (!updated) {
-                return { content: [{ type: 'text', text: `Task "${taskId}" not found.` }], isError: true };
+                return { content: [{ type: 'text', text: 'Task not found' }], isError: true };
             }
             return { content: [{ type: 'text', text: JSON.stringify({ taskId, updated: true }, null, 2) }] };
         }

package/dist/cli/indexer.js

@@ -270,6 +270,8 @@ function createProjectIndexer(docGraph, codeGraph, config, knowledgeGraph, fileI
             for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
                 if (entry.name.startsWith('.') || watcher_1.ALWAYS_IGNORED.has(entry.name))
                     continue;
+                if (entry.isSymbolicLink())
+                    continue;
                 const full = path_1.default.join(dir, entry.name);
                 if (entry.isDirectory()) {
                     const relDir = path_1.default.relative(config.projectDir, full);

package/dist/graphs/code.js

@@ -217,6 +217,10 @@ function loadCodeGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[code-graph] Embedding config changed, re-indexing code graph\n`);
             return graph;
         }
+        if (!(0, graph_persistence_1.validateGraphStructure)(data.graph)) {
+            process.stderr.write(`[code-graph] Invalid graph structure in ${file}, starting fresh\n`);
+            return graph;
+        }
         (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[code-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);

package/dist/graphs/docs.js

@@ -164,6 +164,10 @@ function loadGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[graph] Embedding config changed, re-indexing docs graph\n`);
             return graph;
         }
+        if (!(0, graph_persistence_1.validateGraphStructure)(data.graph)) {
+            process.stderr.write(`[graph] Invalid graph structure in ${file}, starting fresh\n`);
+            return graph;
+        }
         (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);

package/dist/graphs/file-index.js

@@ -272,6 +272,10 @@ function loadFileIndexGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[file-index] Embedding config changed, re-indexing file index\n`);
             return graph;
         }
+        if (!(0, graph_persistence_1.validateGraphStructure)(data.graph)) {
+            process.stderr.write(`[file-index] Invalid graph structure in ${file}, starting fresh\n`);
+            return graph;
+        }
         (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[file-index] Loaded ${graph.order} nodes, ${graph.size} edges\n`);

package/dist/graphs/knowledge.js

@@ -360,6 +360,10 @@ function loadKnowledgeGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[knowledge-graph] Embedding config changed, re-indexing knowledge graph\n`);
             return graph;
         }
+        if (!(0, graph_persistence_1.validateGraphStructure)(data.graph)) {
+            process.stderr.write(`[knowledge-graph] Invalid graph structure in ${file}, starting fresh\n`);
+            return graph;
+        }
         (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[knowledge-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
@@ -433,6 +437,7 @@ class KnowledgeGraphManager {
     mirrorTracker;
     _bm25Index;
     get externalGraphs() { return this.ext; }
+    get projectDir() { return this.ctx.projectDir; }
     constructor(_graph, embedFns, ctx, ext = {}) {
         this._graph = _graph;
         this.embedFns = embedFns;

package/dist/graphs/skill.js

@@ -504,6 +504,10 @@ function loadSkillGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[skill-graph] Embedding config changed, re-indexing skill graph\n`);
             return graph;
         }
+        if (!(0, graph_persistence_1.validateGraphStructure)(data.graph)) {
+            process.stderr.write(`[skill-graph] Invalid graph structure in ${file}, starting fresh\n`);
+            return graph;
+        }
         (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[skill-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
@@ -610,6 +614,7 @@ class SkillGraphManager {
     taskGraph;
     mirrorTracker;
     _bm25Index;
+    get projectDir() { return this.ctx.projectDir; }
     constructor(_graph, embedFns, ctx, ext = {}) {
         this._graph = _graph;
         this.embedFns = embedFns;

package/dist/graphs/task.js

@@ -525,6 +525,10 @@ function loadTaskGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[task-graph] Embedding config changed, re-indexing task graph\n`);
             return graph;
         }
+        if (!(0, graph_persistence_1.validateGraphStructure)(data.graph)) {
+            process.stderr.write(`[task-graph] Invalid graph structure in ${file}, starting fresh\n`);
+            return graph;
+        }
         (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[task-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
@@ -591,6 +595,7 @@ class TaskGraphManager {
     knowledgeGraph;
     mirrorTracker;
     _bm25Index;
+    get projectDir() { return this.ctx.projectDir; }
     constructor(_graph, embedFns, ctx, ext = {}) {
         this._graph = _graph;
         this.embedFns = embedFns;

package/dist/lib/defaults.js

@@ -38,7 +38,7 @@ exports.MAX_TITLE_LEN = 500;
 exports.MAX_NOTE_CONTENT_LEN = 1_000_000;
 exports.MAX_TAG_LEN = 100;
 exports.MAX_TAGS_COUNT = 100;
-exports.MAX_SEARCH_QUERY_LEN = 2000;
+exports.MAX_SEARCH_QUERY_LEN = 10_000;
 exports.MAX_SEARCH_TOP_K = 500;
 exports.MAX_DESCRIPTION_LEN = 500_000;
 exports.MAX_ASSIGNEE_LEN = 100;

package/dist/lib/file-import.js

@@ -96,10 +96,16 @@ function extractTitleAndContent(body) {
  */
 function extractId(filePath) {
     const basename = path.basename(filePath, '.md');
+    let id;
     if (basename === 'note' || basename === 'task' || basename === 'skill') {
-        return path.basename(path.dirname(filePath));
+        id = path.basename(path.dirname(filePath));
     }
-    return basename;
+    else {
+        id = basename;
+    }
+    if (id === '..' || id === '.' || id.includes('\0'))
+        return '';
+    return id;
 }
 function parseNoteFile(filePath) {
     try {

