@noteplanco/noteplan-mcp 1.1.23 → 1.1.24

package/dist/noteplan/file-writer.js

@@ -1,26 +1,10 @@
-// File system writer for local NotePlan notes
 import * as fs from 'fs';
 import * as path from 'path';
-import { getNotePlanPath, getNotesPath, getFileExtension, buildCalendarNotePath, getCalendarNote, isValidNoteExtension, } from './file-reader.js';
-/**
- * Rename/move a file, with fallback for sandboxed/mounted filesystems.
- * EPERM/EXDEV: copy + delete instead of atomic rename.
- */
-function moveFile(source, destination) {
-    try {
-        fs.renameSync(source, destination);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === 'EPERM' || code === 'EXDEV') {
-            fs.copyFileSync(source, destination);
-            fs.unlinkSync(source);
-        }
-        else {
-            throw error;
-        }
-    }
-}
+import { getNotePlanPath, getNotesPath, getFileExtension, buildCalendarNotePathAsync, getCalendarNote, isValidNoteExtension, } from './file-reader.js';
+import { readFileUtf8, statPath, pathExists, writeFileUtf8, makeDirectory, moveFile, } from '../transport/bridge-fs.js';
+import { BridgeHttpError } from '../transport/bridge-client.js';
+import { ATTACHMENT_SUFFIX, getAttachmentsAbsolutePath, getNoteBaseName, } from './attachments-paths.js';
+import { assertFolderAllowed } from '../utils/folder-access.js';
 function ensurePathInsideRoot(candidatePath, rootPath, label) {
     const resolvedCandidate = path.resolve(candidatePath);
     const resolvedRoot = path.resolve(rootPath);
@@ -193,106 +177,148 @@ function resolveRenamedFilename(currentFullPath, newFilename, keepExtension) {
     return `${requestedBase}${requestedExt}`;
 }
 /**
- * Write content to a note file atomically
- * NotePlan's FolderMonitor will detect the change within ~300ms.
- *
- * Important: use in-place writes for existing files so filesystem birthtime
- * (used as createdAt in MCP responses) does not reset on every edit.
+ * Use in-place writes for existing files so filesystem birthtime (exposed as
+ * createdAt in MCP responses) does not reset on every edit.
  */
-export function writeNoteFile(filePath, content) {
+export async function writeNoteFile(filePath, content) {
     const fullPath = path.isAbsolute(filePath) ? filePath : path.join(getNotePlanPath(), filePath);
     ensurePathInsideRoot(fullPath, getNotePlanPath(), 'File path');
-    // Ensure directory exists
-    const dir = path.dirname(fullPath);
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true });
-    }
-    // Normalize line endings to Unix style
     const normalizedContent = content.replace(/\r\n/g, '\n');
-    // Preserve createdAt for existing notes by avoiding temp-file rename.
-    // Renaming a temp file replaces the inode and resets birthtime.
-    if (fs.existsSync(fullPath)) {
-        fs.writeFileSync(fullPath, normalizedContent, { encoding: 'utf-8' });
+    if (await pathExists(fullPath)) {
+        await writeFileUtf8(fullPath, normalizedContent);
         return;
     }
-    // For new files, create exclusively to avoid accidental overwrite races.
     try {
-        fs.writeFileSync(fullPath, normalizedContent, { encoding: 'utf-8', flag: 'wx' });
-    }
-    catch (error) {
-        const maybeErrno = error;
-        if (maybeErrno.code === 'EEXIST' || maybeErrno.code === 'EPERM') {
-            // EEXIST: file appeared between existsSync and writeFileSync — safe to overwrite.
-            // EPERM: sandboxed/mounted filesystems (e.g. Claude Co-Work, iCloud FUSE) may not
-            //   support O_EXCL (wx flag). Fall back to plain write.
-            fs.writeFileSync(fullPath, normalizedContent, { encoding: 'utf-8' });
+        await writeFileUtf8(fullPath, normalizedContent, { exclusive: true });
+    }
+    catch (err) {
+        const code = err.code;
+        const conflict = code === 'EEXIST' ||
+            code === 'EPERM' ||
+            (err instanceof BridgeHttpError && err.status === 409);
+        if (conflict) {
+            await writeFileUtf8(fullPath, normalizedContent);
             return;
         }
-        throw error;
+        throw err;
     }
 }
 /**
- * Create a new project note
+ * Resolve a caller-supplied filename to a safe basename + extension. Path
+ * separators and `..` are rejected up-front because they bypass the
+ * folder argument; everything else is run through sanitizeFilename and
+ * given the configured default extension if none was provided.
