@openparachute/vault 0.6.4-rc.9 → 0.6.5-rc.1

package/src/bare-tag-guard-routes.test.ts

@@ -0,0 +1,72 @@
+/**
+ * Canonical-bare-tag guard (vault#XXX) — REST layer. Confirms the PUT
+ * /tags/:name route normalizes the upserted tag NAME (so the partial-merge read
+ * + write land on the bare row) and leaves the rename SOURCE-name lookup literal
+ * (the migration escape hatch — a #-prefixed legacy tag must still be
+ * rename-able away). The query + note-tag write paths normalize in the store and
+ * are covered by core/src/bare-tag-guard.test.ts.
+ */
+
+import { describe, it, expect, beforeEach } from "bun:test";
+import { Database } from "bun:sqlite";
+import { SqliteStore } from "../core/src/store.ts";
+import { initSchema } from "../core/src/schema.ts";
+import { handleTags } from "./routes.ts";
+
+let store: SqliteStore;
+let db: Database;
+
+beforeEach(() => {
+  db = new Database(":memory:");
+  initSchema(db);
+  store = new SqliteStore(db);
+});
+
+function put(name: string, body: unknown): Promise<Response> {
+  const req = new Request(`http://localhost/api/tags/${encodeURIComponent(name)}`, {
+    method: "PUT",
+    body: JSON.stringify(body),
+  });
+  return handleTags(req, store, `/${encodeURIComponent(name)}`);
+}
+
+describe("PUT /tags/:name — bare-tag guard", () => {
+  it("PUT /tags/%23foo with parent_names [#bar] stores the bare row + bare parents", async () => {
+    const res = await put("#foo", { parent_names: ["#bar"], description: "child" });
+    expect(res.status).toBe(200);
+
+    const record = await store.getTagRecord("foo");
+    expect(record).not.toBeNull();
+    expect(record!.parent_names).toEqual(["bar"]);
+    expect(await store.getTagRecord("#foo")).toBeNull();
+  });
+
+  it("a #-decorated PUT preserves the existing bare record's fields (merge correctness)", async () => {
+    await put("thing", { description: "first" });
+    await put("#thing", { parent_names: [] });
+    const record = await store.getTagRecord("thing");
+    expect(record!.description).toBe("first");
+  });
+});
+
+describe("POST /tags/:name/rename — source name stays literal", () => {
+  it("rename #agent/message → agent/message finds the literal #-prefixed row", async () => {
+    db.prepare("INSERT OR IGNORE INTO tags (name) VALUES ('#agent/message')").run();
+    const note = await store.createNote("legacy inbound");
+    db.prepare("INSERT INTO note_tags (note_id, tag_name) VALUES (?, '#agent/message')").run(note.id);
+
+    const sub = "/" + encodeURIComponent("#agent/message") + "/rename";
+    const req = new Request(`http://localhost/api/tags${sub}`, {
+      method: "POST",
+      body: JSON.stringify({ new_name: "agent/message" }),
+    });
+    const res = await handleTags(req, store, sub);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { renamed?: number };
+    expect(body.renamed).toBeGreaterThan(0);
+
+    const tags = await store.listTags();
+    expect(tags.map((t) => t.name)).not.toContain("#agent/message");
+    expect(tags.map((t) => t.name)).toContain("agent/message");
+  });
+});

package/src/cli.ts

@@ -1664,7 +1664,7 @@ function cmdRemove(args: string[]) {
     configDirty = true;
     console.log(
       `  Last vault removed — wrote auto_create: false to ${GLOBAL_CONFIG_PATH} so the` +
-        ` server won't auto-recreate "default" on next boot. Create a vault with:` +
+        ` server won't auto-create a first vault on next boot. Create one with:` +
         ` parachute-vault create <name>`,
     );
   }

