@graphmemory/server 1.3.2 → 1.3.3

package/dist/api/rest/graph.js

@@ -8,7 +8,7 @@ function exportGraph(graph, graphName) {
     const edges = [];
     graph.forEachNode((id, attrs) => {
         // Skip proxy nodes and embeddings for transfer size
-        const { embedding, fileEmbedding, ...rest } = attrs;
+        const { embedding, fileEmbedding, body, pendingImports, pendingEdges, ...rest } = attrs;
         nodes.push({ id, graph: graphName, ...rest });
     });
     graph.forEachEdge((_edge, attrs, source, target) => {

package/dist/api/rest/index.js

@@ -232,7 +232,6 @@ function createRestApp(projectManager, options) {
             }
             return {
                 id,
-                projectDir: p.config.projectDir,
                 workspaceId: p.workspaceId ?? null,
                 graphs,
                 stats: {

package/dist/api/rest/validation.js

@@ -45,9 +45,9 @@ exports.noteSearchSchema = zod_1.z.object({
     searchMode: zod_1.z.enum(['hybrid', 'vector', 'keyword']).optional(),
 });
 exports.noteListSchema = zod_1.z.object({
-    filter: zod_1.z.string().optional(),
-    tag: zod_1.z.string().optional(),
-    limit: zod_1.z.coerce.number().int().positive().optional(),
+    filter: zod_1.z.string().max(500).optional(),
+    tag: zod_1.z.string().max(defaults_1.MAX_TAG_LEN).optional(),
+    limit: zod_1.z.coerce.number().int().positive().max(1000).optional(),
 });
 // ---------------------------------------------------------------------------
 // Task schemas
@@ -93,10 +93,10 @@ exports.taskSearchSchema = zod_1.z.object({
 exports.taskListSchema = zod_1.z.object({
     status: zod_1.z.enum(['backlog', 'todo', 'in_progress', 'review', 'done', 'cancelled']).optional(),
     priority: zod_1.z.enum(['critical', 'high', 'medium', 'low']).optional(),
-    tag: zod_1.z.string().optional(),
-    filter: zod_1.z.string().optional(),
-    assignee: zod_1.z.string().optional(),
-    limit: zod_1.z.coerce.number().int().positive().optional(),
+    tag: zod_1.z.string().max(defaults_1.MAX_TAG_LEN).optional(),
+    filter: zod_1.z.string().max(500).optional(),
+    assignee: zod_1.z.string().max(defaults_1.MAX_ASSIGNEE_LEN).optional(),
+    limit: zod_1.z.coerce.number().int().positive().max(1000).optional(),
 });
 // ---------------------------------------------------------------------------
 // Search schemas (docs, code, files)
@@ -108,18 +108,18 @@ exports.searchQuerySchema = zod_1.z.object({
     searchMode: zod_1.z.enum(['hybrid', 'vector', 'keyword']).optional(),
 });
 exports.listQuerySchema = zod_1.z.object({
-    filter: zod_1.z.string().optional(),
-    limit: zod_1.z.coerce.number().int().positive().optional(),
+    filter: zod_1.z.string().max(500).optional(),
+    limit: zod_1.z.coerce.number().int().positive().max(1000).optional(),
 });
 // ---------------------------------------------------------------------------
 // File index schemas
 // ---------------------------------------------------------------------------
 exports.fileListSchema = zod_1.z.object({
-    directory: zod_1.z.string().optional(),
-    extension: zod_1.z.string().optional(),
-    language: zod_1.z.string().optional(),
-    filter: zod_1.z.string().optional(),
-    limit: zod_1.z.coerce.number().int().positive().optional(),
+    directory: zod_1.z.string().max(4096).optional(),
+    extension: zod_1.z.string().max(100).optional(),
+    language: zod_1.z.string().max(100).optional(),
+    filter: zod_1.z.string().max(500).optional(),
+    limit: zod_1.z.coerce.number().int().positive().max(1000).optional(),
 });
 // ---------------------------------------------------------------------------
 // Graph export schema
@@ -165,9 +165,9 @@ exports.skillSearchSchema = zod_1.z.object({
 });
 exports.skillListSchema = zod_1.z.object({
     source: zod_1.z.enum(['user', 'learned']).optional(),
-    tag: zod_1.z.string().optional(),
-    filter: zod_1.z.string().optional(),
-    limit: zod_1.z.coerce.number().int().positive().optional(),
+    tag: zod_1.z.string().max(defaults_1.MAX_TAG_LEN).optional(),
+    filter: zod_1.z.string().max(500).optional(),
+    limit: zod_1.z.coerce.number().int().positive().max(1000).optional(),
 });
 exports.graphExportSchema = zod_1.z.object({
     scope: zod_1.z.enum(['all', 'docs', 'code', 'knowledge', 'tasks', 'files', 'skills']).default('all'),