  */
-export function createProjectNote(title, content = '', folder) {
-    // Sanitize title for filename
-    const safeTitle = sanitizeFilename(title);
-    // Strip Notes/ prefix if present to avoid double-nesting (Notes/Notes/...)
-    const cleanFolder = folder?.replace(/^Notes\//, '');
-    const folderPath = cleanFolder ? path.join('Notes', cleanFolder) : 'Notes';
-    const ext = getFileExtension(); // Use detected extension
-    const filePath = path.join(folderPath, `${safeTitle}${ext}`);
-    // Check if file already exists (with any extension)
+function resolveExplicitFilename(filename, defaultExt) {
+    const trimmed = filename.trim();
+    if (trimmed.length === 0) {
+        throw new Error('filename is empty');
+    }
+    if (/[/\\]/.test(trimmed) || trimmed.split(/[/\\]/).some((segment) => segment === '..')) {
+        throw new Error('filename must be a basename only (no path separators). Use the "folder" parameter to choose a folder.');
+    }
+    const ext = path.extname(trimmed).toLowerCase();
+    const hasKnownExt = ext === '.md' || ext === '.txt';
+    const base = hasKnownExt ? trimmed.slice(0, -ext.length) : trimmed;
+    const finalExt = hasKnownExt ? ext : defaultExt;
+    const safeBase = sanitizeFilename(base);
+    if (safeBase.length === 0) {
+        throw new Error('filename is invalid after sanitization');
+    }
+    return `${safeBase}${finalExt}`;
+}
+/**
+ * Reject creation if a note already exists at `filePath` under either
+ * `.md` or `.txt`. NotePlan treats both as equivalent for a given base
+ * name, so creating `Foo.md` while `Foo.txt` is on disk would produce
+ * a duplicate that the app silently merges. Shared by both project- and
+ * calendar-note creation.
+ */
+async function assertNoteDoesNotExistAtPath(filePath) {
     const fullPath = path.join(getNotePlanPath(), filePath);
+    const ext = path.extname(filePath);
     const altExt = ext === '.txt' ? '.md' : '.txt';
-    const altPath = path.join(getNotePlanPath(), folderPath, `${safeTitle}${altExt}`);
-    if (fs.existsSync(fullPath)) {
+    const altRelative = `${filePath.slice(0, -ext.length)}${altExt}`;
+    const altFullPath = `${fullPath.slice(0, -ext.length)}${altExt}`;
+    if (await pathExists(fullPath)) {
         throw new Error(`Note already exists: ${filePath}`);
     }
-    if (fs.existsSync(altPath)) {
-        throw new Error(`Note already exists: ${path.join(folderPath, `${safeTitle}${altExt}`)}`);
+    if (await pathExists(altFullPath)) {
+        throw new Error(`Note already exists: ${altRelative}`);
     }
-    // Create content with title as heading if content is empty
+}
+/**
+ * Create a new project note. When `filename` is provided it overrides
+ * the title-derived basename — callers can keep the on-disk name (e.g.
+ * `_context.md`) decoupled from the human-readable title.
+ */
+export async function createProjectNote(title, content = '', folder, filename) {
+    // Strip an optional `Notes/` prefix OR a bare `Notes` (the root-only
+    // case). Without the `(\/|$)` branch, `folder = "Notes"` slipped past
+    // and produced `Notes/Notes/<title>` on disk.
+    const cleanFolder = folder?.replace(/^Notes(\/|$)/, '');
+    const folderPath = cleanFolder ? path.join('Notes', cleanFolder) : 'Notes';
+    const defaultExt = getFileExtension();
+    const fileBasename = filename
+        ? resolveExplicitFilename(filename, defaultExt)
+        : `${sanitizeFilename(title)}${defaultExt}`;
+    const filePath = path.join(folderPath, fileBasename);
+    assertFolderAllowed(filePath, 'create note in');
+    await assertNoteDoesNotExistAtPath(filePath);
     const noteContent = content || `# ${title}\n\n`;
-    writeNoteFile(filePath, noteContent);
+    await writeNoteFile(filePath, noteContent);
     return filePath;
 }
 /**
  * Create or update a calendar note
  */
-export function createCalendarNote(dateStr, content) {
-    // Use the detected configuration for file path
-    const filePath = buildCalendarNotePath(dateStr);
-    writeNoteFile(filePath, content);
+export async function createCalendarNote(dateStr, content) {
+    const filePath = await buildCalendarNotePathAsync(dateStr);
+    await writeNoteFile(filePath, content);
+    return filePath;
+}
+/**
+ * Create a calendar note only if one doesn't already exist for that date,
+ * checking both extensions. Mirrors the collision semantics of
+ * `createProjectNote` so the `noteplan_manage_note(action: create)` flow
+ * can reject duplicates loudly instead of clobbering a periodic note the
+ * user has been working on.
