@noteplanco/noteplan-mcp 1.1.21 → 1.1.24

package/dist/tools/notes.test.js

@@ -1,10 +1,11 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 // Mock preferences before importing markdown-parser (which reads UserDefaults at runtime)
 vi.mock('../noteplan/preferences.js', () => ({
     getTaskMarkerConfigCached: vi.fn(() => ({
         isAsteriskTodo: true,
         isDashTodo: false,
         defaultTodoCharacter: '*',
+        todoCharacter: '*',
         useCheckbox: true,
         taskPrefix: '* [ ] ',
     })),
@@ -1383,7 +1384,7 @@ describe('matchesFrontmatterProperties – property filter edge cases', () => {
 // ---------------------------------------------------------------------------
 // We test the getNote logic by importing the function and mocking the readers.
 // Since getNote depends on sqliteReader and fileReader, we use vi.mock.
-import { getNote } from '../noteplan/unified-store.js';
+import { getNote, listNotes } from '../noteplan/unified-store.js';
 import * as sqliteReader from '../noteplan/sqlite-reader.js';
 import * as fileReader from '../noteplan/file-reader.js';
 vi.mock('../noteplan/sqlite-reader.js', () => ({
@@ -1437,36 +1438,36 @@ describe('getNote id/filename resolution', () => {
     beforeEach(() => {
         vi.clearAllMocks();
     });
-    it('retrieves a local note via id when SQLite lookup returns null', () => {
-        vi.mocked(sqliteReader.getSpaceNote).mockReturnValue(null);
-        vi.mocked(fileReader.readNoteFile).mockReturnValue(localNote);
-        const result = getNote({ id: 'Notes/Books/my-book.md' });
+    it('retrieves a local note via id when SQLite lookup returns null', async () => {
+        vi.mocked(sqliteReader.getSpaceNote).mockResolvedValue(null);
+        vi.mocked(fileReader.readNoteFile).mockResolvedValue(localNote);
+        const result = await getNote({ id: 'Notes/Books/my-book.md' });
         expect(result).toEqual(localNote);
         expect(sqliteReader.getSpaceNote).toHaveBeenCalledWith('Notes/Books/my-book.md');
         expect(fileReader.readNoteFile).toHaveBeenCalledWith('Notes/Books/my-book.md');
     });
-    it('retrieves a local note via filename', () => {
-        vi.mocked(fileReader.readNoteFile).mockReturnValue(localNote);
-        const result = getNote({ filename: 'Notes/Books/my-book.md' });
+    it('retrieves a local note via filename', async () => {
+        vi.mocked(fileReader.readNoteFile).mockResolvedValue(localNote);
+        const result = await getNote({ filename: 'Notes/Books/my-book.md' });
         expect(result).toEqual(localNote);
     });
-    it('id and filename return the same note for local notes', () => {
-        vi.mocked(sqliteReader.getSpaceNote).mockReturnValue(null);
-        vi.mocked(fileReader.readNoteFile).mockReturnValue(localNote);
-        const byId = getNote({ id: localNote.filename });
-        const byFilename = getNote({ filename: localNote.filename });
+    it('id and filename return the same note for local notes', async () => {
+        vi.mocked(sqliteReader.getSpaceNote).mockResolvedValue(null);
+        vi.mocked(fileReader.readNoteFile).mockResolvedValue(localNote);
+        const byId = await getNote({ id: localNote.filename });
+        const byFilename = await getNote({ filename: localNote.filename });
         expect(byId).toEqual(byFilename);
     });
-    it('returns null for non-existent id', () => {
-        vi.mocked(sqliteReader.getSpaceNote).mockReturnValue(null);
-        vi.mocked(fileReader.readNoteFile).mockReturnValue(null);
-        const result = getNote({ id: 'Notes/nonexistent.md' });
+    it('returns null for non-existent id', async () => {
+        vi.mocked(sqliteReader.getSpaceNote).mockResolvedValue(null);
+        vi.mocked(fileReader.readNoteFile).mockResolvedValue(null);
+        const result = await getNote({ id: 'Notes/nonexistent.md' });
         expect(result).toBeNull();
     });
-    it('prefers space note when SQLite lookup succeeds', () => {
+    it('prefers space note when SQLite lookup succeeds', async () => {
         const spaceNote = { ...localNote, source: 'space', id: 'space-uuid-123' };
-        vi.mocked(sqliteReader.getSpaceNote).mockReturnValue(spaceNote);
-        const result = getNote({ id: 'space-uuid-123' });
+        vi.mocked(sqliteReader.getSpaceNote).mockResolvedValue(spaceNote);
+        const result = await getNote({ id: 'space-uuid-123' });
         expect(result).toEqual(spaceNote);
         expect(fileReader.readNoteFile).not.toHaveBeenCalled();
     });
@@ -2218,4 +2219,483 @@ describe('type filtering with code and table', () => {
         expect(result.filteredCount).toBe(5); // 4 code + 1 task
     });
 });
+// ---------------------------------------------------------------------------
+// Title resolution and search: frontmatter title vs body title vs filename
+// Verifies that search/filter pipelines use the frontmatter title when present,
+// matching the Swift-side title resolution (Globals.swift / TemplateHelper).