package/dist/lib/file-mirror.js

@@ -47,6 +47,7 @@ exports.mirrorTaskRelation = mirrorTaskRelation;
 exports.mirrorSkillRelation = mirrorSkillRelation;
 exports.mirrorAttachmentEvent = mirrorAttachmentEvent;
 exports.deleteMirrorDir = deleteMirrorDir;
+exports.sanitizeEntityId = sanitizeEntityId;
 exports.sanitizeFilename = sanitizeFilename;
 exports.writeAttachment = writeAttachment;
 exports.deleteAttachment = deleteAttachment;
@@ -56,6 +57,10 @@ const path = __importStar(require("path"));
 const crypto_1 = __importDefault(require("crypto"));
 const frontmatter_1 = require("./frontmatter");
 const events_log_1 = require("./events-log");
+/** Sanitize a string for safe inclusion in log output. */
+function sanitizeForLog(s) {
+    return s.replace(/[\r\n\t]/g, ' ').slice(0, 200);
+}
 /** Write to a temp file then rename — atomic on same filesystem. */
 function atomicWriteFileSync(filePath, data, encoding) {
     const tmp = `${filePath}.${crypto_1.default.randomBytes(4).toString('hex')}.tmp`;
@@ -80,7 +85,12 @@ function buildOutgoingRelations(entityId, relations) {
 /** Append a 'created' event + write content.md + regenerate note.md snapshot. */
 function mirrorNoteCreate(notesDir, noteId, attrs, relations) {
     try {
-        const entityDir = path.join(notesDir, noteId);
+        const safeId = sanitizeEntityId(noteId);
+        if (!safeId) {
+            process.stderr.write(`[file-mirror] rejected invalid entity ID\n`);
+            return;
+        }
+        const entityDir = path.join(notesDir, safeId);
         fs.mkdirSync(entityDir, { recursive: true });
         const eventsPath = path.join(entityDir, 'events.jsonl');
         if (!fs.existsSync(eventsPath)) {
@@ -101,13 +111,18 @@ function mirrorNoteCreate(notesDir, noteId, attrs, relations) {
         (0, events_log_1.ensureGitattributes)(notesDir);
     }
     catch (err) {
-        process.stderr.write(`[file-mirror] failed to mirror note create ${noteId}: ${err}\n`);
+        process.stderr.write(`[file-mirror] failed to mirror note create ${sanitizeForLog(noteId)}: ${err}\n`);
     }
 }
 /** Append an 'update' event + (if content changed) write content.md + regenerate note.md. */
 function mirrorNoteUpdate(notesDir, noteId, patch, attrs, relations) {
     try {
-        const entityDir = path.join(notesDir, noteId);
+        const safeId = sanitizeEntityId(noteId);
+        if (!safeId) {
+            process.stderr.write(`[file-mirror] rejected invalid entity ID\n`);
+            return;
+        }
+        const entityDir = path.join(notesDir, safeId);
         fs.mkdirSync(entityDir, { recursive: true });
         const eventsPath = path.join(entityDir, 'events.jsonl');
         const delta = { op: 'update' };
@@ -127,7 +142,7 @@ function mirrorNoteUpdate(notesDir, noteId, patch, attrs, relations) {
         _regenerateNoteSnapshot(notesDir, noteId, attrs, relations);
     }
     catch (err) {
-        process.stderr.write(`[file-mirror] failed to mirror note update ${noteId}: ${err}\n`);
+        process.stderr.write(`[file-mirror] failed to mirror note update ${sanitizeForLog(noteId)}: ${err}\n`);
     }
 }
 function _regenerateNoteSnapshot(notesDir, noteId, attrs, relations) {
@@ -153,7 +168,12 @@ function _regenerateNoteSnapshot(notesDir, noteId, attrs, relations) {
 /** Append a 'created' event + write description.md + regenerate task.md snapshot. */
 function mirrorTaskCreate(tasksDir, taskId, attrs, relations) {
     try {
-        const entityDir = path.join(tasksDir, taskId);
+        const safeId = sanitizeEntityId(taskId);
+        if (!safeId) {
+            process.stderr.write(`[file-mirror] rejected invalid entity ID\n`);
+            return;
+        }
+        const entityDir = path.join(tasksDir, safeId);
         fs.mkdirSync(entityDir, { recursive: true });
         const eventsPath = path.join(entityDir, 'events.jsonl');
         if (!fs.existsSync(eventsPath)) {
@@ -179,13 +199,18 @@ function mirrorTaskCreate(tasksDir, taskId, attrs, relations) {
         (0, events_log_1.ensureGitattributes)(tasksDir);
     }
     catch (err) {
-        process.stderr.write(`[file-mirror] failed to mirror task create ${taskId}: ${err}\n`);
+        process.stderr.write(`[file-mirror] failed to mirror task create ${sanitizeForLog(taskId)}: ${err}\n`);
     }
 }
 /** Append an 'update' event + (if description changed) write description.md + regenerate task.md. */
 function mirrorTaskUpdate(tasksDir, taskId, patch, attrs, relations) {
     try {
-        const entityDir = path.join(tasksDir, taskId);
+        const safeId = sanitizeEntityId(taskId);
+        if (!safeId) {
+            process.stderr.write(`[file-mirror] rejected invalid entity ID\n`);
+            return;
+        }
+        const entityDir = path.join(tasksDir, safeId);
         fs.mkdirSync(entityDir, { recursive: true });
         const eventsPath = path.join(entityDir, 'events.jsonl');
         const delta = { op: 'update' };
@@ -215,7 +240,7 @@ function mirrorTaskUpdate(tasksDir, taskId, patch, attrs, relations) {
         _regenerateTaskSnapshot(tasksDir, taskId, attrs, relations);
     }
     catch (err) {
-        process.stderr.write(`[file-mirror] failed to mirror task update ${taskId}: ${err}\n`);
+        process.stderr.write(`[file-mirror] failed to mirror task update ${sanitizeForLog(taskId)}: ${err}\n`);
     }
 }
 function _regenerateTaskSnapshot(tasksDir, taskId, attrs, relations) {
@@ -247,7 +272,12 @@ function _regenerateTaskSnapshot(tasksDir, taskId, attrs, relations) {
 /** Append a 'created' event + write description.md + regenerate skill.md snapshot. */
 function mirrorSkillCreate(skillsDir, skillId, attrs, relations) {
     try {
-        const entityDir = path.join(skillsDir, skillId);
+        const safeId = sanitizeEntityId(skillId);
+        if (!safeId) {
+            process.stderr.write(`[file-mirror] rejected invalid entity ID\n`);
+            return;
+        }
+        const entityDir = path.join(skillsDir, safeId);
         fs.mkdirSync(entityDir, { recursive: true });
         const eventsPath = path.join(entityDir, 'events.jsonl');
         if (!fs.existsSync(eventsPath)) {
@@ -276,13 +306,18 @@ function mirrorSkillCreate(skillsDir, skillId, attrs, relations) {
         (0, events_log_1.ensureGitattributes)(skillsDir);
     }
     catch (err) {
-        process.stderr.write(`[file-mirror] failed to mirror skill create ${skillId}: ${err}\n`);