+ */
+export async function createCalendarNoteIfNew(dateStr, content) {
+    const filePath = await buildCalendarNotePathAsync(dateStr);
+    assertFolderAllowed(filePath, 'create calendar note in');
+    await assertNoteDoesNotExistAtPath(filePath);
+    await writeNoteFile(filePath, content);
     return filePath;
 }
 /**
  * Append content to a note
  */
-export function appendToNote(filePath, content) {
+export async function appendToNote(filePath, content) {
     const fullPath = path.isAbsolute(filePath) ? filePath : path.join(getNotePlanPath(), filePath);
     ensurePathInsideRoot(fullPath, getNotePlanPath(), 'File path');
-    if (!fs.existsSync(fullPath)) {
+    assertFolderAllowed(filePath, 'append to');
+    const existingContent = await readFileUtf8(fullPath);
+    if (existingContent === null) {
         throw new Error(`Note not found: ${filePath}`);
     }
-    const existingContent = fs.readFileSync(fullPath, 'utf-8');
     const newContent = existingContent.endsWith('\n')
         ? existingContent + content
         : existingContent + '\n' + content;
-    writeNoteFile(filePath, newContent);
+    await writeNoteFile(filePath, newContent);
 }
 /**
  * Prepend content to a note (after frontmatter if present)
  */
-export function prependToNote(filePath, content) {
+export async function prependToNote(filePath, content) {
     const fullPath = path.isAbsolute(filePath) ? filePath : path.join(getNotePlanPath(), filePath);
     ensurePathInsideRoot(fullPath, getNotePlanPath(), 'File path');
-    if (!fs.existsSync(fullPath)) {
+    assertFolderAllowed(filePath, 'prepend to');
+    const existingContent = await readFileUtf8(fullPath);
+    if (existingContent === null) {
         throw new Error(`Note not found: ${filePath}`);
     }
-    const existingContent = fs.readFileSync(fullPath, 'utf-8');
     const lines = existingContent.split('\n');
-    // Find end of frontmatter if present
     let insertIndex = 0;
     if (lines[0]?.trim() === '---') {
         for (let i = 1; i < lines.length; i++) {
@@ -302,63 +328,107 @@ export function prependToNote(filePath, content) {
             }
         }
     }
-    // Insert content
     lines.splice(insertIndex, 0, content);
-    writeNoteFile(filePath, lines.join('\n'));
+    await writeNoteFile(filePath, lines.join('\n'));
 }
 /**
  * Update a note's content
  */
-export function updateNote(filePath, content) {
+export async function updateNote(filePath, content) {
     const fullPath = toLocalNoteAbsolutePath(filePath);
-    if (!fs.existsSync(fullPath)) {
+    assertFolderAllowed(filePath, 'update');
+    if (!(await pathExists(fullPath))) {
         throw new Error(`Note not found: ${filePath}`);
     }
-    writeNoteFile(filePath, content);
+    await writeNoteFile(filePath, content);
+}
+/**
+ * Move the sibling `_attachments` folder alongside a note file operation.
+ * Idempotent: the bridge-Swift path already moves attachments via
+ * `DataStore.moveNote` when NotePlan is running, so the pathExists check
+ * makes both bridge and fs-fallback paths safe to call unconditionally.
+ */
+async function relocateAttachmentsFolderIfPresent(oldNoteAbsolutePath, newNoteAbsolutePath) {
+    const oldFolder = getAttachmentsAbsolutePath(oldNoteAbsolutePath);
+    const newFolder = getAttachmentsAbsolutePath(newNoteAbsolutePath);
+    if (oldFolder === newFolder)
+        return;
+    if (!(await pathExists(oldFolder)))
+        return;
+    await moveFile(oldFolder, newFolder);
 }
 /**
- * Delete a note (move to trash)
+ * After a rename that changes the basename, rewrite `[label](old_attachments/file)`
+ * style references in the renamed note's content so they point at the
+ * new folder name. Best-effort literal-string replace — basenames with
+ * URL-encodable characters (spaces, parentheses) may need manual fixup.