+// ---------------------------------------------------------------------------
+import { extractTitle } from '../noteplan/markdown-parser.js';
+describe('title resolution for search – frontmatter title takes priority', () => {
+    // Simulate how unified-store builds Note objects and how listNotes filters them
+    function buildNote(content, filename) {
+        return {
+            id: filename,
+            title: extractTitle(content),
+            filename,
+            content,
+            type: 'note',
+            source: 'local',
+        };
+    }
+    // Replicates the listNotes query filter from notes.ts
+    // Normalizes underscores to spaces; pipe = OR, spaces = AND
+    function matchesListQuery(note, query) {
+        const haystack = `${note.title} ${note.filename} ${note.folder || ''}`
+            .toLowerCase()
+            .replace(/_/g, ' ');
+        const alternatives = query.toLowerCase().split('|').map((alt) => alt.trim().replace(/_/g, ' ')).filter(Boolean);
+        return alternatives.some((alt) => {
+            const words = alt.split(/\s+/).filter(Boolean);
+            return words.every((word) => haystack.includes(word));
+        });
+    }
+    // Replicates metadataScoreTokenAware from unified-store.ts (title_or_filename search)
+    // Normalizes underscores to spaces; multi-word queries use AND matching
+    function normalizeForMatch(value) {
+        return value.replace(/_/g, ' ');
+    }
+    function metadataScore(value, term) {
+        if (!value || !term)
+            return 0;
+        if (value === term)
+            return 120;
+        if (value.startsWith(term))
+            return 100;
+        if (value.includes(term))
+            return 80;
+        return 0;
+    }
+    function metadataScoreTokenAware(value, term) {
+        if (!value || !term)
+            return 0;
+        const normalizedValue = normalizeForMatch(value);
+        const normalizedTerm = normalizeForMatch(term);
+        const words = normalizedTerm.split(/\s+/).filter(Boolean);
+        if (words.length <= 1) {
+            return Math.max(metadataScore(value, term), metadataScore(normalizedValue, normalizedTerm));
+        }
+        const allMatch = words.every((word) => normalizedValue.includes(word));
+        if (!allMatch)
+            return 0;
+        if (normalizedValue === normalizedTerm)
+            return 120;
+        if (normalizedValue.startsWith(normalizedTerm))
+            return 100;
+        return 70 + Math.min(words.length, 10);
+    }
+    // Replicates splitSearchTerms from unified-store.ts (OR on `|`)
+    function splitSearchTerms(query) {
+        const tokens = query.split('|').map((t) => t.trim()).filter(Boolean);
+        return tokens.length > 0 ? tokens : [query.trim()];
+    }
+    // Replicates scoreMetadataMatch: OR across `|`-separated terms,
+    // AND within space-separated words of each term
+    function matchesTitleOrFilename(note, query) {
+        const lowerTitle = note.title.toLowerCase();
+        const lowerFilename = note.filename.toLowerCase();
+        const terms = splitSearchTerms(query);
+        for (const rawTerm of terms) {
+            const term = rawTerm.toLowerCase();
+            if (metadataScoreTokenAware(lowerTitle, term) > 0)
+                return true;
+            if (metadataScoreTokenAware(lowerFilename, term) > 0)
+                return true;
+        }
+        return false;
+    }
+    // --- Local notes ---
+    it('local note: listNotes query matches frontmatter title, not just filename', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body Heading', 'Notes/🟥_0012_project 2 2 2 2.txt');
+        expect(note.title).toBe('🟥_0049_knuth_reviewer');
+        expect(matchesListQuery(note, '0049')).toBe(true);
+        expect(matchesListQuery(note, 'knuth')).toBe(true);
+    });
+    it('local note: listNotes query does NOT match filename-only content when frontmatter title is different', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body Heading', 'Notes/🟥_0012_project 2 2 2 2.txt');
+        // The filename contains "0012" but the frontmatter title does not — however
+        // listNotes searches BOTH title and filename, so this should still match via filename
+        expect(matchesListQuery(note, '0012')).toBe(true);