package/src/first-boot-create.test.ts

@@ -0,0 +1,155 @@
+/**
+ * Integration tests for the first-boot vault creation gate introduced in
+ * vault#478 Part 2 — server creates a vault ONLY when PARACHUTE_VAULT_NAME
+ * is explicitly set.
+ *
+ * Each test spawns a real server subprocess against a fresh PARACHUTE_HOME
+ * tmpdir (the stop-signal.test.ts pattern) and probes over HTTP so the
+ * actual Bun.serve boot path is exercised, not a mocked code path.
+ *
+ * Port assignments (chosen to avoid collisions with the running daemon on
+ * 1940 and stop-signal.test.ts on 19404):
+ *   19410 — test 1: PARACHUTE_VAULT_NAME unset → zero vaults
+ *   19411 — test 2: PARACHUTE_VAULT_NAME=testvault → vault created
+ *
+ * NOTE: the unit-level assertions for resolveFirstBootVaultName (source:
+ * "default" / "env" / "env-invalid") already live in vault-name.test.ts.
+ * These tests cover the SERVER-LEVEL behaviour — whether a vault is actually
+ * created on disk — so they are intentionally non-duplicative.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, mkdirSync, existsSync } from "fs";
+import { tmpdir } from "os";
+import { join, resolve } from "path";
+import { waitForHealthy } from "./health.ts";
+import { listVaults } from "./config.ts";
+
+const SERVER_PATH = resolve(import.meta.dir, "server.ts");
+
+// ---------------------------------------------------------------------------
+// Test 1 — PARACHUTE_VAULT_NAME unset
+// ---------------------------------------------------------------------------
+
+const PORT_NO_ENV = 19_410;
+let tmpHomeNoEnv: string;
+
+beforeAll(() => {
+  tmpHomeNoEnv = mkdtempSync(join(tmpdir(), "vault-first-boot-no-env-"));
+  mkdirSync(join(tmpHomeNoEnv, "vault"), { recursive: true });
+});
+
+afterAll(() => {
+  rmSync(tmpHomeNoEnv, { recursive: true, force: true });
+});
+
+describe("first-boot: PARACHUTE_VAULT_NAME unset → zero vaults", () => {
+  test("server is healthy AND no vault was auto-created", async () => {
+    const proc = Bun.spawn({
+      cmd: ["bun", SERVER_PATH],
+      env: {
+        ...process.env,
+        PARACHUTE_HOME: tmpHomeNoEnv,
+        PORT: String(PORT_NO_ENV),
+        // Must be unset — do NOT inherit from the test runner's shell.
+        PARACHUTE_VAULT_NAME: undefined as unknown as string,
+        SCRIBE_URL: "",
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+
+    try {
+      const health = await waitForHealthy(PORT_NO_ENV, { totalMs: 15_000 });
+      expect(health.status).toBe("healthy");
+
+      // Verify zero vaults were created inside the tmp home.
+      const originalHome = process.env.PARACHUTE_HOME;
+      try {
+        process.env.PARACHUTE_HOME = tmpHomeNoEnv;
+        const vaults = listVaults();
+        expect(vaults).toHaveLength(0);
+        expect(vaults).not.toContain("default");
+      } finally {
+        if (originalHome === undefined) delete process.env.PARACHUTE_HOME;
+        else process.env.PARACHUTE_HOME = originalHome;
+      }
+
+      // Also assert no vault.yaml was written (belt-and-suspenders).
+      // Path structure: <PARACHUTE_HOME>/vault/data/<name>/vault.yaml
+      const defaultVaultConfig = join(tmpHomeNoEnv, "vault", "data", "default", "vault.yaml");
+      expect(existsSync(defaultVaultConfig)).toBe(false);
+    } finally {
+      if (!proc.killed) proc.kill();
+      await proc.exited;
+    }
+  }, 25_000);
+});
+
+// ---------------------------------------------------------------------------
+// Test 2 — PARACHUTE_VAULT_NAME=testvault → vault created
+// ---------------------------------------------------------------------------
+
+const PORT_WITH_ENV = 19_411;
+let tmpHomeWithEnv: string;
+
+// We need separate beforeAll/afterAll scopes for the two server lifetimes.
+// Bun:test describe blocks share the outer beforeAll/afterAll, so we use
+// module-level variables and a nested describe with its own lifecycle hooks.
+describe("first-boot: PARACHUTE_VAULT_NAME=testvault → vault created", () => {
+  let proc: ReturnType<typeof Bun.spawn>;
+
+  beforeAll(async () => {
+    tmpHomeWithEnv = mkdtempSync(join(tmpdir(), "vault-first-boot-with-env-"));
+    mkdirSync(join(tmpHomeWithEnv, "vault"), { recursive: true });
+
+    proc = Bun.spawn({
+      cmd: ["bun", SERVER_PATH],
+      env: {
+        ...process.env,
+        PARACHUTE_HOME: tmpHomeWithEnv,
+        PORT: String(PORT_WITH_ENV),
+        PARACHUTE_VAULT_NAME: "testvault",
+        SCRIBE_URL: "",
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+
+    const health = await waitForHealthy(PORT_WITH_ENV, { totalMs: 15_000 });
+    if (health.status !== "healthy") {
+      proc.kill();
+      throw new Error(`server failed to become healthy: ${health.status} (${health.error ?? ""})`);
+    }
+  });
+
+  afterAll(async () => {
+    if (proc && !proc.killed) proc.kill();
+    await proc?.exited;
+    rmSync(tmpHomeWithEnv, { recursive: true, force: true });
+  });
+
+  test('vault "testvault" was created (not "default")', () => {
+    const originalHome = process.env.PARACHUTE_HOME;
+    try {
+      process.env.PARACHUTE_HOME = tmpHomeWithEnv;
+      const vaults = listVaults();
+      expect(vaults).toContain("testvault");
+      expect(vaults).not.toContain("default");
+      expect(vaults).toHaveLength(1);
+    } finally {
+      if (originalHome === undefined) delete process.env.PARACHUTE_HOME;
+      else process.env.PARACHUTE_HOME = originalHome;
+    }
+  });
+
+  test("vault config dir exists at the correct path", () => {
+    // Path structure: <PARACHUTE_HOME>/vault/data/<name>/vault.yaml
+    const vaultConfigPath = join(tmpHomeWithEnv, "vault", "data", "testvault", "vault.yaml");
+    expect(existsSync(vaultConfigPath)).toBe(true);
+
+    // "default" must NOT have been created.
+    const defaultConfigPath = join(tmpHomeWithEnv, "vault", "data", "default", "vault.yaml");
+    expect(existsSync(defaultConfigPath)).toBe(false);
+  });
+});