package/dist/api/tools/code/get-file-symbols.js

@@ -9,12 +9,12 @@ function register(server, mgr) {
             'Returns an array of { id, kind, name, signature, startLine, endLine, isExported }. ' +
             'Pass an id to get_symbol to fetch full content including body and docComment.',
         inputSchema: {
-            fileId: zod_1.z.string().describe('File path relative to code dir, e.g. "src/lib/graph.ts"'),
+            fileId: zod_1.z.string().max(500).describe('File path relative to code dir, e.g. "src/lib/graph.ts"'),
         },
     }, async ({ fileId }) => {
         const symbols = mgr.getFileSymbols(fileId);
         if (symbols.length === 0) {
-            return { content: [{ type: 'text', text: `File not found: ${fileId}` }], isError: true };
+            return { content: [{ type: 'text', text: 'File not found or contains no symbols' }], isError: true };
         }
         const result = symbols.map(s => ({
             id: s.id,

package/dist/api/tools/code/get-symbol.js

@@ -9,12 +9,12 @@ function register(server, mgr) {
             'Node IDs have the form "fileId::symbolName" or "fileId::ClassName::methodName". ' +
             'Returns id, fileId, kind, name, signature, docComment, body, startLine, endLine, isExported, and crossLinks (notes/tasks linking to this symbol).',
         inputSchema: {
-            nodeId: zod_1.z.string().describe('Symbol ID from search_code or get_file_symbols, e.g. "src/lib/graph.ts::updateFile"'),
+            nodeId: zod_1.z.string().max(500).describe('Symbol ID from search_code or get_file_symbols, e.g. "src/lib/graph.ts::updateFile"'),
         },
     }, async ({ nodeId }) => {
         const symbol = mgr.getSymbol(nodeId);
         if (!symbol) {
-            return { content: [{ type: 'text', text: `Symbol not found: ${nodeId}` }], isError: true };
+            return { content: [{ type: 'text', text: 'Symbol not found' }], isError: true };
         }
         const { embedding: _embedding, mtime: _mtime, ...rest } = symbol;
         return { content: [{ type: 'text', text: JSON.stringify(rest, null, 2) }] };

package/dist/api/tools/code/list-files.js

@@ -9,8 +9,8 @@ function register(server, mgr) {
             'Returns an array of { fileId, symbolCount }. ' +
             'Pass a fileId to get_file_symbols to see all its declarations.',
         inputSchema: {
-            filter: zod_1.z.string().optional().describe('Case-insensitive substring to match against file paths, e.g. "graph" or "src/lib"'),
-            limit: zod_1.z.number().optional().describe('Maximum number of results to return (default 20)'),
+            filter: zod_1.z.string().max(500).optional().describe('Case-insensitive substring to match against file paths, e.g. "graph" or "src/lib"'),
+            limit: zod_1.z.number().max(1000).optional().describe('Maximum number of results to return (default 20)'),
         },
     }, async ({ filter, limit }) => ({
         content: [{ type: 'text', text: JSON.stringify(mgr.listFiles(filter, limit), null, 2) }],

package/dist/api/tools/code/search-code.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('search_code', {
         description: 'Semantic search over the indexed source code. ' +
@@ -14,7 +15,7 @@ function register(server, mgr) {
             'id, fileId, kind, name, signature, docComment, startLine, endLine, score. ' +
             'Set includeBody=true to include full source code in results (avoids extra get_symbol calls).',
         inputSchema: {
-            query: zod_1.z.string().describe('Natural language or code search query, e.g. "function that loads the graph from disk"'),
+            query: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Natural language or code search query, e.g. "function that loads the graph from disk"'),
             topK: zod_1.z.number().min(1).max(500).optional().describe('How many top similar symbols to use as seeds (default 5)'),
             bfsDepth: zod_1.z.number().min(0).max(10).optional().describe('How many hops to follow graph edges from each seed (default 1; 0 = no expansion)'),
             maxResults: zod_1.z.number().min(1).max(500).optional().describe('Maximum number of results to return (default 20)'),