+        process.stderr.write(`[file-mirror] failed to mirror skill create ${sanitizeForLog(skillId)}: ${err}\n`);
     }
 }
 /** Append an 'update' event + (if description changed) write description.md + regenerate skill.md. */
 function mirrorSkillUpdate(skillsDir, skillId, patch, attrs, relations) {
     try {
-        const entityDir = path.join(skillsDir, skillId);
+        const safeId = sanitizeEntityId(skillId);
+        if (!safeId) {
+            process.stderr.write(`[file-mirror] rejected invalid entity ID\n`);
+            return;
+        }
+        const entityDir = path.join(skillsDir, safeId);
         fs.mkdirSync(entityDir, { recursive: true });
         const eventsPath = path.join(entityDir, 'events.jsonl');
         const delta = { op: 'update' };
@@ -318,7 +353,7 @@ function mirrorSkillUpdate(skillsDir, skillId, patch, attrs, relations) {
         _regenerateSkillSnapshot(skillsDir, skillId, attrs, relations);
     }
     catch (err) {
-        process.stderr.write(`[file-mirror] failed to mirror skill update ${skillId}: ${err}\n`);
+        process.stderr.write(`[file-mirror] failed to mirror skill update ${sanitizeForLog(skillId)}: ${err}\n`);
     }
 }
 function _regenerateSkillSnapshot(skillsDir, skillId, attrs, relations) {
@@ -364,7 +399,7 @@ function mirrorNoteRelation(notesDir, noteId, action, kind, to, attrs, relations
         _regenerateNoteSnapshot(notesDir, noteId, attrs, relations);
     }
     catch (err) {
-        process.stderr.write(`[file-mirror] failed to mirror note relation ${noteId}: ${err}\n`);
+        process.stderr.write(`[file-mirror] failed to mirror note relation ${sanitizeForLog(noteId)}: ${err}\n`);
     }
 }
 function mirrorTaskRelation(tasksDir, taskId, action, kind, to, attrs, relations, graph) {
@@ -378,7 +413,7 @@ function mirrorTaskRelation(tasksDir, taskId, action, kind, to, attrs, relations
         _regenerateTaskSnapshot(tasksDir, taskId, attrs, relations);
     }
     catch (err) {
-        process.stderr.write(`[file-mirror] failed to mirror task relation ${taskId}: ${err}\n`);
+        process.stderr.write(`[file-mirror] failed to mirror task relation ${sanitizeForLog(taskId)}: ${err}\n`);
     }
 }
 function mirrorSkillRelation(skillsDir, skillId, action, kind, to, attrs, relations, graph) {
@@ -392,7 +427,7 @@ function mirrorSkillRelation(skillsDir, skillId, action, kind, to, attrs, relati
         _regenerateSkillSnapshot(skillsDir, skillId, attrs, relations);
     }
     catch (err) {
-        process.stderr.write(`[file-mirror] failed to mirror skill relation ${skillId}: ${err}\n`);
+        process.stderr.write(`[file-mirror] failed to mirror skill relation ${sanitizeForLog(skillId)}: ${err}\n`);
     }
 }
 /** Append an attachment add/remove event. */
@@ -410,18 +445,30 @@ function mirrorAttachmentEvent(entityDir, action, file) {
 // ---------------------------------------------------------------------------
 /** Delete the entire mirror directory for a note, task or skill (including attachments). */
 function deleteMirrorDir(dir, id) {
+    const safeId = sanitizeEntityId(id);
+    if (!safeId) {
+        process.stderr.write(`[file-mirror] rejected invalid entity ID\n`);
+        return;
+    }
     try {
-        fs.rmSync(path.join(dir, id), { recursive: true, force: true });
+        fs.rmSync(path.join(dir, safeId), { recursive: true, force: true });
     }
     catch (err) {
         if (err.code !== 'ENOENT') {
-            process.stderr.write(`[file-mirror] failed to delete ${id}/: ${err}\n`);
+            process.stderr.write(`[file-mirror] failed to delete ${sanitizeForLog(id)}/: ${err}\n`);
         }
     }
 }
 // ---------------------------------------------------------------------------
 // Attachment file helpers (paths now go through attachments/ subdir)
 // ---------------------------------------------------------------------------
+/** Sanitize an entity ID: extract basename, strip null bytes and path traversal. */
+function sanitizeEntityId(id) {
+    const base = path.basename(id.replace(/\0/g, '').replace(/\\/g, '/')).trim();
+    if (base === '.' || base === '..')
+        return '';
+    return base;
+}
 /** Sanitize a filename: extract basename, strip null bytes and path traversal. */
 function sanitizeFilename(name) {
     // Normalize backslashes to forward slashes (path.basename on Unix doesn't treat \ as separator)
@@ -433,29 +480,38 @@ function sanitizeFilename(name) {
 }
 /** Write an attachment file to the entity's attachments/ subdirectory. */
 function writeAttachment(baseDir, entityId, filename, data) {
+    const safeEntityId = sanitizeEntityId(entityId);
+    if (!safeEntityId)
+        throw new Error('Entity ID is empty after sanitization');
     const safe = sanitizeFilename(filename);
     if (!safe)
         throw new Error('Attachment filename is empty after sanitization');
-    const attachmentsDir = path.join(baseDir, entityId, 'attachments');
+    const attachmentsDir = path.join(baseDir, safeEntityId, 'attachments');
     fs.mkdirSync(attachmentsDir, { recursive: true });
     fs.writeFileSync(path.join(attachmentsDir, safe), data);
 }
 /** Delete an attachment file from attachments/ subdir. Returns true if it existed. */
 function deleteAttachment(baseDir, entityId, filename) {
-    const filePath = path.join(baseDir, entityId, 'attachments', sanitizeFilename(filename));
+    const safeEntityId = sanitizeEntityId(entityId);
+    if (!safeEntityId)
+        return false;
+    const filePath = path.join(baseDir, safeEntityId, 'attachments', sanitizeFilename(filename));
     try {
         fs.unlinkSync(filePath);
         return true;
     }
     catch (err) {
         if (err.code !== 'ENOENT') {
-            process.stderr.write(`[file-mirror] failed to delete attachment ${filename}: ${err}\n`);
+            process.stderr.write(`[file-mirror] failed to delete attachment ${sanitizeForLog(filename)}: ${err}\n`);
         }
         return false;
     }
 }
 /** Get the absolute path of an attachment in attachments/ subdir, or null if not found. */
 function getAttachmentPath(baseDir, entityId, filename) {
-    const filePath = path.join(baseDir, entityId, 'attachments', sanitizeFilename(filename));
+    const safeEntityId = sanitizeEntityId(entityId);
+    if (!safeEntityId)
+        return null;
+    const filePath = path.join(baseDir, safeEntityId, 'attachments', sanitizeFilename(filename));
     return fs.existsSync(filePath) ? filePath : null;
 }