package/src/routes.ts

@@ -12,8 +12,9 @@
  */
 
 import type { Store, Note, QueryOpts } from "../core/src/types.ts";
-import { TAG_EXPAND_MODES, type TagExpandMode } from "../core/src/tag-hierarchy.ts";
+import { TAG_EXPAND_MODES, stripTagHash, type TagExpandMode } from "../core/src/tag-hierarchy.ts";
 import { listUnresolvedWikilinks } from "../core/src/wikilinks.ts";
+import { transactionAsync } from "../core/src/txn.ts";
 import { getNote, getNotes, getNoteTags, toNoteIndex, filterMetadata, mergeMetadata, MAX_BATCH_SIZE, validateExtension, ExtensionValidationError } from "../core/src/notes.ts";
 import {
   parseContentRange,
@@ -27,6 +28,8 @@ import { logStrictBypass } from "./scopes.ts";
 import * as linkOps from "../core/src/links.ts";
 import * as tagSchemaOps from "../core/src/tag-schemas.ts";
 import { IndexedFieldError } from "../core/src/indexed-fields.ts";
+import { buildVaultProjection, resolveTagInheritance } from "../core/src/vault-projection.ts";
+import { loadSchemaConfig } from "../core/src/schema-defaults.ts";
 import {
   buildExpandVisibility,
   filterHydratedLinksByTagScope,
@@ -1141,17 +1144,16 @@ async function handleNotesInner(
       // don't collide with concurrent single-item callers on the shared
       // bun:sqlite connection.
       const batched = items.length > 1;
-      if (batched) db.exec("BEGIN");
-      try {
+      const runBatch = async (): Promise<void> => {
         for (const item of items) {
           // Validate extension before reaching the Store (vault#328).
-          // Thrown inside the BEGIN block — outer catch rolls the batch
-          // back, same shape as the path-conflict path.
+          // Thrown inside the batch transaction — rolls the batch back,
+          // same shape as the path-conflict path.
           const extension = item.extension !== undefined
             ? validateExtension(item.extension)
             : undefined;
           // Strict-schema gate (vault#299) — reject before any write so a
-          // mid-batch violation rolls back via the outer BEGIN/ROLLBACK.
+          // mid-batch violation rolls back the batch transaction.
           gateStrictWrite(store, writeCtx, {
             path: item.path,
             tags: item.tags,
@@ -1179,9 +1181,10 @@ async function handleNotesInner(
 
           created.push((await store.getNote(note.id)) ?? note);
         }
-        if (batched) db.exec("COMMIT");
+      };
+      try {
+        await (batched ? transactionAsync(db, runBatch) : runBatch());
       } catch (e: any) {
-        if (batched) db.exec("ROLLBACK");
         // Duck-type for module-boundary robustness (matches the PATCH branch).
         if (e && e.code === "PATH_CONFLICT") {
           return json(
@@ -1997,6 +2000,64 @@ export async function handleTags(
     return json(result);
   }
 