package/dist/api/tools/code/search-files.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('search_files', {
         description: 'Semantic search over indexed source code files. ' +
@@ -11,7 +12,7 @@ function register(server, mgr) {
             'fileId, symbolCount, score. ' +
             'Use this to discover which source files are relevant before diving into symbols with get_file_symbols or search_code.',
         inputSchema: {
-            query: zod_1.z.string().describe('Natural language or path search query, e.g. "graph persistence" or "search module"'),
+            query: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Natural language or path search query, e.g. "graph persistence" or "search module"'),
             topK: zod_1.z.number().min(1).max(500).optional().describe('Maximum number of results to return (default 10)'),
             minScore: zod_1.z.number().min(0).max(1).optional().describe('Minimum relevance score 0–1 (default 0.3)'),
         },

package/dist/api/tools/docs/cross-references.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, docMgr, codeMgr) {
     const docGraph = docMgr.graph;
     const codeGraph = codeMgr.graph;
@@ -12,7 +13,7 @@ function register(server, docMgr, codeMgr) {
             'and examples (code blocks in docs that contain the symbol). ' +
             'This is the most comprehensive way to understand a symbol — combining source code, docs, and examples.',
         inputSchema: {
-            symbol: zod_1.z.string().describe('Symbol name to look up, e.g. "createUser", "AuthService"'),
+            symbol: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Symbol name to look up, e.g. "createUser", "AuthService"'),
         },
     }, async ({ symbol }) => {
         // 1. Search CodeGraph for definitions

package/dist/api/tools/docs/explain-symbol.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     const graph = mgr.graph;
     server.registerTool('explain_symbol', {
@@ -10,7 +11,7 @@ function register(server, mgr) {
             'and the surrounding text section that provides context/explanation. ' +
             'Use this to understand what a function, class, or type does based on documentation.',
         inputSchema: {
-            symbol: zod_1.z.string().describe('Symbol name to look up, e.g. "createUser", "AuthService"'),
+            symbol: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Symbol name to look up, e.g. "createUser", "AuthService"'),
             limit: zod_1.z.number().optional().describe('Max results to return (default 10)'),
         },
     }, async ({ symbol, limit = 10 }) => {

package/dist/api/tools/docs/find-examples.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     const graph = mgr.graph;
     server.registerTool('find_examples', {
@@ -10,7 +11,7 @@ function register(server, mgr) {
             'Use this to find usage examples of a known symbol in the docs. ' +
             'Returns matching code block nodes with id, fileId, language, symbols, content, and the parent section context.',
         inputSchema: {
-            symbol: zod_1.z.string().describe('Symbol name to search for, e.g. "createUser", "UserService"'),
+            symbol: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Symbol name to search for, e.g. "createUser", "UserService"'),
             limit: zod_1.z.number().optional().describe('Max results to return (default 20)'),
         },
     }, async ({ symbol, limit = 20 }) => {

package/dist/api/tools/docs/get-node.js

@@ -11,12 +11,12 @@ function register(server, mgr) {
             '"docs/auth.md::Overview" for a named section. ' +
             'Returns id, fileId, title, content, level, links, mtime, and crossLinks (notes/tasks linking to this node).',
         inputSchema: {
-            nodeId: zod_1.z.string().describe('Node ID from search results or get_toc, e.g. "docs/auth.md" or "docs/auth.md::Overview"'),
+            nodeId: zod_1.z.string().max(500).describe('Node ID from search results or get_toc, e.g. "docs/auth.md" or "docs/auth.md::Overview"'),
         },
     }, async ({ nodeId }) => {
         const node = mgr.getNode(nodeId);
         if (!node) {
-            return { content: [{ type: 'text', text: `Node not found: ${nodeId}` }], isError: true };
+            return { content: [{ type: 'text', text: 'Node not found' }], isError: true };
         }
         const { embedding: _embedding, ...rest } = node;
         return { content: [{ type: 'text', text: JSON.stringify(rest, null, 2) }] };