package/dist/lib/graph-persistence.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readJsonWithTmpFallback = readJsonWithTmpFallback;
+exports.validateGraphStructure = validateGraphStructure;
 const fs = __importStar(require("fs"));
 /**
  * Try to read and parse a JSON file, falling back to .tmp if main file
@@ -66,3 +67,44 @@ function readJsonWithTmpFallback(file) {
     }
     return null;
 }
+/**
+ * Basic structural validation for Graphology serialized graph data.
+ * Ensures the shape matches what graph.import() expects, preventing
+ * injection of unexpected properties.
+ */
+function validateGraphStructure(data) {
+    if (data == null || typeof data !== 'object')
+        return false;
+    const obj = data;
+    if (!Array.isArray(obj.nodes))
+        return false;
+    if (!Array.isArray(obj.edges))
+        return false;
+    for (const node of obj.nodes) {
+        if (node == null || typeof node !== 'object')
+            return false;
+        const n = node;
+        if (typeof n.key !== 'string')
+            return false;
+        if (n.attributes !== undefined) {
+            if (n.attributes == null || typeof n.attributes !== 'object')
+                return false;
+            if (Object.prototype.hasOwnProperty.call(n.attributes, '__proto__') || Object.prototype.hasOwnProperty.call(n.attributes, 'constructor'))
+                return false;
+        }
+    }
+    for (const edge of obj.edges) {
+        if (edge == null || typeof edge !== 'object')
+            return false;
+        const e = edge;
+        if (typeof e.source !== 'string' || typeof e.target !== 'string')
+            return false;
+        if (e.attributes !== undefined) {
+            if (e.attributes == null || typeof e.attributes !== 'object')
+                return false;
+            if (Object.prototype.hasOwnProperty.call(e.attributes, '__proto__') || Object.prototype.hasOwnProperty.call(e.attributes, 'constructor'))
+                return false;
+        }
+    }
+    return true;
+}