+  // POST /tags/:name/conformance — count existing notes that would VIOLATE a
+  // proposed field spec for the tag (vault#283 tightening warning). Read-only
+  // (POST because it carries a proposed `fields` body). Must precede the
+  // /:name matcher so "conformance" isn't read as a tag name.
+  const conformanceMatch = subpath.match(/^\/([^/]+)\/conformance$/);
+  if (conformanceMatch) {
+    if (req.method !== "POST") return json({ error: "Method not allowed" }, 405);
+    const cTag = decodeURIComponent(conformanceMatch[1]!);
+    if (tagScope.allowed && !tagScope.allowed.has(cTag)) {
+      return json({ error: "Tag not found", tag: cTag }, 404);
+    }
+    const body = (await req.json().catch(() => null)) as
+      | { fields?: Record<string, unknown> | null }
+      | null;
+    if (!body) return json({ error: "Invalid JSON body" }, 400);
+    // The proposed fields the operator intends to save. Sanitized through the
+    // same parse the resolver uses (drop non-object specs). Empty/absent →
+    // nothing to enforce → zero violations.
+    const proposed: Record<string, tagSchemaOps.TagFieldSchema> = {};
+    if (body.fields && typeof body.fields === "object" && !Array.isArray(body.fields)) {
+      for (const [k, v] of Object.entries(body.fields)) {
+        if (v && typeof v === "object" && !Array.isArray(v)) {
+          proposed[k] = v as tagSchemaOps.TagFieldSchema;
+        }
+      }
+    }
+    const report = await store.countTagConformance(cTag, proposed);
+    return json(report);
+  }
+
+  // GET /tags/:name/effective — the tag's effective (own ∪ inherited) fields +
+  // direct/effective parents + schema-conflict info, drawn from the same
+  // projection vault-info exposes. Read-only inheritance preview for the
+  // Schema editor (vault#283). Must precede the /:name matcher.
+  const effectiveMatch = subpath.match(/^\/([^/]+)\/effective$/);
+  if (effectiveMatch) {
+    if (req.method !== "GET") return json({ error: "Method not allowed" }, 405);
+    const eTag = decodeURIComponent(effectiveMatch[1]!);
+    if (tagScope.allowed && !tagScope.allowed.has(eTag)) {
+      return json({ error: "Tag not found", tag: eTag }, 404);
+    }
+    const projection = buildVaultProjection(store.db);
+    const record = await store.getTagRecord(eTag);
+    // Resolve inheritance directly (not via projection.tags, which omits
+    // hierarchy-only tags carrying no own schema) so the editor's preview
+    // works even for a tag the operator is just starting to give fields.
+    const resolved = loadSchemaConfig(store.db);
+    const { effective_parents, effective_fields } = resolveTagInheritance(resolved, eTag);
+    return json({
+      name: eTag,
+      parents: record?.parent_names ?? [],
+      effective_parents,
+      fields: record?.fields ?? null,
+      effective_fields,
+      indexed_fields: projection.indexed_fields,
+    });
+  }
+
   // Routes with tag name
   const nameMatch = subpath.match(/^\/([^/]+)$/);
   if (!nameMatch) return json({ error: "Not found" }, 404);
@@ -2026,7 +2087,15 @@ export async function handleTags(
   // of { description, fields, relationships, parent_names }; omitted keys
   // are preserved, explicit null clears. See patterns/tag-data-model.md.
   if (req.method === "PUT") {
-    if (tagScope.allowed && !tagScope.allowed.has(tagName)) {
+    // Canonical-bare-tag guard (vault#XXX): normalize the upserted tag NAME so
+    // the existing-field merge read (store.getTagSchema below) and the upsert
+    // both target the bare row. store.upsertTagRecord re-normalizes (idempotent)
+    // for the write; this keeps the partial-merge read correct for a
+    // `#`-decorated PUT path. (GET/DELETE/rename keep their literal lookups —
+    // rename's source-name must still match a `#`-prefixed legacy row so the
+    // data migration can rename it away.)
+    const putTagName = stripTagHash(tagName);
+    if (tagScope.allowed && !tagScope.allowed.has(putTagName)) {
       return tagScopeForbidden(tagScope.raw ?? []);
     }
     const body = (await req.json()) as {
@@ -2034,7 +2103,18 @@ export async function handleTags(
       fields?: Record<string, unknown> | null;
       relationships?: Record<string, unknown> | null;
       parent_names?: unknown;
+      /**
+       * When true, `fields` is treated as the FULL intended field map for the
+       * tag — fields absent from the payload are DROPPED (a replace, not a
+       * merge). Default false preserves the historical partial-update merge
+       * the MCP `update-tag` tool relies on (omitted keys preserved). The
+       * Schema editor (vault#283) sends the full map + `replace_fields: true`
+       * so removing a field row actually deletes the field. See
+       * patterns/tag-data-model.md.
+       */
+      replace_fields?: unknown;
     };
+    const replaceFields = body.replace_fields === true;
 