  */
-export function deleteNote(filePath) {
+async function rewriteAttachmentLinksAfterRename(noteAbsolutePath, oldBaseName, newBaseName) {
+    if (oldBaseName === newBaseName)
+        return;
+    const content = await readFileUtf8(noteAbsolutePath);
+    if (content === null)
+        return;
+    const oldRef = `${oldBaseName}${ATTACHMENT_SUFFIX}/`;
+    if (!content.includes(oldRef))
+        return;
+    const newRef = `${newBaseName}${ATTACHMENT_SUFFIX}/`;
+    await writeFileUtf8(noteAbsolutePath, content.split(oldRef).join(newRef));
+}
+export async function deleteNote(filePath) {
     const fullPath = toLocalNoteAbsolutePath(filePath);
-    if (!fs.existsSync(fullPath)) {
+    assertFolderAllowed(filePath, 'delete');
+    if (!(await pathExists(fullPath))) {
         throw new Error(`Note not found: ${filePath}`);
     }
-    // Reject non-text files (e.g. .key, .pdf) — only .md and .txt are valid notes
     if (!isValidNoteExtension(path.basename(fullPath))) {
         throw new Error(`Cannot delete: "${path.basename(fullPath)}" is not a note file. Only .md and .txt files are supported.`);
     }
-    // Move to Notes/@Trash (matching NotePlan's own moveToTrash behavior)
     const trashPath = path.join(getNotesPath(), '@Trash');
-    if (!fs.existsSync(trashPath)) {
-        fs.mkdirSync(trashPath, { recursive: true });
+    if (!(await pathExists(trashPath))) {
+        await makeDirectory(trashPath);
     }
     const filename = path.basename(fullPath);
     const trashFilePath = path.join(trashPath, filename);
-    // Handle duplicate filenames in trash
     let finalTrashPath = trashFilePath;
     let counter = 1;
-    while (fs.existsSync(finalTrashPath)) {
+    while (await pathExists(finalTrashPath)) {
         const ext = path.extname(filename);
         const base = path.basename(filename, ext);
         finalTrashPath = path.join(trashPath, `${base}-${counter}${ext}`);
         counter++;
     }
-    moveFile(fullPath, finalTrashPath);
+    await moveFile(fullPath, finalTrashPath);
+    // Drag the sibling _attachments/ folder along so embedded images/files
+    // are recoverable from @Trash and the note's relative links keep
+    // resolving if the user restores it. Match the trashed note's
+    // (possibly suffix-disambiguated) basename.
+    const sourceAttachments = getAttachmentsAbsolutePath(fullPath);
+    const sourceBaseName = getNoteBaseName(fullPath);
+    const trashedBaseName = getNoteBaseName(finalTrashPath);
+    if (await pathExists(sourceAttachments)) {
+        const trashedAttachmentsPath = path.join(path.dirname(finalTrashPath), `${trashedBaseName}${ATTACHMENT_SUFFIX}`);
+        await moveFile(sourceAttachments, trashedAttachmentsPath);
+    }
+    // If the trash collision suffix changed the basename, the in-content
+    // attachment links still point at the original folder name — rewrite
+    // them so a later restore (which preserves the trashed basename)
+    // produces a functional note.
+    await rewriteAttachmentLinksAfterRename(finalTrashPath, sourceBaseName, trashedBaseName);
     return path.relative(getNotePlanPath(), finalTrashPath);
 }
 /**
  * Preview local note move target without mutating the filesystem
  */
-export function previewMoveLocalNote(filePath, destinationFolder) {
+export async function previewMoveLocalNote(filePath, destinationFolder) {
     const fullPath = toLocalNoteAbsolutePath(filePath);
-    if (!fs.existsSync(fullPath)) {
+    const sourceStat = await statPath(fullPath);
+    if (!sourceStat.exists) {
         throw new Error(`Note not found: ${filePath}`);
     }
-    if (fs.statSync(fullPath).isDirectory()) {
+    if (sourceStat.isDir) {
         throw new Error(`Not a note file: ${filePath}`);
     }
-    // Reject non-text files (e.g. .key, .pdf) — only .md and .txt are valid notes
     if (!isValidNoteExtension(path.basename(fullPath))) {
         throw new Error(`Cannot move: "${path.basename(fullPath)}" is not a note file. Only .md and .txt files are supported.`);
     }
@@ -371,38 +441,48 @@ export function previewMoveLocalNote(filePath, destinationFolder) {
     if (path.resolve(nextAbsolutePath) === path.resolve(fullPath)) {
         throw new Error('Note is already in the destination folder');
     }
-    if (fs.existsSync(nextAbsolutePath)) {
+    if (await pathExists(nextAbsolutePath)) {
         throw new Error(`A note already exists at destination: ${path.relative(getNotePlanPath(), nextAbsolutePath)}`);
     }
+    const fromFilename = path.relative(getNotePlanPath(), fullPath);
+    const toFilename = path.relative(getNotePlanPath(), nextAbsolutePath);
+    // Both source and destination must be accessible — otherwise an agent
+    // could exfiltrate from a denied folder by moving notes out of it.