package/dist/api/tools/docs/get-toc.js

@@ -9,12 +9,12 @@ function register(server, mgr) {
             'Returns an array of { id, title, level } objects. ' +
             'The id field is a node ID you can pass directly to get_node to fetch full content.',
         inputSchema: {
-            fileId: zod_1.z.string().describe('File path relative to docs dir, e.g. "docs/auth.md"'),
+            fileId: zod_1.z.string().max(500).describe('File path relative to docs dir, e.g. "docs/auth.md"'),
         },
     }, async ({ fileId }) => {
         const chunks = mgr.getFileChunks(fileId);
         if (chunks.length === 0) {
-            return { content: [{ type: 'text', text: `File not found: ${fileId}` }], isError: true };
+            return { content: [{ type: 'text', text: 'File not found' }], isError: true };
         }
         const toc = chunks.map(c => ({ id: c.id, title: c.title, level: c.level }));
         return { content: [{ type: 'text', text: JSON.stringify(toc, null, 2) }] };

package/dist/api/tools/docs/list-snippets.js

@@ -10,10 +10,10 @@ function register(server, mgr) {
             'Supports filtering by file, language, and content substring. ' +
             'Use this to discover what code examples exist in the docs.',
         inputSchema: {
-            fileId: zod_1.z.string().optional().describe('Filter by file, e.g. "docs/auth.md"'),
-            filter: zod_1.z.string().optional().describe('Case-insensitive substring match on content'),
-            language: zod_1.z.string().optional().describe('Filter by language, e.g. "typescript"'),
-            limit: zod_1.z.number().optional().describe('Max results to return (default 20)'),
+            fileId: zod_1.z.string().max(500).optional().describe('Filter by file, e.g. "docs/auth.md"'),
+            filter: zod_1.z.string().max(500).optional().describe('Case-insensitive substring match on content'),
+            language: zod_1.z.string().max(100).optional().describe('Filter by language, e.g. "typescript"'),
+            limit: zod_1.z.number().max(1000).optional().describe('Max results to return (default 20)'),
         },
     }, async ({ fileId, filter, language, limit = 20 }) => {
         const lowerFilter = filter?.toLowerCase();

package/dist/api/tools/docs/list-topics.js

@@ -9,8 +9,8 @@ function register(server, mgr) {
             'Returns an array of { fileId, title, chunks }. ' +
             'Pass a fileId to get_toc to see its structure, or to search to query it.',
         inputSchema: {
-            filter: zod_1.z.string().optional().describe('Case-insensitive substring to match against file paths, e.g. "auth" or "api"'),
-            limit: zod_1.z.number().optional().describe('Maximum number of results to return (default 20)'),
+            filter: zod_1.z.string().max(500).optional().describe('Case-insensitive substring to match against file paths, e.g. "auth" or "api"'),
+            limit: zod_1.z.number().max(1000).optional().describe('Maximum number of results to return (default 20)'),
         },
     }, async ({ filter, limit }) => ({
         content: [{ type: 'text', text: JSON.stringify(mgr.listFiles(filter, limit), null, 2) }],

package/dist/api/tools/docs/search-files.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('search_topic_files', {
         description: 'Semantic search over indexed documentation files. ' +
@@ -11,7 +12,7 @@ function register(server, mgr) {
             'fileId, title, chunks, score. ' +
             'Use this to discover which doc files are relevant before diving into content with search or get_toc.',
         inputSchema: {
-            query: zod_1.z.string().describe('Natural language search query, e.g. "authentication setup" or "API endpoints"'),
+            query: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Natural language search query, e.g. "authentication setup" or "API endpoints"'),
             topK: zod_1.z.number().min(1).max(500).optional().describe('Maximum number of results to return (default 10)'),
             minScore: zod_1.z.number().min(0).max(1).optional().describe('Minimum relevance score 0–1 (default 0.3)'),
         },