+    });
+    it('local note: title_or_filename search matches frontmatter title', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body Heading', 'Notes/🟥_0012_project 2 2 2 2.txt');
+        expect(matchesTitleOrFilename(note, '0049')).toBe(true);
+        expect(matchesTitleOrFilename(note, 'knuth_reviewer')).toBe(true);
+    });
+    it('local note: title_or_filename search matches filename too', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body Heading', 'Notes/🟥_0012_project 2 2 2 2.txt');
+        expect(matchesTitleOrFilename(note, '0012')).toBe(true);
+    });
+    it('local note: uses body heading as title when frontmatter has no title/name', () => {
+        const note = buildNote('---\ntype: project-note\ntags: #test\n---\n# My Project Title', 'Notes/random-filename.txt');
+        expect(note.title).toBe('My Project Title');
+        expect(matchesTitleOrFilename(note, 'my project')).toBe(true);
+        expect(matchesListQuery(note, 'my project')).toBe(true);
+    });
+    it('local note: uses name property as title fallback', () => {
+        const note = buildNote('---\nname: My Named Note\ntags: #test\n---\n# Different Heading', 'Notes/something.txt');
+        expect(note.title).toBe('My Named Note');
+        expect(matchesTitleOrFilename(note, 'named note')).toBe(true);
+    });
+    // --- Space notes (simulating rowToNote behavior) ---
+    // This simulates the fixed rowToNote: content present → extractTitle(content) is used
+    function buildSpaceNote(content, dbTitle, filename) {
+        return {
+            id: 'space-id-123',
+            title: content ? extractTitle(content) : dbTitle || 'Untitled',
+            filename,
+            content,
+            type: 'note',
+            source: 'space',
+        };
+    }
+    it('space note: uses frontmatter title, not SQLite title column', () => {
+        const note = buildSpaceNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body Heading', '🟥_0012_project 2 2 2 2', // SQLite title column (filename-derived)
+        '🟥_0012_project 2 2 2 2.md');
+        expect(note.title).toBe('🟥_0049_knuth_reviewer');
+        expect(matchesTitleOrFilename(note, '0049')).toBe(true);
+        expect(matchesTitleOrFilename(note, 'knuth')).toBe(true);
+    });
+    it('space note: does NOT use the SQLite title when frontmatter title exists', () => {
+        const note = buildSpaceNote('---\ntitle: Correct Title\n---\n# Body', 'Wrong DB Title', 'wrong-db-title.md');
+        expect(note.title).toBe('Correct Title');
+        expect(note.title).not.toBe('Wrong DB Title');
+    });
+    it('space note: uses body heading when frontmatter has no title', () => {
+        const note = buildSpaceNote('---\ntags: #test\n---\n# Body Heading Title', 'db-filename-title', 'db-filename-title.md');
+        expect(note.title).toBe('Body Heading Title');
+        expect(matchesTitleOrFilename(note, 'body heading')).toBe(true);
+    });
+    it('space note: falls back to dbTitle when content is empty', () => {
+        const note = buildSpaceNote('', 'DB Fallback Title', 'some-file.md');
+        expect(note.title).toBe('DB Fallback Title');
+    });
+    it('space note: returns Untitled when both content and dbTitle are empty', () => {
+        const note = buildSpaceNote('', '', 'empty.md');
+        expect(note.title).toBe('Untitled');
+    });
+    it('space note: listNotes query matches frontmatter title from space note', () => {
+        const note = buildSpaceNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', '🟥_0012_project 2 2 2 2', '🟥_0012_project 2 2 2 2.md');
+        expect(matchesListQuery(note, '0049')).toBe(true);
+        expect(matchesListQuery(note, 'knuth_reviewer')).toBe(true);
+    });
+    // --- Token-aware AND matching with underscore normalization ---
+    it('title_or_filename: "knuth reviewer" (space) matches "knuth_reviewer" (underscore)', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        expect(matchesTitleOrFilename(note, 'knuth reviewer')).toBe(true);
+    });
+    it('listNotes: "knuth reviewer" (space) matches "knuth_reviewer" (underscore)', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        expect(matchesListQuery(note, 'knuth reviewer')).toBe(true);
+    });