+    // Asserting at preview time means dry-run requests also fail loudly
+    // instead of leaking path-existence info.
+    assertFolderAllowed(fromFilename, 'move from');
+    assertFolderAllowed(toFilename, 'move to');
     return {
-        fromFilename: path.relative(getNotePlanPath(), fullPath),
-        toFilename: path.relative(getNotePlanPath(), nextAbsolutePath),
+        fromFilename,
+        toFilename,
         destinationFolder: normalizedDestinationFolder,
     };
 }
 /**
  * Move a local note to another folder
  */
-export function moveLocalNote(filePath, destinationFolder) {
-    const preview = previewMoveLocalNote(filePath, destinationFolder);
+export async function moveLocalNote(filePath, destinationFolder) {
+    const preview = await previewMoveLocalNote(filePath, destinationFolder);
     const sourcePath = path.join(getNotePlanPath(), preview.fromFilename);
     const targetPath = path.join(getNotePlanPath(), preview.toFilename);
     const targetDir = path.dirname(targetPath);
-    if (!fs.existsSync(targetDir)) {
-        fs.mkdirSync(targetDir, { recursive: true });
+    if (!(await pathExists(targetDir))) {
+        await makeDirectory(targetDir);
     }
-    moveFile(sourcePath, targetPath);
+    await moveFile(sourcePath, targetPath);
+    await relocateAttachmentsFolderIfPresent(sourcePath, targetPath);
     return preview.toFilename;
 }
 /**
  * Preview restoring a local note from @Trash into Notes
  */
-export function previewRestoreLocalNoteFromTrash(filePath, destinationFolder) {
+export async function previewRestoreLocalNoteFromTrash(filePath, destinationFolder) {
     const fullPath = toLocalNoteAbsolutePath(filePath);
-    if (!fs.existsSync(fullPath)) {
+    const sourceStat = await statPath(fullPath);
+    if (!sourceStat.exists) {
         throw new Error(`Note not found: ${filePath}`);
     }
-    if (fs.statSync(fullPath).isDirectory()) {
+    if (sourceStat.isDir) {
         throw new Error(`Not a note file: ${filePath}`);
     }
     const trashRoot = path.join(getNotesPath(), '@Trash');
@@ -411,41 +491,47 @@ export function previewRestoreLocalNoteFromTrash(filePath, destinationFolder) {
     const destinationDir = path.join(getNotePlanPath(), normalizedDestinationFolder);
     ensurePathInsideRoot(destinationDir, getNotesPath(), 'Destination folder');
     const nextAbsolutePath = path.join(destinationDir, path.basename(fullPath));
-    if (fs.existsSync(nextAbsolutePath)) {
+    if (await pathExists(nextAbsolutePath)) {
         throw new Error(`A note already exists at destination: ${path.relative(getNotePlanPath(), nextAbsolutePath)}`);
     }
+    const toFilename = path.relative(getNotePlanPath(), nextAbsolutePath);
+    // The trash itself isn't filtered (users restore there even if it
+    // sits outside their allowlist), but the destination must be accessible.
+    // Asserting at preview time also blocks dry-run probes.
+    assertFolderAllowed(toFilename, 'restore to');
     return {
         fromFilename: path.relative(getNotePlanPath(), fullPath),
-        toFilename: path.relative(getNotePlanPath(), nextAbsolutePath),
+        toFilename,
         destinationFolder: normalizedDestinationFolder,
     };
 }
 /**
  * Restore a local note from @Trash into Notes
  */
-export function restoreLocalNoteFromTrash(filePath, destinationFolder) {
-    const preview = previewRestoreLocalNoteFromTrash(filePath, destinationFolder);
+export async function restoreLocalNoteFromTrash(filePath, destinationFolder) {
+    const preview = await previewRestoreLocalNoteFromTrash(filePath, destinationFolder);
     const sourcePath = path.join(getNotePlanPath(), preview.fromFilename);
     const targetPath = path.join(getNotePlanPath(), preview.toFilename);
     const targetDir = path.dirname(targetPath);
-    if (!fs.existsSync(targetDir)) {
-        fs.mkdirSync(targetDir, { recursive: true });
+    if (!(await pathExists(targetDir))) {
+        await makeDirectory(targetDir);
     }
-    moveFile(sourcePath, targetPath);
+    await moveFile(sourcePath, targetPath);
+    await relocateAttachmentsFolderIfPresent(sourcePath, targetPath);
     return preview.toFilename;
 }
 /**
  * Preview local note rename target without mutating the filesystem
  */
-export function previewRenameLocalNoteFile(filePath, newFilename, keepExtension = true) {
+export async function previewRenameLocalNoteFile(filePath, newFilename, keepExtension = true) {
     const fullPath = toLocalNoteAbsolutePath(filePath);