package/dist/api/tools/docs/search-snippets.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     const graph = mgr.graph;
     server.registerTool('search_snippets', {
@@ -11,10 +12,10 @@ function register(server, mgr) {
             'Use this when looking for code examples by description, e.g. "authentication example" or "database query". ' +
             'Returns code block nodes sorted by relevance score.',
         inputSchema: {
-            query: zod_1.z.string().describe('Natural language search query'),
+            query: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Natural language search query'),
             topK: zod_1.z.number().min(1).max(500).optional().describe('Max results to return (default 10)'),
             minScore: zod_1.z.number().min(0).max(1).optional().describe('Minimum relevance score 0–1 (default 0.3)'),
-            language: zod_1.z.string().optional().describe('Filter by language, e.g. "typescript", "python"'),
+            language: zod_1.z.string().max(100).optional().describe('Filter by language, e.g. "typescript", "python"'),
         },
     }, async ({ query, topK = 10, minScore = 0.3, language }) => {
         // Search all nodes via mgr.search (no BFS expansion), then filter to code blocks only

package/dist/api/tools/docs/search.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('search', {
         description: 'Semantic search over the indexed documentation. ' +
@@ -13,7 +14,7 @@ function register(server, mgr) {
             'Use the id from results to fetch full content with get_node. ' +
             'Prefer this tool when looking for information without knowing which file contains it.',
         inputSchema: {
-            query: zod_1.z.string().describe('Natural language search query'),
+            query: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Natural language search query'),
             topK: zod_1.z.number().min(1).max(500).optional().describe('How many top similar sections to use as seeds for graph expansion (default 5)'),
             bfsDepth: zod_1.z.number().min(0).max(10).optional().describe('How many hops to follow cross-document links from each seed (default 1; 0 = no expansion)'),
             maxResults: zod_1.z.number().min(1).max(500).optional().describe('Maximum number of results to return (default 20)'),

package/dist/api/tools/file-index/get-file-info.js

@@ -9,12 +9,12 @@ function register(server, mgr) {
             'For directories: returns filePath, kind, fileName, directory, fileCount, size (total of direct children). ' +
             'Use "." for the project root.',
         inputSchema: {
-            filePath: zod_1.z.string().describe('Relative file or directory path (e.g. "src/lib/config.ts" or "src/lib")'),
+            filePath: zod_1.z.string().max(4096).describe('Relative file or directory path (e.g. "src/lib/config.ts" or "src/lib")'),
         },
     }, async ({ filePath }) => {
         const info = mgr.getFileInfo(filePath);
         if (!info) {
-            return { content: [{ type: 'text', text: `File or directory not found: ${filePath}` }], isError: true };
+            return { content: [{ type: 'text', text: 'File or directory not found' }], isError: true };
         }
         return { content: [{ type: 'text', text: JSON.stringify(info, null, 2) }] };
     });

package/dist/api/tools/file-index/list-all-files.js

@@ -10,15 +10,15 @@ function register(server, mgr) {
             'Returns an array of { filePath, kind, fileName, extension, language, mimeType, size, fileCount }. ' +
             'Use search_all_files for semantic search or get_file_info for detailed metadata on a specific path.',
         inputSchema: {
-            directory: zod_1.z.string().optional()
+            directory: zod_1.z.string().max(4096).optional()
                 .describe('List immediate children of this directory (e.g. ".", "src/lib"). Default: lists all files'),
-            extension: zod_1.z.string().optional()
+            extension: zod_1.z.string().max(100).optional()
                 .describe('Filter by extension (e.g. ".ts", ".md", ".png")'),
-            language: zod_1.z.string().optional()
+            language: zod_1.z.string().max(100).optional()
                 .describe('Filter by language (e.g. "typescript", "markdown", "json")'),
-            filter: zod_1.z.string().optional()
+            filter: zod_1.z.string().max(500).optional()
                 .describe('Substring filter on file path (case-insensitive)'),
-            limit: zod_1.z.number().optional().default(50)
+            limit: zod_1.z.number().max(1000).optional().default(50)
                 .describe('Max results (default 50)'),
         },
     }, async ({ directory, extension, language, filter, limit }) => {

package/dist/api/tools/file-index/search-all-files.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('search_all_files', {
         description: 'Semantic search over all indexed project files by file path. ' +
@@ -11,7 +12,7 @@ function register(server, mgr) {
             'filePath, fileName, extension, language, size, score. ' +
             'Use this to discover which project files are relevant to a topic.',
         inputSchema: {
-            query: zod_1.z.string().describe('Search query'),
+            query: zod_1.z.string().max(defaults_1.MAX_SEARCH_QUERY_LEN).describe('Search query'),
             topK: zod_1.z.number().min(1).max(500).optional().default(10)
                 .describe('Max results (default 10)'),
             minScore: zod_1.z.number().optional().default(0.3)