+    it('multi-word query matches tokens in any order', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        expect(matchesTitleOrFilename(note, 'reviewer knuth')).toBe(true);
+        expect(matchesListQuery(note, 'reviewer knuth')).toBe(true);
+    });
+    it('multi-word query requires ALL tokens (AND logic)', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        // "knuth" matches but "einstein" does not → should fail
+        expect(matchesTitleOrFilename(note, 'knuth einstein')).toBe(false);
+        expect(matchesListQuery(note, 'knuth einstein')).toBe(false);
+    });
+    it('single word with underscore in query matches underscore in title', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        expect(matchesTitleOrFilename(note, 'knuth_reviewer')).toBe(true);
+        expect(matchesListQuery(note, 'knuth_reviewer')).toBe(true);
+    });
+    it('number substring still matches within underscore-separated title', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        expect(matchesTitleOrFilename(note, '0049')).toBe(true);
+        expect(matchesListQuery(note, '0049')).toBe(true);
+    });
+    // Multi-word frontmatter keys (e.g. "start date") must not break title resolution
+    it('local note: extracts frontmatter title when multi-word keys are present', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\nstart date: 2026-02\ntags: #project/scope\ntype: project-note\n---\n# Body Heading', 'Notes/🟥_0012_project 2 2 2 2.txt');
+        expect(note.title).toBe('🟥_0049_knuth_reviewer');
+        expect(matchesTitleOrFilename(note, '0049')).toBe(true);
+        expect(matchesListQuery(note, 'knuth')).toBe(true);
+    });
+    it('space note: extracts frontmatter title when multi-word keys are present', () => {
+        const note = buildSpaceNote('---\ntitle: 🟥_0049_knuth_reviewer\nstart date: 2026-02\ntags: #project/scope\ntype: project-note\n---\n# Body Heading', '🟥_0012_project 2 2 2 2', '🟥_0012_project 2 2 2 2.md');
+        expect(note.title).toBe('🟥_0049_knuth_reviewer');
+        expect(matchesTitleOrFilename(note, '0049')).toBe(true);
+        expect(matchesListQuery(note, 'knuth_reviewer')).toBe(true);
+    });
+    // --- OR separator (pipe |) and AND (spaces) ---
+    it('pipe | gives OR: matches if either term matches', () => {
+        const note = buildNote('---\ntitle: Meeting Notes\n---\n# Body', 'Notes/meeting-notes.txt');
+        // "meeting" matches, "nonexistent" doesn't — OR means it should match
+        expect(matchesTitleOrFilename(note, 'nonexistent | meeting')).toBe(true);
+    });
+    it('pipe | gives OR: fails if neither term matches', () => {
+        const note = buildNote('---\ntitle: Meeting Notes\n---\n# Body', 'Notes/meeting-notes.txt');
+        expect(matchesTitleOrFilename(note, 'nonexistent | alsonot')).toBe(false);
+    });
+    it('pipe | gives OR: matches on second alternative', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        // First term doesn't match, second does
+        expect(matchesTitleOrFilename(note, 'einstein | knuth')).toBe(true);
+    });
+    it('spaces give AND: all words must match', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        expect(matchesTitleOrFilename(note, 'knuth reviewer')).toBe(true);
+        expect(matchesTitleOrFilename(note, 'knuth 0049')).toBe(true);
+        expect(matchesTitleOrFilename(note, 'knuth einstein')).toBe(false);
+    });
+    it('OR with AND: each pipe alternative is AND-matched independently', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        // "knuth einstein" fails AND, but "0049 reviewer" passes AND → OR succeeds
+        expect(matchesTitleOrFilename(note, 'knuth einstein | 0049 reviewer')).toBe(true);
+    });
+    it('OR with AND: fails when no alternative matches all its tokens', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        expect(matchesTitleOrFilename(note, 'knuth einstein | foo bar')).toBe(false);
+    });
+    // --- listNotes also supports OR (pipe) ---
+    it('listNotes: pipe | gives OR', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        expect(matchesListQuery(note, 'nonexistent | knuth')).toBe(true);
+        expect(matchesListQuery(note, 'nonexistent | alsonot')).toBe(false);
+    });
+    it('listNotes: OR with AND combined', () => {