-    if (!fs.existsSync(fullPath)) {
+    const sourceStat = await statPath(fullPath);
+    if (!sourceStat.exists) {
         throw new Error(`Note not found: ${filePath}`);
     }
-    if (fs.statSync(fullPath).isDirectory()) {
+    if (sourceStat.isDir) {
         throw new Error(`Not a note file: ${filePath}`);
     }
-    // Reject non-text files (e.g. .key, .pdf) — only .md and .txt are valid notes
     if (!isValidNoteExtension(path.basename(fullPath))) {
         throw new Error(`Cannot rename: "${path.basename(fullPath)}" is not a note file. Only .md and .txt files are supported.`);
     }
@@ -456,35 +542,45 @@ export function previewRenameLocalNoteFile(filePath, newFilename, keepExtension
     if (path.resolve(nextAbsolutePath) === path.resolve(fullPath)) {
         throw new Error('New filename matches current filename');
     }
-    if (fs.existsSync(nextAbsolutePath)) {
+    if (await pathExists(nextAbsolutePath)) {
         throw new Error(`A note already exists with filename: ${path.relative(getNotePlanPath(), nextAbsolutePath)}`);
     }
+    const fromFilename = path.relative(getNotePlanPath(), fullPath);
+    // Rename stays in the same folder, so checking the source folder
+    // alone covers both. Asserting at preview time also gates dry-run.
+    assertFolderAllowed(fromFilename, 'rename');
     return {
-        fromFilename: path.relative(getNotePlanPath(), fullPath),
+        fromFilename,
         toFilename: path.relative(getNotePlanPath(), nextAbsolutePath),
     };
 }
 /**
  * Rename a local note file inside the same folder
  */
-export function renameLocalNoteFile(filePath, newFilename, keepExtension = true) {
-    const preview = previewRenameLocalNoteFile(filePath, newFilename, keepExtension);
+export async function renameLocalNoteFile(filePath, newFilename, keepExtension = true) {
+    const preview = await previewRenameLocalNoteFile(filePath, newFilename, keepExtension);
     const sourcePath = path.join(getNotePlanPath(), preview.fromFilename);
     const targetPath = path.join(getNotePlanPath(), preview.toFilename);
-    moveFile(sourcePath, targetPath);
+    await moveFile(sourcePath, targetPath);
+    await relocateAttachmentsFolderIfPresent(sourcePath, targetPath);
+    await rewriteAttachmentLinksAfterRename(targetPath, getNoteBaseName(sourcePath), getNoteBaseName(targetPath));
     return preview.toFilename;
 }
 /**
  * Preview creating a local folder under Notes
  */
-export function previewCreateFolder(folderPath) {
+export async function previewCreateFolder(folderPath) {
     const normalized = normalizeLocalFolderPath(folderPath, 'Folder path');
     if (!normalized) {
         throw new Error('Folder path is required');
     }
     const fullPath = path.join(getNotesPath(), normalized);
     ensurePathInsideRoot(fullPath, getNotesPath(), 'Folder path');
-    if (fs.existsSync(fullPath)) {
+    // Block creating a folder inside a denied subtree — that subtree is
+    // off-limits for any new content. `Notes/<normalized>` is the
+    // relative path the access rules match against.
+    assertFolderAllowed(`Notes/${normalized}`, 'create folder at');
+    if (await pathExists(fullPath)) {
         throw new Error(`Folder already exists: ${normalized}`);
     }
     return normalized;
@@ -492,28 +588,31 @@ export function previewCreateFolder(folderPath) {
 /**
  * Create a folder in the Notes directory
  */
-export function createFolder(folderPath) {
-    const normalized = previewCreateFolder(folderPath);
+export async function createFolder(folderPath) {
+    const normalized = await previewCreateFolder(folderPath);
     const fullPath = path.join(getNotesPath(), normalized);
-    if (!fs.existsSync(fullPath)) {
-        fs.mkdirSync(fullPath, { recursive: true });
+    if (!(await pathExists(fullPath))) {
+        await makeDirectory(fullPath);
     }
     return normalized;
 }
 /**
  * Preview deleting a local folder (validates and returns normalized path)
  */
-export function previewDeleteLocalFolder(folderPath) {
+export async function previewDeleteLocalFolder(folderPath) {
     const normalized = normalizeLocalFolderPath(folderPath, 'Source folder');
     if (!normalized) {
         throw new Error('Folder path is required');
     }
     const fullPath = path.join(getNotesPath(), normalized);
     ensurePathInsideRoot(fullPath, getNotesPath(), 'Source folder');
-    if (!fs.existsSync(fullPath)) {
+    // Deleting a denied folder would bypass the rule for everything inside it.