package/dist/lib/jwt.js

@@ -20,16 +20,17 @@ const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 // Password hashing (scrypt)
 // ---------------------------------------------------------------------------
 const SCRYPT_KEYLEN = 64;
-const SCRYPT_COST = 16384; // N
+const SCRYPT_COST = 65536; // N
 const SCRYPT_BLOCK = 8; // r
 const SCRYPT_PARALLEL = 1; // p
+const SCRYPT_MAXMEM = 128 * 1024 * 1024; // 128 MiB (needed for N=65536, r=8)
 /**
  * Hash a password using scrypt. Returns a string: `$scrypt$N$r$p$salt$hash`
  */
 async function hashPassword(password) {
     const salt = crypto_1.default.randomBytes(16).toString('hex');
     const derived = await new Promise((resolve, reject) => {
-        crypto_1.default.scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_COST, r: SCRYPT_BLOCK, p: SCRYPT_PARALLEL }, (err, key) => {
+        crypto_1.default.scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_COST, r: SCRYPT_BLOCK, p: SCRYPT_PARALLEL, maxmem: SCRYPT_MAXMEM }, (err, key) => {
             if (err)
                 reject(err);
             else
@@ -52,7 +53,7 @@ async function verifyPassword(password, storedHash) {
     const salt = parts[5];
     const expectedHash = parts[6];
     const derived = await new Promise((resolve, reject) => {
-        crypto_1.default.scrypt(password, salt, SCRYPT_KEYLEN, { N, r, p }, (err, key) => {
+        crypto_1.default.scrypt(password, salt, SCRYPT_KEYLEN, { N, r, p, maxmem: SCRYPT_MAXMEM }, (err, key) => {
             if (err)
                 reject(err);
             else

package/dist/lib/promise-queue.js

@@ -8,15 +8,33 @@ exports.PromiseQueue = void 0;
  * but the queue continues processing subsequent items.
  */
 class PromiseQueue {
-    chain = Promise.resolve();
+    queue = [];
+    running = false;
     /**
      * Enqueue an async function. Returns a promise that resolves/rejects
      * with the function's result once it has been executed in turn.
      */
     enqueue(fn) {
         return new Promise((resolve, reject) => {
-            this.chain = this.chain.then(fn).then(resolve, reject);
+            this.queue.push(async () => {
+                try {
+                    resolve(await fn());
+                }
+                catch (e) {
+                    reject(e);
+                }
+            });
+            if (!this.running)
+                this.drain();
         });
     }
+    async drain() {
+        this.running = true;
+        while (this.queue.length > 0) {
+            const task = this.queue.shift();
+            await task();
+        }
+        this.running = false;
+    }
 }
 exports.PromiseQueue = PromiseQueue;