+        const note = buildNote('---\ntitle: 🟥_0049_knuth_reviewer\ntype: project-note\n---\n# Body', 'Notes/some-file.txt');
+        expect(matchesListQuery(note, 'knuth einstein | 0049 reviewer')).toBe(true);
+        expect(matchesListQuery(note, 'foo bar | baz qux')).toBe(false);
+    });
+    // --- Symmetric underscore normalization ---
+    it('underscore in search term matches space in title', () => {
+        const note = buildNote('---\ntitle: knuth reviewer notes\n---\n# Body', 'Notes/some-file.txt');
+        // Title has spaces, query has underscore — should still match
+        expect(matchesTitleOrFilename(note, 'knuth_reviewer')).toBe(true);
+    });
+    it('underscore in search term matches underscore in title', () => {
+        const note = buildNote('---\ntitle: knuth_reviewer_notes\n---\n# Body', 'Notes/some-file.txt');
+        expect(matchesTitleOrFilename(note, 'knuth_reviewer')).toBe(true);
+    });
+    it('space in search term matches underscore in title', () => {
+        const note = buildNote('---\ntitle: knuth_reviewer_notes\n---\n# Body', 'Notes/some-file.txt');
+        expect(matchesTitleOrFilename(note, 'knuth reviewer')).toBe(true);
+    });
+});
+// ── listNotes — folder scope inside a space (regression: PR #6 by @steinwaywhw) ──
+// Ported from PR #6 to the post-bridge async architecture.
+describe('listNotes – folder scope inside a space', () => {
+    const spaceId = 'space-001';
+    const folderId = 'folder-001';
+    const noteInFolder = {
+        id: 'note-in-folder',
+        title: 'Project Alpha',
+        filename: `%%NotePlanCloud%%/${spaceId}/${folderId}/note-in-folder`,
+        type: 'note',
+        source: 'space',
+        folder: folderId,
+        content: '# Project Alpha',
+        modifiedAt: new Date(),
+        createdAt: new Date(),
+        spaceId,
+    };
+    const noteInOtherFolder = {
+        ...noteInFolder,
+        id: 'note-other',
+        title: 'Other Note',
+        folder: 'folder-002',
+        filename: `%%NotePlanCloud%%/${spaceId}/folder-002/note-other`,
+    };
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.mocked(sqliteReader.listSpaces).mockResolvedValue([
+            { id: spaceId, name: 'My Space', noteCount: 2 },
+        ]);
+        vi.mocked(sqliteReader.listSpaceNotes).mockResolvedValue([noteInFolder, noteInOtherFolder]);
+    });
+    it('returns only notes in the resolved folder', async () => {
+        vi.mocked(sqliteReader.resolveSpaceFolder).mockResolvedValue({
+            id: folderId,
+            path: 'Active Projects',
+            name: 'Active Projects',
+            source: 'space',
+            spaceId,
+        });
+        const result = await listNotes({ folder: 'Active Projects', space: 'My Space' });
+        expect(result.map((n) => n.title)).toEqual(['Project Alpha']);
+        expect(sqliteReader.resolveSpaceFolder).toHaveBeenCalledWith(spaceId, 'Active Projects');
+    });
+    it('returns empty when the folder does not resolve in the space', async () => {
+        vi.mocked(sqliteReader.resolveSpaceFolder).mockResolvedValue(null);
+        const result = await listNotes({ folder: 'Nonexistent', space: 'My Space' });
+        expect(result).toHaveLength(0);
+    });
+    it('returns all space notes when no folder is specified', async () => {
+        const result = await listNotes({ space: 'My Space' });
+        expect(result).toHaveLength(2);
+        expect(sqliteReader.resolveSpaceFolder).not.toHaveBeenCalled();
+    });
+});
+// ---------------------------------------------------------------------------
+// Folder access rules — read-side filtering in unified-store
+// ---------------------------------------------------------------------------
+import { searchNotes, listFolders, listTags, getCalendarNote, invalidateListingCaches } from '../noteplan/unified-store.js';
+import { __resetFolderAccessConfigForTests } from '../utils/folder-access.js';
+describe('folder-access read-side filtering', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        delete process.env.NOTEPLAN_ALLOWED_FOLDERS;
+        delete process.env.NOTEPLAN_DENIED_FOLDERS;
+        __resetFolderAccessConfigForTests();
+        // The listNotes cache is module-level so a previous test's filtered
+        // result would leak into this one. Reset before every case.