     // Validate the relationships payload up front so a bad payload returns
     // 400, not a thrown 500. `relationships` is an opaque vocabulary map
@@ -2071,7 +2151,10 @@ export async function handleTags(
     }
 
     // Field merge mirrors MCP update-tag — preserves prior keys when the
-    // payload only declares new ones.
+    // payload only declares new ones. UNLESS `replace_fields: true`, in which
+    // case `fields` is the full intended map and absent keys are dropped (the
+    // Schema editor's full-replacement save — vault#283; without this a
+    // removed field row is silently resurrected by the merge).
     let fieldsPatch:
       | Record<string, tagSchemaOps.TagFieldSchema>
       | null
@@ -2079,12 +2162,17 @@ export async function handleTags(
     if (body.fields === null) {
       fieldsPatch = null;
     } else if (body.fields !== undefined) {
-      const existing = await store.getTagSchema(tagName);
-      const merged: Record<string, tagSchemaOps.TagFieldSchema> = {
-        ...(existing?.fields ?? {}),
-        ...(body.fields as Record<string, tagSchemaOps.TagFieldSchema>),
-      };
-      fieldsPatch = Object.keys(merged).length > 0 ? merged : null;
+      if (replaceFields) {
+        const full = body.fields as Record<string, tagSchemaOps.TagFieldSchema>;
+        fieldsPatch = Object.keys(full).length > 0 ? full : null;
+      } else {
+        const existing = await store.getTagSchema(putTagName);
+        const merged: Record<string, tagSchemaOps.TagFieldSchema> = {
+          ...(existing?.fields ?? {}),
+          ...(body.fields as Record<string, tagSchemaOps.TagFieldSchema>),
+        };
+        fieldsPatch = Object.keys(merged).length > 0 ? merged : null;
+      }
     }
 
     // A bad indexed-field name (or an unindexable type, or a cross-tag type
@@ -2093,7 +2181,7 @@ export async function handleTags(
     // unchanged on failure (no orphan/lying index). vault#478.
     let result;
     try {
-      result = await store.upsertTagRecord(tagName, {
+      result = await store.upsertTagRecord(putTagName, {
         ...(body.description !== undefined ? { description: body.description } : {}),
         ...(fieldsPatch !== undefined ? { fields: fieldsPatch } : {}),
         ...(relationshipsPatch !== undefined ? { relationships: relationshipsPatch } : {}),
@@ -2821,32 +2909,96 @@ async function handleRetryLegacyInBody(
 