+    assertFolderAllowed(`Notes/${normalized}`, 'delete folder');
+    const stat = await statPath(fullPath);
+    if (!stat.exists) {
         throw new Error(`Folder not found: ${normalized}`);
     }
-    if (!fs.statSync(fullPath).isDirectory()) {
+    if (!stat.isDir) {
         throw new Error(`Not a folder: ${normalized}`);
     }
     const folderName = path.basename(fullPath);
@@ -525,38 +624,38 @@ export function previewDeleteLocalFolder(folderPath) {
 /**
  * Delete a local folder (move to @Trash)
  */
-export function deleteLocalFolder(folderPath) {
-    const normalized = previewDeleteLocalFolder(folderPath);
+export async function deleteLocalFolder(folderPath) {
+    const normalized = await previewDeleteLocalFolder(folderPath);
     const fullPath = path.join(getNotesPath(), normalized);
     const folderName = path.basename(fullPath);
-    // Move to Notes/@Trash (matching NotePlan's own moveToTrash behavior)
     const trashPath = path.join(getNotesPath(), '@Trash');
-    if (!fs.existsSync(trashPath)) {
-        fs.mkdirSync(trashPath, { recursive: true });
+    if (!(await pathExists(trashPath))) {
+        await makeDirectory(trashPath);
     }
     let targetPath = path.join(trashPath, folderName);
     let counter = 1;
-    while (fs.existsSync(targetPath)) {
+    while (await pathExists(targetPath)) {
         targetPath = path.join(trashPath, `${folderName}-${counter}`);
         counter++;
     }
-    moveFile(fullPath, targetPath);
+    await moveFile(fullPath, targetPath);
     return path.relative(getNotePlanPath(), targetPath);
 }
 /**
  * Preview moving a local folder under Notes
  */
-export function previewMoveLocalFolder(sourceFolder, destinationFolder) {
+export async function previewMoveLocalFolder(sourceFolder, destinationFolder) {
     const normalizedSource = normalizeLocalFolderPath(sourceFolder, 'Source folder');
     if (!normalizedSource) {
         throw new Error('Source folder is required');
     }
     const sourcePath = path.join(getNotesPath(), normalizedSource);
     ensurePathInsideRoot(sourcePath, getNotesPath(), 'Source folder');
-    if (!fs.existsSync(sourcePath)) {
+    const sourceStat = await statPath(sourcePath);
+    if (!sourceStat.exists) {
         throw new Error(`Source folder not found: ${normalizedSource}`);
     }
-    if (!fs.statSync(sourcePath).isDirectory()) {
+    if (!sourceStat.isDir) {
         throw new Error(`Source is not a folder: ${normalizedSource}`);
     }
     const normalizedDestination = normalizeLocalFolderPath(destinationFolder, 'Destination folder');
@@ -564,10 +663,11 @@ export function previewMoveLocalFolder(sourceFolder, destinationFolder) {
         ? path.join(getNotesPath(), normalizedDestination)
         : getNotesPath();
     ensurePathInsideRoot(destinationPath, getNotesPath(), 'Destination folder');
-    if (!fs.existsSync(destinationPath)) {
+    const destStat = await statPath(destinationPath);
+    if (!destStat.exists) {
         throw new Error(`Destination folder not found: ${normalizedDestination || 'Notes'}`);
     }
-    if (!fs.statSync(destinationPath).isDirectory()) {
+    if (!destStat.isDir) {
         throw new Error('Destination is not a folder');
     }
     if (path.resolve(destinationPath) === path.resolve(sourcePath) ||
@@ -578,39 +678,47 @@ export function previewMoveLocalFolder(sourceFolder, destinationFolder) {
     if (path.resolve(targetPath) === path.resolve(sourcePath)) {
         throw new Error('Folder is already in the destination');
     }
-    if (fs.existsSync(targetPath)) {
+    if (await pathExists(targetPath)) {
         throw new Error(`A folder already exists at destination: ${path.relative(getNotesPath(), targetPath)}`);
     }
+    const fromFolder = normalizedSource;
+    const toFolder = path.relative(getNotesPath(), targetPath).replace(/\\/g, '/');
+    // Both endpoints must be accessible — moving a denied folder out
+    // would expose its contents, moving any folder INTO a denied subtree
+    // would smuggle content past the rule.