package/dist/ui/assets/{NoteForm-SQ0b93i0.js → NoteForm-D0lOYBQq.js}

@@ -1 +1 @@
-import{r as e}from"./rolldown-runtime-Dw2cE7zH.js";import{D as t,O as n}from"./vendor-markdown-CT8ZVEPu.js";import{Y as r,nt as i,q as a,r as o}from"./vendor-mui-BPj7d3Sw.js";import{D as s,E as c,I as l,O as u,P as d,S as f}from"./index-CEweXD9O.js";var p=e(n(),1),m=t();function h({note:e,onSubmit:t,onCancel:n,submitLabel:h=`Save`}){let[g,_]=(0,p.useState)(``),[v,y]=(0,p.useState)(``),[b,x]=(0,p.useState)([]),[S,C]=(0,p.useState)(!1),[w,T]=(0,p.useState)(!1);(0,p.useEffect)(()=>{e&&(_(e.title),y(e.content),x(e.tags??[]))},[e]);let E=async()=>{if(!g.trim()){T(!0);return}C(!0);try{await t({title:g.trim(),content:v.trim(),tags:b})}finally{C(!1)}};return(0,m.jsxs)(r,{component:`form`,id:`note-form`,onSubmit:e=>{e.preventDefault(),E()},sx:{display:`flex`,flexDirection:`column`,gap:3},children:[(0,m.jsx)(l,{title:`Details`,children:(0,m.jsxs)(u,{children:[(0,m.jsxs)(s,{fullWidth:!0,children:[(0,m.jsx)(c,{required:!0,children:`Title`}),(0,m.jsx)(o,{autoFocus:!0,fullWidth:!0,value:g,onChange:e=>{_(e.target.value),T(!1)},error:w,helperText:w?`Title is required`:void 0})]}),(0,m.jsxs)(s,{fullWidth:!0,children:[(0,m.jsx)(c,{children:`Content`}),(0,m.jsx)(f,{value:v,onChange:y,height:300})]}),(0,m.jsx)(s,{fullWidth:!0,children:(0,m.jsx)(d,{tags:b,editable:!0,onAdd:e=>x(t=>t.includes(e)?t:[...t,e]),onRemove:e=>x(t=>t.filter(t=>t!==e))})})]})}),(0,m.jsxs)(r,{sx:{display:`flex`,gap:1,justifyContent:`flex-end`},children:[(0,m.jsx)(a,{onClick:n,children:`Cancel`}),(0,m.jsx)(a,{variant:`contained`,onClick:E,disabled:S||!g.trim(),children:S?(0,m.jsx)(i,{size:20}):h})]})]})}export{h as t};
+import{r as e}from"./rolldown-runtime-Dw2cE7zH.js";import{O as t,k as n}from"./vendor-markdown-DngssFHR.js";import{Y as r,nt as i,q as a,r as o}from"./vendor-mui-DXUYJbRC.js";import{D as s,E as c,I as l,O as u,P as d,S as f}from"./index-80sqSHwS.js";var p=e(n(),1),m=t();function h({note:e,onSubmit:t,onCancel:n,submitLabel:h=`Save`}){let[g,_]=(0,p.useState)(``),[v,y]=(0,p.useState)(``),[b,x]=(0,p.useState)([]),[S,C]=(0,p.useState)(!1),[w,T]=(0,p.useState)(!1);(0,p.useEffect)(()=>{e&&(_(e.title),y(e.content),x(e.tags??[]))},[e]);let E=async()=>{if(!g.trim()){T(!0);return}C(!0);try{await t({title:g.trim(),content:v.trim(),tags:b})}finally{C(!1)}};return(0,m.jsxs)(r,{component:`form`,id:`note-form`,onSubmit:e=>{e.preventDefault(),E()},sx:{display:`flex`,flexDirection:`column`,gap:3},children:[(0,m.jsx)(l,{title:`Details`,children:(0,m.jsxs)(u,{children:[(0,m.jsxs)(s,{fullWidth:!0,children:[(0,m.jsx)(c,{required:!0,children:`Title`}),(0,m.jsx)(o,{autoFocus:!0,fullWidth:!0,value:g,onChange:e=>{_(e.target.value),T(!1)},error:w,helperText:w?`Title is required`:void 0})]}),(0,m.jsxs)(s,{fullWidth:!0,children:[(0,m.jsx)(c,{children:`Content`}),(0,m.jsx)(f,{value:v,onChange:y,height:300})]}),(0,m.jsx)(s,{fullWidth:!0,children:(0,m.jsx)(d,{tags:b,editable:!0,onAdd:e=>x(t=>t.includes(e)?t:[...t,e]),onRemove:e=>x(t=>t.filter(t=>t!==e))})})]})}),(0,m.jsxs)(r,{sx:{display:`flex`,gap:1,justifyContent:`flex-end`},children:[(0,m.jsx)(a,{onClick:n,children:`Cancel`}),(0,m.jsx)(a,{variant:`contained`,onClick:E,disabled:S||!g.trim(),children:S?(0,m.jsx)(i,{size:20}):h})]})]})}export{h as t};