+        invalidateListingCaches();
+        // Reset readers to safe defaults — individual tests override.
+        vi.mocked(sqliteReader.listSpaces).mockResolvedValue([]);
+        vi.mocked(sqliteReader.listSpaceNotes).mockResolvedValue([]);
+        vi.mocked(sqliteReader.searchSpaceNotesFTS).mockResolvedValue({ results: [], backend: 'sqlite' });
+        vi.mocked(fileReader.listProjectNotes).mockResolvedValue([]);
+        vi.mocked(fileReader.listCalendarNotes).mockResolvedValue([]);
+        vi.mocked(fileReader.searchLocalNotes).mockResolvedValue([]);
+        vi.mocked(fileReader.readNoteFile).mockResolvedValue(null);
+    });
+    afterEach(() => {
+        delete process.env.NOTEPLAN_ALLOWED_FOLDERS;
+        delete process.env.NOTEPLAN_DENIED_FOLDERS;
+        __resetFolderAccessConfigForTests();
+    });
+    it('listNotes drops notes inside a denied folder', async () => {
+        process.env.NOTEPLAN_DENIED_FOLDERS = 'Notes/Personal';
+        __resetFolderAccessConfigForTests();
+        const personal = {
+            id: 'Notes/Personal/Diary.md',
+            title: 'Diary',
+            filename: 'Notes/Personal/Diary.md',
+            type: 'note',
+            source: 'local',
+            folder: 'Notes/Personal',
+            content: '',
+            modifiedAt: new Date(),
+            createdAt: new Date(),
+            spaceId: undefined,
+        };
+        const work = { ...personal, id: 'Notes/Work/Plan.md', filename: 'Notes/Work/Plan.md', folder: 'Notes/Work', title: 'Plan' };
+        vi.mocked(fileReader.listProjectNotes).mockResolvedValue([personal, work]);
+        const result = await listNotes();
+        expect(result.map((n) => n.filename)).toEqual(['Notes/Work/Plan.md']);
+    });
+    it('getNote returns null for a denied filename even if the reader has it', async () => {
+        process.env.NOTEPLAN_DENIED_FOLDERS = 'Notes/Personal';
+        __resetFolderAccessConfigForTests();
+        const personal = {
+            id: 'Notes/Personal/Diary.md',
+            title: 'Diary',
+            filename: 'Notes/Personal/Diary.md',
+            type: 'note',
+            source: 'local',
+            folder: 'Notes/Personal',
+            content: '',
+            modifiedAt: new Date(),
+            createdAt: new Date(),
+            spaceId: undefined,
+        };
+        vi.mocked(fileReader.readNoteFile).mockResolvedValue(personal);
+        vi.mocked(sqliteReader.getSpaceNote).mockResolvedValue(null);
+        const result = await getNote({ filename: 'Notes/Personal/Diary.md' });
+        expect(result).toBeNull();
+    });
+    it('searchNotes filters denied folders out of the result set', async () => {
+        process.env.NOTEPLAN_DENIED_FOLDERS = 'Notes/Personal';
+        __resetFolderAccessConfigForTests();
+        const personal = {
+            id: 'Notes/Personal/Diary.md',
+            title: 'Diary about work',
+            filename: 'Notes/Personal/Diary.md',
+            type: 'note',
+            source: 'local',
+            folder: 'Notes/Personal',
+            content: 'meeting work plan',
+            modifiedAt: new Date(),
+            createdAt: new Date(),
+            spaceId: undefined,
+        };
+        const work = { ...personal, id: 'Notes/Work/Plan.md', filename: 'Notes/Work/Plan.md', folder: 'Notes/Work', title: 'Diary at Work' };
+        // Use the metadata-search branch (searchField=title) so we don't need to
+        // wrangle the ripgrep mock — same filter site applies.