+    assertFolderAllowed(`Notes/${fromFolder}`, 'move folder from');
+    assertFolderAllowed(`Notes/${toFolder}`, 'move folder to');
     return {
-        fromFolder: normalizedSource,
-        toFolder: path.relative(getNotesPath(), targetPath).replace(/\\/g, '/'),
+        fromFolder,
+        toFolder,
         destinationFolder: normalizedDestination || 'Notes',
     };
 }
 /**
  * Move a local folder under Notes
  */
-export function moveLocalFolder(sourceFolder, destinationFolder) {
-    const preview = previewMoveLocalFolder(sourceFolder, destinationFolder);
+export async function moveLocalFolder(sourceFolder, destinationFolder) {
+    const preview = await previewMoveLocalFolder(sourceFolder, destinationFolder);
     const sourcePath = path.join(getNotesPath(), preview.fromFolder);
     const targetPath = path.join(getNotesPath(), preview.toFolder);
-    moveFile(sourcePath, targetPath);
+    await moveFile(sourcePath, targetPath);
     return preview;
 }
 /**
  * Preview renaming a local folder in place
  */
-export function previewRenameLocalFolder(sourceFolder, newName) {
+export async function previewRenameLocalFolder(sourceFolder, newName) {
     const normalizedSource = normalizeLocalFolderPath(sourceFolder, 'Source folder');
     if (!normalizedSource) {
         throw new Error('Source folder is required');
     }
     const sourcePath = path.join(getNotesPath(), normalizedSource);
     ensurePathInsideRoot(sourcePath, getNotesPath(), 'Source folder');
-    if (!fs.existsSync(sourcePath)) {
+    const sourceStat = await statPath(sourcePath);
+    if (!sourceStat.exists) {
         throw new Error(`Source folder not found: ${normalizedSource}`);
     }
-    if (!fs.statSync(sourcePath).isDirectory()) {
+    if (!sourceStat.isDir) {
         throw new Error(`Source is not a folder: ${normalizedSource}`);
     }
     let normalizedInput = newName.trim().replace(/\\/g, '/');
@@ -651,22 +759,26 @@ export function previewRenameLocalFolder(sourceFolder, newName) {
     if (path.resolve(targetPath) === path.resolve(sourcePath)) {
         throw new Error('New folder name matches current name');
     }
-    if (fs.existsSync(targetPath)) {
+    if (await pathExists(targetPath)) {
         throw new Error(`A folder with this name already exists: ${path.relative(getNotesPath(), targetPath)}`);
     }
-    return {
-        fromFolder: normalizedSource,
-        toFolder: path.relative(getNotesPath(), targetPath).replace(/\\/g, '/'),
-    };
+    const fromFolder = normalizedSource;
+    const toFolder = path.relative(getNotesPath(), targetPath).replace(/\\/g, '/');
+    // Renaming the source folder bypasses any deny rule that pinned it;
+    // asserting source covers the case. We also gate destination because
+    // renaming TO a denied name is incoherent.
+    assertFolderAllowed(`Notes/${fromFolder}`, 'rename folder');
+    assertFolderAllowed(`Notes/${toFolder}`, 'rename folder to');
+    return { fromFolder, toFolder };
 }
 /**
  * Rename a local folder in place
  */
-export function renameLocalFolder(sourceFolder, newName) {
-    const preview = previewRenameLocalFolder(sourceFolder, newName);
+export async function renameLocalFolder(sourceFolder, newName) {
+    const preview = await previewRenameLocalFolder(sourceFolder, newName);
     const sourcePath = path.join(getNotesPath(), preview.fromFolder);
     const targetPath = path.join(getNotesPath(), preview.toFolder);
-    moveFile(sourcePath, targetPath);
+    await moveFile(sourcePath, targetPath);
     return preview;
 }
 /**
@@ -682,15 +794,19 @@ function sanitizeFilename(name) {
  * Ensure a calendar note exists, create if not
  * Returns the path to the existing or newly created note
  */
-export function ensureCalendarNote(dateStr) {
+export async function ensureCalendarNote(dateStr) {
     // First try to find an existing note (checks multiple paths/extensions)
-    const existingNote = getCalendarNote(dateStr);
+    const existingNote = await getCalendarNote(dateStr);
     if (existingNote) {
         return existingNote.filename;
     }
     // Create a new one using detected configuration
-    const filePath = buildCalendarNotePath(dateStr);
-    writeNoteFile(filePath, '');
+    const filePath = await buildCalendarNotePathAsync(dateStr);
+    // Otherwise the addToToday / append-to-date flows could materialize a
+    // file inside a denied folder before the asserting writer downstream
+    // gets a chance to reject the write.
+    assertFolderAllowed(filePath, 'create calendar note in');
+    await writeNoteFile(filePath, '');
     return filePath;
 }
 //# sourceMappingURL=file-writer.js.map