package/dist/api/tools/knowledge/add-attachment.js

@@ -14,14 +14,36 @@ function register(server, mgr) {
             'The file is copied into the note directory (.notes/{noteId}/). ' +
             'Returns attachment metadata (filename, mimeType, size).',
         inputSchema: {
-            noteId: zod_1.z.string().describe('ID of the note to attach the file to'),
-            filePath: zod_1.z.string().describe('Absolute path to the file on disk'),
+            noteId: zod_1.z.string().max(500).describe('ID of the note to attach the file to'),
+            filePath: zod_1.z.string().max(4096).describe('Absolute path to the file on disk'),
         },
     }, async ({ noteId, filePath }) => {
         const resolved = path_1.default.resolve(filePath);
+        const projectDir = mgr.projectDir;
+        if (!projectDir) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'No project directory configured' }) }], isError: true };
+        }
+        let realResolved;
+        try {
+            realResolved = fs_1.default.realpathSync(resolved);
+        }
+        catch {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'File not found' }) }], isError: true };
+        }
+        let realProject;
+        try {
+            realProject = fs_1.default.realpathSync(path_1.default.resolve(projectDir));
+        }
+        catch {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'Project directory not found' }) }], isError: true };
+        }
+        const normalizedProject = realProject + path_1.default.sep;
+        if (!realResolved.startsWith(normalizedProject) && realResolved !== realProject) {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'File path must be within the project directory' }) }], isError: true };
+        }
         let stat;
         try {
-            stat = fs_1.default.statSync(resolved);
+            stat = fs_1.default.statSync(realResolved);
         }
         catch {
             return { content: [{ type: 'text', text: JSON.stringify({ error: 'File not found' }) }], isError: true };
@@ -32,7 +54,7 @@ function register(server, mgr) {
         if (stat.size > defaults_1.MAX_UPLOAD_SIZE) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: 'File exceeds 50 MB limit' }) }], isError: true };
         }
-        const data = fs_1.default.readFileSync(resolved);
+        const data = fs_1.default.readFileSync(realResolved);
         const filename = path_1.default.basename(resolved);
         const meta = mgr.addAttachment(noteId, filename, data);
         if (!meta) {

package/dist/api/tools/knowledge/create-note.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('create_note', {
         description: 'Create a new note or fact in the knowledge graph. ' +
@@ -9,9 +10,9 @@ function register(server, mgr) {
             'Returns the generated noteId (slug from title). ' +
             'Use create_relation to link notes together.',
         inputSchema: {
-            title: zod_1.z.string().describe('Short title for the note, e.g. "Auth uses JWT tokens"'),
-            content: zod_1.z.string().describe('Full text content of the note'),
-            tags: zod_1.z.array(zod_1.z.string()).optional().describe('Optional tags for filtering, e.g. ["architecture", "decision"]'),
+            title: zod_1.z.string().max(defaults_1.MAX_TITLE_LEN).describe('Short title for the note, e.g. "Auth uses JWT tokens"'),
+            content: zod_1.z.string().max(defaults_1.MAX_NOTE_CONTENT_LEN).describe('Full text content of the note'),
+            tags: zod_1.z.array(zod_1.z.string().max(defaults_1.MAX_TAG_LEN)).max(defaults_1.MAX_TAGS_COUNT).optional().describe('Optional tags for filtering, e.g. ["architecture", "decision"]'),
         },
     }, async ({ title, content, tags }) => {
         const noteId = await mgr.createNote(title, content, tags ?? []);