+        vi.mocked(fileReader.listProjectNotes).mockResolvedValue([personal, work]);
+        const result = await searchNotes('diary', { searchField: 'title' });
+        // Both notes have "diary" in their title; the denied one must be filtered out.
+        expect(result.results.map((r) => r.note.filename)).toEqual(['Notes/Work/Plan.md']);
+    });
+    // Folder *listings* themselves used to leak — `noteplan_folders(action: list/find/resolve)`
+    // would return a denied folder by name. The fix prepends `Notes/` to the folder's relative
+    // path so the same env-var match works ("Notes/Personal" rule against `Personal/Diary`).
+    it('listFolders drops local folders inside a denied subtree', async () => {
+        process.env.NOTEPLAN_DENIED_FOLDERS = 'Notes/Personal';
+        __resetFolderAccessConfigForTests();
+        vi.mocked(fileReader.listFolders).mockResolvedValue([
+            { path: 'Personal', name: 'Personal', source: 'local' },
+            { path: 'Personal/Finance', name: 'Finance', source: 'local' },
+            { path: 'Work', name: 'Work', source: 'local' },
+        ]);
+        const result = await listFolders();
+        expect(result.map((f) => f.path)).toEqual(['Work']);
+    });
+    // getCalendarNote / getTodayNote / per-day fetches in getNotesInRange used
+    // to call fileReader.getCalendarNote directly, bypassing isFolderAllowed.
+    // Important: a user can deny `Calendar` outright to hide all calendar notes.
+    it('getCalendarNote returns null when Calendar/ is denied', async () => {
+        process.env.NOTEPLAN_DENIED_FOLDERS = 'Calendar';
+        __resetFolderAccessConfigForTests();
+        vi.mocked(fileReader.getCalendarNote).mockResolvedValue({
+            id: 'Calendar/20260507.txt',
+            title: '20260507',
+            filename: 'Calendar/20260507.txt',
+            type: 'calendar',
+            source: 'local',
+            folder: 'Calendar',
+            content: 'private',
+            modifiedAt: new Date(),
+            createdAt: new Date(),
+            spaceId: undefined,
+        });
+        const result = await getCalendarNote('20260507');
+        expect(result).toBeNull();
+    });
+    // listTags walked the bridge / ripgrep / filesystem indiscriminately, so
+    // tag NAMES from denied notes leaked through `noteplan_search(action:
+    // list_tags)` even though the notes themselves were filtered. When rules
+    // are configured we now iterate the already-filtered listNotes() output.
+    it('listTags excludes tags that exist only inside a denied folder', async () => {
+        process.env.NOTEPLAN_DENIED_FOLDERS = 'Notes/Personal';
+        __resetFolderAccessConfigForTests();
+        const personal = {
+            id: 'Notes/Personal/Diary.md',
+            title: 'Diary',
+            filename: 'Notes/Personal/Diary.md',
+            type: 'note',
+            source: 'local',
+            folder: 'Notes/Personal',
+            content: 'session with #therapist about #anxiety',
+            modifiedAt: new Date(),
+            createdAt: new Date(),
+            spaceId: undefined,
+        };
+        const work = {
+            ...personal,
+            id: 'Notes/Work/Plan.md',
+            filename: 'Notes/Work/Plan.md',
+            folder: 'Notes/Work',
+            title: 'Plan',
+            content: 'review #q2 plan with #team',
+        };
+        vi.mocked(fileReader.listProjectNotes).mockResolvedValue([personal, work]);
+        const tags = await listTags();
+        expect(tags).toEqual(expect.arrayContaining(['#q2', '#team']));
+        expect(tags).not.toContain('#therapist');
+        expect(tags).not.toContain('#anxiety');
+    });
+    // No rules configured → keep the fast bridge / ripgrep / extractAllTags path.
+    it('listTags uses the fast extractAllTags path when no rules are configured', async () => {
+        vi.mocked(fileReader.extractAllTags).mockResolvedValue(['#fast', '#path']);
+        const tags = await listTags();
+        expect(tags).toEqual(['#fast', '#path']);
+        expect(fileReader.extractAllTags).toHaveBeenCalled();
+    });
+});
 //# sourceMappingURL=notes.test.js.map