package/dist/ui/assets/{SkillForm-BVsGrNPb.js → SkillForm-CfDWe0Nx.js}

@@ -1 +1 @@
-import{r as e}from"./rolldown-runtime-Dw2cE7zH.js";import{D as t,O as n}from"./vendor-markdown-CT8ZVEPu.js";import{$ as r,Y as i,_ as a,nt as o,q as s,r as c,tt as l,v as u,y as d}from"./vendor-mui-BPj7d3Sw.js";import{K as f,i as p}from"./vendor-mui-icons-B196sG3f.js";import{D as m,E as h,I as g,O as _,P as v,S as y}from"./index-CEweXD9O.js";var b=e(n(),1),x=t();function S({skill:e,onSubmit:t,onCancel:n,submitLabel:S=`Save`}){let[C,w]=(0,b.useState)(``),[T,E]=(0,b.useState)(``),[D,O]=(0,b.useState)([``]),[k,A]=(0,b.useState)([]),[j,M]=(0,b.useState)([]),[N,P]=(0,b.useState)([]),[F,I]=(0,b.useState)([]),[L,R]=(0,b.useState)(`user`),[z,B]=(0,b.useState)(1),[V,H]=(0,b.useState)(!1),[U,W]=(0,b.useState)(!1);(0,b.useEffect)(()=>{e&&(w(e.title),E(e.description),O(e.steps.length>0?e.steps:[``]),A(e.triggers??[]),M(e.inputHints??[]),P(e.filePatterns??[]),I(e.tags??[]),R(e.source),B(e.confidence))},[e]);let G=async()=>{if(!C.trim()){W(!0);return}H(!0);try{await t({title:C.trim(),description:T.trim(),steps:D.map(e=>e.trim()).filter(Boolean),triggers:k,inputHints:j,filePatterns:N,tags:F,source:L,confidence:z})}finally{H(!1)}},K=(e,t)=>{O(n=>n.map((n,r)=>r===e?t:n))},q=()=>{O(e=>[...e,``])},J=e=>{O(t=>t.filter((t,n)=>n!==e))};return(0,x.jsxs)(i,{component:`form`,id:`skill-form`,onSubmit:e=>{e.preventDefault(),G()},sx:{display:`flex`,flexDirection:`column`,gap:3},children:[(0,x.jsx)(g,{title:`Details`,children:(0,x.jsxs)(_,{children:[(0,x.jsxs)(m,{fullWidth:!0,children:[(0,x.jsx)(h,{required:!0,children:`Title`}),(0,x.jsx)(c,{autoFocus:!0,fullWidth:!0,value:C,onChange:e=>{w(e.target.value),W(!1)},error:U,helperText:U?`Title is required`:void 0})]}),(0,x.jsxs)(m,{fullWidth:!0,children:[(0,x.jsx)(h,{children:`Description`}),(0,x.jsx)(y,{value:T,onChange:E,height:200})]})]})}),(0,x.jsx)(g,{title:`Steps`,children:(0,x.jsxs)(i,{sx:{display:`flex`,flexDirection:`column`,gap:1},children:[D.map((e,t)=>(0,x.jsxs)(i,{sx:{display:`flex`,gap:1,alignItems:`center`},children:[(0,x.jsxs)(r,{variant:`body2`,sx:{minWidth:24,color:`text.secondary`},children:[t+1,`.`]}),(0,x.jsx)(c,{fullWidth:!0,size:`small`,value:e,onChange:e=>K(t,e.target.value),placeholder:`Step ${t+1}`}),D.length>1&&(0,x.jsx)(l,{size:`small`,onClick:()=>J(t),color:`error`,children:(0,x.jsx)(p,{fontSize:`small`})})]},t)),(0,x.jsx)(s,{size:`small`,startIcon:(0,x.jsx)(f,{}),onClick:q,sx:{alignSelf:`flex-start`},children:`Add Step`})]})}),(0,x.jsx)(g,{title:`Matching`,children:(0,x.jsxs)(_,{children:[(0,x.jsxs)(m,{fullWidth:!0,children:[(0,x.jsx)(h,{children:`Triggers`}),(0,x.jsx)(v,{tags:k,editable:!0,onAdd:e=>A(t=>t.includes(e)?t:[...t,e]),onRemove:e=>A(t=>t.filter(t=>t!==e))})]}),(0,x.jsxs)(m,{fullWidth:!0,children:[(0,x.jsx)(h,{children:`Input Hints`}),(0,x.jsx)(v,{tags:j,editable:!0,onAdd:e=>M(t=>t.includes(e)?t:[...t,e]),onRemove:e=>M(t=>t.filter(t=>t!==e))})]}),(0,x.jsxs)(m,{fullWidth:!0,children:[(0,x.jsx)(h,{children:`File Patterns`}),(0,x.jsx)(v,{tags:N,editable:!0,onAdd:e=>P(t=>t.includes(e)?t:[...t,e]),onRemove:e=>P(t=>t.filter(t=>t!==e))})]})]})}),(0,x.jsx)(g,{title:`Properties`,children:(0,x.jsxs)(_,{children:[(0,x.jsxs)(m,{children:[(0,x.jsx)(h,{children:`Source`}),(0,x.jsxs)(u,{fullWidth:!0,value:L,onChange:e=>R(e.target.value),children:[(0,x.jsx)(d,{value:`user`,children:`User`}),(0,x.jsx)(d,{value:`learned`,children:`Learned`})]})]}),(0,x.jsx)(m,{children:(0,x.jsxs)(i,{sx:{px:1},children:[(0,x.jsxs)(h,{children:[`Confidence: `,Math.round(z*100),`%`]}),(0,x.jsx)(a,{value:z,onChange:(e,t)=>B(t),min:0,max:1,step:.01,valueLabelDisplay:`auto`,valueLabelFormat:e=>`${Math.round(e*100)}%`})]})}),(0,x.jsx)(m,{fullWidth:!0,children:(0,x.jsx)(v,{tags:F,editable:!0,onAdd:e=>I(t=>t.includes(e)?t:[...t,e]),onRemove:e=>I(t=>t.filter(t=>t!==e))})})]})}),(0,x.jsxs)(i,{sx:{display:`flex`,gap:1,justifyContent:`flex-end`},children:[(0,x.jsx)(s,{onClick:n,children:`Cancel`}),(0,x.jsx)(s,{variant:`contained`,onClick:G,disabled:V||!C.trim(),children:V?(0,x.jsx)(o,{size:20}):S})]})]})}export{S as t};
+import{r as e}from"./rolldown-runtime-Dw2cE7zH.js";import{O as t,k as n}from"./vendor-markdown-DngssFHR.js";import{$ as r,Y as i,_ as a,nt as o,q as s,r as c,tt as l,v as u,y as d}from"./vendor-mui-DXUYJbRC.js";import{K as f,i as p}from"./vendor-mui-icons-YtgP6dg2.js";import{D as m,E as h,I as g,O as _,P as v,S as y}from"./index-80sqSHwS.js";var b=e(n(),1),x=t();function S({skill:e,onSubmit:t,onCancel:n,submitLabel:S=`Save`}){let[C,w]=(0,b.useState)(``),[T,E]=(0,b.useState)(``),[D,O]=(0,b.useState)([``]),[k,A]=(0,b.useState)([]),[j,M]=(0,b.useState)([]),[N,P]=(0,b.useState)([]),[F,I]=(0,b.useState)([]),[L,R]=(0,b.useState)(`user`),[z,B]=(0,b.useState)(1),[V,H]=(0,b.useState)(!1),[U,W]=(0,b.useState)(!1);(0,b.useEffect)(()=>{e&&(w(e.title),E(e.description),O(e.steps.length>0?e.steps:[``]),A(e.triggers??[]),M(e.inputHints??[]),P(e.filePatterns??[]),I(e.tags??[]),R(e.source),B(e.confidence))},[e]);let G=async()=>{if(!C.trim()){W(!0);return}H(!0);try{await t({title:C.trim(),description:T.trim(),steps:D.map(e=>e.trim()).filter(Boolean),triggers:k,inputHints:j,filePatterns:N,tags:F,source:L,confidence:z})}finally{H(!1)}},K=(e,t)=>{O(n=>n.map((n,r)=>r===e?t:n))},q=()=>{O(e=>[...e,``])},J=e=>{O(t=>t.filter((t,n)=>n!==e))};return(0,x.jsxs)(i,{component:`form`,id:`skill-form`,onSubmit:e=>{e.preventDefault(),G()},sx:{display:`flex`,flexDirection:`column`,gap:3},children:[(0,x.jsx)(g,{title:`Details`,children:(0,x.jsxs)(_,{children:[(0,x.jsxs)(m,{fullWidth:!0,children:[(0,x.jsx)(h,{required:!0,children:`Title`}),(0,x.jsx)(c,{autoFocus:!0,fullWidth:!0,value:C,onChange:e=>{w(e.target.value),W(!1)},error:U,helperText:U?`Title is required`:void 0})]}),(0,x.jsxs)(m,{fullWidth:!0,children:[(0,x.jsx)(h,{children:`Description`}),(0,x.jsx)(y,{value:T,onChange:E,height:200})]})]})}),(0,x.jsx)(g,{title:`Steps`,children:(0,x.jsxs)(i,{sx:{display:`flex`,flexDirection:`column`,gap:1},children:[D.map((e,t)=>(0,x.jsxs)(i,{sx:{display:`flex`,gap:1,alignItems:`center`},children:[(0,x.jsxs)(r,{variant:`body2`,sx:{minWidth:24,color:`text.secondary`},children:[t+1,`.`]}),(0,x.jsx)(c,{fullWidth:!0,size:`small`,value:e,onChange:e=>K(t,e.target.value),placeholder:`Step ${t+1}`}),D.length>1&&(0,x.jsx)(l,{size:`small`,onClick:()=>J(t),color:`error`,children:(0,x.jsx)(p,{fontSize:`small`})})]},t)),(0,x.jsx)(s,{size:`small`,startIcon:(0,x.jsx)(f,{}),onClick:q,sx:{alignSelf:`flex-start`},children:`Add Step`})]})}),(0,x.jsx)(g,{title:`Matching`,children:(0,x.jsxs)(_,{children:[(0,x.jsxs)(m,{fullWidth:!0,children:[(0,x.jsx)(h,{children:`Triggers`}),(0,x.jsx)(v,{tags:k,editable:!0,onAdd:e=>A(t=>t.includes(e)?t:[...t,e]),onRemove:e=>A(t=>t.filter(t=>t!==e))})]}),(0,x.jsxs)(m,{fullWidth:!0,children:[(0,x.jsx)(h,{children:`Input Hints`}),(0,x.jsx)(v,{tags:j,editable:!0,onAdd:e=>M(t=>t.includes(e)?t:[...t,e]),onRemove:e=>M(t=>t.filter(t=>t!==e))})]}),(0,x.jsxs)(m,{fullWidth:!0,children:[(0,x.jsx)(h,{children:`File Patterns`}),(0,x.jsx)(v,{tags:N,editable:!0,onAdd:e=>P(t=>t.includes(e)?t:[...t,e]),onRemove:e=>P(t=>t.filter(t=>t!==e))})]})]})}),(0,x.jsx)(g,{title:`Properties`,children:(0,x.jsxs)(_,{children:[(0,x.jsxs)(m,{children:[(0,x.jsx)(h,{children:`Source`}),(0,x.jsxs)(u,{fullWidth:!0,value:L,onChange:e=>R(e.target.value),children:[(0,x.jsx)(d,{value:`user`,children:`User`}),(0,x.jsx)(d,{value:`learned`,children:`Learned`})]})]}),(0,x.jsx)(m,{children:(0,x.jsxs)(i,{sx:{px:1},children:[(0,x.jsxs)(h,{children:[`Confidence: `,Math.round(z*100),`%`]}),(0,x.jsx)(a,{value:z,onChange:(e,t)=>B(t),min:0,max:1,step:.01,valueLabelDisplay:`auto`,valueLabelFormat:e=>`${Math.round(e*100)}%`})]})}),(0,x.jsx)(m,{fullWidth:!0,children:(0,x.jsx)(v,{tags:F,editable:!0,onAdd:e=>I(t=>t.includes(e)?t:[...t,e]),onRemove:e=>I(t=>t.filter(t=>t!==e))})})]})}),(0,x.jsxs)(i,{sx:{display:`flex`,gap:1,justifyContent:`flex-end`},children:[(0,x.jsx)(s,{onClick:n,children:`Cancel`}),(0,x.jsx)(s,{variant:`contained`,onClick:G,disabled:V||!C.trim(),children:V?(0,x.jsx)(o,{size:20}):S})]})]})}export{S as t};