package/dist/api/tools/knowledge/create-relation.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('create_relation', {
         description: 'Create a directed relation from a note to another note or to a node in the docs/code/files graph. ' +
@@ -9,12 +10,12 @@ function register(server, mgr) {
             'e.g. "relates_to", "depends_on", "contradicts", "supports", "part_of", "references". ' +
             'Set targetGraph to "docs", "code", "files", or "tasks" to link to a doc chunk, code symbol, file/directory, or task.',
         inputSchema: {
-            fromId: zod_1.z.string().describe('Source note ID'),
-            toId: zod_1.z.string().describe('Target note ID, or target node ID in docs/code/files/tasks graph'),
-            kind: zod_1.z.string().describe('Relation type, e.g. "depends_on", "references"'),
+            fromId: zod_1.z.string().max(500).describe('Source note ID'),
+            toId: zod_1.z.string().max(500).describe('Target note ID, or target node ID in docs/code/files/tasks graph'),
+            kind: zod_1.z.string().max(defaults_1.MAX_LINK_KIND_LEN).describe('Relation type, e.g. "depends_on", "references"'),
             targetGraph: zod_1.z.enum(['docs', 'code', 'files', 'tasks', 'skills']).optional()
                 .describe('Set to "docs", "code", "files", "tasks", or "skills" to create a cross-graph link instead of note-to-note'),
-            projectId: zod_1.z.string().optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
+            projectId: zod_1.z.string().max(defaults_1.MAX_PROJECT_ID_LEN).optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
         },
     }, async ({ fromId, toId, kind, targetGraph, projectId }) => {
         const created = mgr.createRelation(fromId, toId, kind, targetGraph, projectId);

package/dist/api/tools/knowledge/delete-note.js

@@ -7,12 +7,12 @@ function register(server, mgr) {
         description: 'Delete a note from the knowledge graph. ' +
             'Also removes all relations (edges) connected to this note.',
         inputSchema: {
-            noteId: zod_1.z.string().describe('ID of the note to delete'),
+            noteId: zod_1.z.string().max(500).describe('ID of the note to delete'),
         },
     }, async ({ noteId }) => {
         const deleted = mgr.deleteNote(noteId);
         if (!deleted) {
-            return { content: [{ type: 'text', text: `Note not found: ${noteId}` }], isError: true };
+            return { content: [{ type: 'text', text: 'Note not found' }], isError: true };
         }
         return { content: [{ type: 'text', text: JSON.stringify({ noteId, deleted: true }, null, 2) }] };
     });

package/dist/api/tools/knowledge/delete-relation.js

@@ -2,16 +2,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('delete_relation', {
         description: 'Delete a directed relation between a note and another note or a cross-graph target. ' +
             'Set targetGraph to "docs", "code", "files", or "tasks" when deleting a cross-graph link.',
         inputSchema: {
-            fromId: zod_1.z.string().describe('Source note ID'),
-            toId: zod_1.z.string().describe('Target note ID, or target node ID in docs/code/files/tasks graph'),
+            fromId: zod_1.z.string().max(500).describe('Source note ID'),
+            toId: zod_1.z.string().max(500).describe('Target note ID, or target node ID in docs/code/files/tasks graph'),
             targetGraph: zod_1.z.enum(['docs', 'code', 'files', 'tasks', 'skills']).optional()
                 .describe('Set to "docs", "code", "files", "tasks", or "skills" when deleting a cross-graph link'),
-            projectId: zod_1.z.string().optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
+            projectId: zod_1.z.string().max(defaults_1.MAX_PROJECT_ID_LEN).optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
         },
     }, async ({ fromId, toId, targetGraph, projectId }) => {
         const deleted = mgr.deleteRelation(fromId, toId, targetGraph, projectId);

package/dist/api/tools/knowledge/find-linked-notes.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('find_linked_notes', {
         description: 'Find all notes in the knowledge graph that link to a specific node in the docs, code, files, or tasks graph. ' +
@@ -10,10 +11,10 @@ function register(server, mgr) {
             'Returns an array of { noteId, title, kind, tags }. ' +
             'Use get_note to fetch full content of a returned note.',
         inputSchema: {
-            targetId: zod_1.z.string().describe('Target node ID in the external graph (e.g. "src/config.ts", "src/auth.ts::login", "docs/api.md::Setup")'),
+            targetId: zod_1.z.string().max(defaults_1.MAX_TARGET_NODE_ID_LEN).describe('Target node ID in the external graph (e.g. "src/config.ts", "src/auth.ts::login", "docs/api.md::Setup")'),
             targetGraph: zod_1.z.enum(['docs', 'code', 'files', 'tasks', 'skills']).describe('Which graph the target belongs to'),
-            kind: zod_1.z.string().optional().describe('Filter by relation kind (e.g. "references", "depends_on"). If omitted, returns all relations.'),
-            projectId: zod_1.z.string().optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
+            kind: zod_1.z.string().max(defaults_1.MAX_LINK_KIND_LEN).optional().describe('Filter by relation kind (e.g. "references", "depends_on"). If omitted, returns all relations.'),
+            projectId: zod_1.z.string().max(defaults_1.MAX_PROJECT_ID_LEN).optional().describe('Project ID that the target node belongs to. Defaults to the current project.'),
         },
     }, async ({ targetId, targetGraph, kind, projectId }) => {
         const results = mgr.findLinkedNotes(targetGraph, targetId, kind, projectId);