package/dist/ui/assets/{TaskForm-DgPVeiI9.js → TaskForm-ltmMCEAE.js}

@@ -1 +1 @@
-import{r as e}from"./rolldown-runtime-Dw2cE7zH.js";import{D as t,O as n}from"./vendor-markdown-CT8ZVEPu.js";import{l as r}from"./vendor-react-CHUjhoxh.js";import{Y as i,nt as a,q as o,r as s,v as c,y as l}from"./vendor-mui-BPj7d3Sw.js";import{D as u,E as d,I as f,O as p,P as m,S as h,et as g,t as _}from"./index-CEweXD9O.js";var v=e(n(),1),y=t();function b({task:e,onSubmit:t,onCancel:n,submitLabel:b=`Save`}){let{projectId:x}=r(),[S,C]=(0,v.useState)(``),[w,T]=(0,v.useState)(``),[E,D]=(0,v.useState)(`todo`),[O,k]=(0,v.useState)(`medium`),[A,j]=(0,v.useState)([]),[M,N]=(0,v.useState)(``),[P,F]=(0,v.useState)(``),[I,L]=(0,v.useState)(``),[R,z]=(0,v.useState)([]),[B,V]=(0,v.useState)(!1),[H,U]=(0,v.useState)(!1);(0,v.useEffect)(()=>{e&&(C(e.title),T(e.description),D(e.status),k(e.priority),j(e.tags??[]),N(e.dueDate?new Date(e.dueDate).toISOString().split(`T`)[0]:``),F(e.estimate==null?``:String(e.estimate)),L(e.assignee??``))},[e]),(0,v.useEffect)(()=>{x&&g(x).then(z).catch(()=>{})},[x]);let W=async()=>{if(!S.trim()){U(!0);return}V(!0);try{await t({title:S.trim(),description:w.trim(),status:E,priority:O,tags:A,dueDate:M?new Date(M).getTime():null,estimate:P?Number(P):null,assignee:I||null})}finally{V(!1)}};return(0,y.jsxs)(i,{component:`form`,id:`task-form`,onSubmit:e=>{e.preventDefault(),W()},sx:{display:`flex`,flexDirection:`column`,gap:3},children:[(0,y.jsx)(f,{title:`Details`,children:(0,y.jsxs)(p,{children:[(0,y.jsxs)(u,{fullWidth:!0,children:[(0,y.jsx)(d,{required:!0,children:`Title`}),(0,y.jsx)(s,{autoFocus:!0,fullWidth:!0,value:S,onChange:e=>{C(e.target.value),U(!1)},error:H,helperText:H?`Title is required`:void 0})]}),(0,y.jsxs)(u,{fullWidth:!0,children:[(0,y.jsx)(d,{children:`Description`}),(0,y.jsx)(h,{value:w,onChange:T,height:250})]})]})}),(0,y.jsx)(f,{title:`Properties`,children:(0,y.jsxs)(p,{children:[(0,y.jsxs)(u,{children:[(0,y.jsx)(d,{children:`Status`}),(0,y.jsx)(c,{fullWidth:!0,value:E,onChange:e=>D(e.target.value),children:_.map(e=>(0,y.jsx)(l,{value:e.status,children:e.label},e.status))})]}),(0,y.jsxs)(u,{children:[(0,y.jsx)(d,{children:`Priority`}),(0,y.jsxs)(c,{fullWidth:!0,value:O,onChange:e=>k(e.target.value),children:[(0,y.jsx)(l,{value:`critical`,children:`Critical`}),(0,y.jsx)(l,{value:`high`,children:`High`}),(0,y.jsx)(l,{value:`medium`,children:`Medium`}),(0,y.jsx)(l,{value:`low`,children:`Low`})]})]}),(0,y.jsxs)(u,{children:[(0,y.jsx)(d,{children:`Due Date`}),(0,y.jsx)(s,{fullWidth:!0,type:`date`,value:M,onChange:e=>N(e.target.value)})]}),(0,y.jsxs)(u,{children:[(0,y.jsx)(d,{children:`Estimate (hours)`}),(0,y.jsx)(s,{fullWidth:!0,type:`number`,value:P,onChange:e=>F(e.target.value),slotProps:{input:{inputProps:{min:0,step:.5}}}})]}),(0,y.jsxs)(u,{children:[(0,y.jsx)(d,{children:`Assignee`}),(0,y.jsxs)(c,{fullWidth:!0,value:I,onChange:e=>L(e.target.value),displayEmpty:!0,renderValue:e=>e?R.find(t=>t.id===e)?.name||e:`Unassigned`,children:[(0,y.jsx)(l,{value:``,children:`Unassigned`}),R.map(e=>(0,y.jsx)(l,{value:e.id,children:e.name||e.id},e.id))]})]}),(0,y.jsx)(u,{fullWidth:!0,children:(0,y.jsx)(m,{tags:A,editable:!0,onAdd:e=>j(t=>t.includes(e)?t:[...t,e]),onRemove:e=>j(t=>t.filter(t=>t!==e))})})]})}),(0,y.jsxs)(i,{sx:{display:`flex`,gap:1,justifyContent:`flex-end`},children:[(0,y.jsx)(o,{onClick:n,children:`Cancel`}),(0,y.jsx)(o,{variant:`contained`,onClick:W,disabled:B||!S.trim(),children:B?(0,y.jsx)(a,{size:20}):b})]})]})}export{b as t};
+import{r as e}from"./rolldown-runtime-Dw2cE7zH.js";import{O as t,k as n}from"./vendor-markdown-DngssFHR.js";import{l as r}from"./vendor-react-DxfYAwYK.js";import{Y as i,nt as a,q as o,r as s,v as c,y as l}from"./vendor-mui-DXUYJbRC.js";import{D as u,E as d,I as f,O as p,P as m,S as h,et as g,t as _}from"./index-80sqSHwS.js";var v=e(n(),1),y=t();function b({task:e,onSubmit:t,onCancel:n,submitLabel:b=`Save`}){let{projectId:x}=r(),[S,C]=(0,v.useState)(``),[w,T]=(0,v.useState)(``),[E,D]=(0,v.useState)(`todo`),[O,k]=(0,v.useState)(`medium`),[A,j]=(0,v.useState)([]),[M,N]=(0,v.useState)(``),[P,F]=(0,v.useState)(``),[I,L]=(0,v.useState)(``),[R,z]=(0,v.useState)([]),[B,V]=(0,v.useState)(!1),[H,U]=(0,v.useState)(!1);(0,v.useEffect)(()=>{e&&(C(e.title),T(e.description),D(e.status),k(e.priority),j(e.tags??[]),N(e.dueDate?new Date(e.dueDate).toISOString().split(`T`)[0]:``),F(e.estimate==null?``:String(e.estimate)),L(e.assignee??``))},[e]),(0,v.useEffect)(()=>{x&&g(x).then(z).catch(()=>{})},[x]);let W=async()=>{if(!S.trim()){U(!0);return}V(!0);try{await t({title:S.trim(),description:w.trim(),status:E,priority:O,tags:A,dueDate:M?new Date(M).getTime():null,estimate:P?Number(P):null,assignee:I||null})}finally{V(!1)}};return(0,y.jsxs)(i,{component:`form`,id:`task-form`,onSubmit:e=>{e.preventDefault(),W()},sx:{display:`flex`,flexDirection:`column`,gap:3},children:[(0,y.jsx)(f,{title:`Details`,children:(0,y.jsxs)(p,{children:[(0,y.jsxs)(u,{fullWidth:!0,children:[(0,y.jsx)(d,{required:!0,children:`Title`}),(0,y.jsx)(s,{autoFocus:!0,fullWidth:!0,value:S,onChange:e=>{C(e.target.value),U(!1)},error:H,helperText:H?`Title is required`:void 0})]}),(0,y.jsxs)(u,{fullWidth:!0,children:[(0,y.jsx)(d,{children:`Description`}),(0,y.jsx)(h,{value:w,onChange:T,height:250})]})]})}),(0,y.jsx)(f,{title:`Properties`,children:(0,y.jsxs)(p,{children:[(0,y.jsxs)(u,{children:[(0,y.jsx)(d,{children:`Status`}),(0,y.jsx)(c,{fullWidth:!0,value:E,onChange:e=>D(e.target.value),children:_.map(e=>(0,y.jsx)(l,{value:e.status,children:e.label},e.status))})]}),(0,y.jsxs)(u,{children:[(0,y.jsx)(d,{children:`Priority`}),(0,y.jsxs)(c,{fullWidth:!0,value:O,onChange:e=>k(e.target.value),children:[(0,y.jsx)(l,{value:`critical`,children:`Critical`}),(0,y.jsx)(l,{value:`high`,children:`High`}),(0,y.jsx)(l,{value:`medium`,children:`Medium`}),(0,y.jsx)(l,{value:`low`,children:`Low`})]})]}),(0,y.jsxs)(u,{children:[(0,y.jsx)(d,{children:`Due Date`}),(0,y.jsx)(s,{fullWidth:!0,type:`date`,value:M,onChange:e=>N(e.target.value)})]}),(0,y.jsxs)(u,{children:[(0,y.jsx)(d,{children:`Estimate (hours)`}),(0,y.jsx)(s,{fullWidth:!0,type:`number`,value:P,onChange:e=>F(e.target.value),slotProps:{input:{inputProps:{min:0,step:.5}}}})]}),(0,y.jsxs)(u,{children:[(0,y.jsx)(d,{children:`Assignee`}),(0,y.jsxs)(c,{fullWidth:!0,value:I,onChange:e=>L(e.target.value),displayEmpty:!0,renderValue:e=>e?R.find(t=>t.id===e)?.name||e:`Unassigned`,children:[(0,y.jsx)(l,{value:``,children:`Unassigned`}),R.map(e=>(0,y.jsx)(l,{value:e.id,children:e.name||e.id},e.id))]})]}),(0,y.jsx)(u,{fullWidth:!0,children:(0,y.jsx)(m,{tags:A,editable:!0,onAdd:e=>j(t=>t.includes(e)?t:[...t,e]),onRemove:e=>j(t=>t.filter(t=>t!==e))})})]})}),(0,y.jsxs)(i,{sx:{display:`flex`,gap:1,justifyContent:`flex-end`},children:[(0,y.jsx)(o,{onClick:n,children:`Cancel`}),(0,y.jsx)(o,{variant:`contained`,onClick:W,disabled:B||!S.trim(),children:B?(0,y.jsx)(a,{size:20}):b})]})]})}export{b as t};