package/dist/api/tools/knowledge/get-note.js

@@ -7,12 +7,12 @@ function register(server, mgr) {
         description: 'Return the full content of a note by its ID. ' +
             'Returns id, title, content, tags, createdAt, updatedAt, and relations (including cross-graph links from/to tasks, docs, code, files).',
         inputSchema: {
-            noteId: zod_1.z.string().describe('Note ID, e.g. "auth-uses-jwt-tokens"'),
+            noteId: zod_1.z.string().max(500).describe('Note ID, e.g. "auth-uses-jwt-tokens"'),
         },
     }, async ({ noteId }) => {
         const note = mgr.getNote(noteId);
         if (!note) {
-            return { content: [{ type: 'text', text: `Note not found: ${noteId}` }], isError: true };
+            return { content: [{ type: 'text', text: 'Note not found' }], isError: true };
         }
         const { embedding: _embedding, ...rest } = note;
         return { content: [{ type: 'text', text: JSON.stringify(rest, null, 2) }] };

package/dist/api/tools/knowledge/list-notes.js

@@ -2,15 +2,16 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.register = register;
 const zod_1 = require("zod");
+const defaults_1 = require("../../../lib/defaults");
 function register(server, mgr) {
     server.registerTool('list_notes', {
         description: 'List notes in the knowledge graph. ' +
             'Optionally filter by title/id substring and/or tag. ' +
             'Returns an array of { id, title, tags, updatedAt } sorted by most recently updated.',
         inputSchema: {
-            filter: zod_1.z.string().optional().describe('Case-insensitive substring to match against note title or ID'),
-            tag: zod_1.z.string().optional().describe('Filter by tag (exact match, case-insensitive)'),
-            limit: zod_1.z.number().optional().describe('Maximum number of results (default 20)'),
+            filter: zod_1.z.string().max(500).optional().describe('Case-insensitive substring to match against note title or ID'),
+            tag: zod_1.z.string().max(defaults_1.MAX_TAG_LEN).optional().describe('Filter by tag (exact match, case-insensitive)'),
+            limit: zod_1.z.number().max(1000).optional().describe('Maximum number of results (default 20)'),
         },
     }, async ({ filter, tag, limit }) => ({
         content: [{ type: 'text', text: JSON.stringify(mgr.listNotes(filter, tag, limit), null, 2) }],

package/dist/api/tools/knowledge/list-relations.js

@@ -8,7 +8,7 @@ function register(server, mgr) {
             'Returns an array of { fromId, toId, kind, targetGraph? }. ' +
             'Cross-graph links include targetGraph ("docs", "code", "files", or "tasks") and resolve the real node ID.',
         inputSchema: {
-            noteId: zod_1.z.string().describe('Note ID to list relations for'),
+            noteId: zod_1.z.string().max(500).describe('Note ID to list relations for'),
         },
     }, async ({ noteId }) => {
         const relations = mgr.listRelations(noteId);

package/dist/api/tools/knowledge/remove-attachment.js

@@ -6,7 +6,7 @@ function register(server, mgr) {
     server.registerTool('remove_note_attachment', {
         description: 'Remove an attachment from a note. The file is deleted from disk.',
         inputSchema: {
-            noteId: zod_1.z.string().describe('ID of the note'),
+            noteId: zod_1.z.string().max(500).describe('ID of the note'),
             filename: zod_1.z.string().min(1).max(255)
                 .refine(s => !/[/\\]/.test(s), 'Filename must not contain path separators')
                 .refine(s => !s.includes('..'), 'Filename must not contain ..')