 const MAX_UPLOAD_BYTES = 100 * 1024 * 1024; // 100MB
 
-// Storage allowlist policy:
-//   - audio + image + .pdf (knowledge-vault content: papers, scans, receipts)
-//     + .mp4 (mobile capture default; iOS records mp4, not webm).
-//   - .svg and .html are deliberately excluded — both can embed `<script>`
-//     tags, which would turn an upload into a same-origin XSS vector when
-//     the asset is served back from /storage/. If a future use case needs
-//     SVG, sanitize on read (strip <script>/<foreignObject>) and revisit.
-const ALLOWED_EXTENSIONS = new Set([
-  ".wav", ".mp3", ".m4a", ".ogg", ".webm",
-  ".png", ".jpg", ".jpeg", ".gif", ".webp",
-  ".pdf", ".mp4",
+// Storage upload policy: DENY-LIST (vault#517). A knowledge vault stores
+// arbitrary files — ebooks, office docs, datasets, archives, binaries — so we
+// accept ANY upload EXCEPT the handful of types a browser can execute as
+// active content in our origin when served back from /storage/. (The prior
+// allowlist rejected the long tail: .epub/.csv/.zip/… all came back "File type
+// not allowed".)
+//
+// BLOCKED — same-origin-XSS / active-content set:
+//   .html/.htm/.xhtml/.shtml/.xht  HTML — embeds <script>
+//   .svg                           XML image — embeds <script>
+//   .xml                           can carry XSLT / be parsed as XHTML
+//   .js/.mjs/.cjs                  JavaScript
+//   .css                           style-injection / UI-redress vector
+//
+// Two independent guards keep every STORED file inert when served:
+//   1. Only the curated MIME_TYPES below map to a real (always passive) type;
+//      every other extension serves as application/octet-stream — a download,
+//      never rendered.
+//   2. The GET byte-serve response pins `X-Content-Type-Options: nosniff`, so
+//      a browser can't sniff an octet-stream body into an executable type.
+// The blocklist is belt-and-suspenders on top of those: even if a future MIME
+// entry or an upstream proxy weakened (1) or (2), these extensions still never
+// land on disk. If a future use case needs SVG, sanitize on read (strip
+// <script>/<foreignObject>) and revisit.
+const BLOCKED_EXTENSIONS = new Set([
+  ".html", ".htm", ".xhtml", ".shtml", ".xht",
+  ".svg",
+  ".xml",
+  ".js", ".mjs", ".cjs",
+  ".css",
 ]);
 
+// Explicit MIME types for the commonly-previewed formats. Anything accepted
+// but absent here serves as application/octet-stream — a download, never
+// rendered (e.g. .pages/.key/.numbers/.azw3/.exe/arbitrary binaries). None of
+// these map to an active type (text/html, image/svg+xml), so a served asset
+// can't execute script; `nosniff` on the GET response makes that ironclad.
+//
+// INVARIANT: never add an entry that maps to a browser-active type —
+// text/html, image/svg+xml, application/xhtml+xml, text/javascript,
+// application/wasm, text/css. Doing so re-enables same-origin execution for
+// that extension (and would mean it must also join BLOCKED_EXTENSIONS).
 const MIME_TYPES: Record<string, string> = {
+  // Audio
   ".wav": "audio/wav",
   ".mp3": "audio/mpeg",
   ".m4a": "audio/mp4",
   ".ogg": "audio/ogg",
+  ".oga": "audio/ogg",
+  ".opus": "audio/opus",
+  ".aac": "audio/aac",
+  ".flac": "audio/flac",
   ".webm": "audio/webm",
+  // Image
   ".png": "image/png",
   ".jpg": "image/jpeg",
   ".jpeg": "image/jpeg",
   ".gif": "image/gif",
   ".webp": "image/webp",
-  ".pdf": "application/pdf",
+  ".bmp": "image/bmp",
+  ".tiff": "image/tiff",
+  ".tif": "image/tiff",
+  ".heic": "image/heic",
+  ".heif": "image/heif",
+  ".avif": "image/avif",
+  // Video
   ".mp4": "video/mp4",
+  ".m4v": "video/x-m4v",
+  ".mov": "video/quicktime",
+  // Documents / ebooks / data
+  ".pdf": "application/pdf",
+  ".epub": "application/epub+zip",
+  ".mobi": "application/x-mobipocket-ebook",
+  ".txt": "text/plain; charset=utf-8",
+  ".md": "text/markdown; charset=utf-8",
+  ".markdown": "text/markdown; charset=utf-8",
+  ".rtf": "application/rtf",
+  ".csv": "text/csv; charset=utf-8",
+  ".tsv": "text/tab-separated-values; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".xls": "application/vnd.ms-excel",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".odt": "application/vnd.oasis.opendocument.text",
+  ".ods": "application/vnd.oasis.opendocument.spreadsheet",
+  ".odp": "application/vnd.oasis.opendocument.presentation",
+  ".zip": "application/zip",
 };
 
 export async function handleStorage(
@@ -2867,9 +3019,17 @@ export async function handleStorage(
     if (file.size > MAX_UPLOAD_BYTES) {
       return json({ error: `File too large (${Math.round(file.size / 1024 / 1024)}MB). Max: 100MB` }, 413);
     }
-    const ext = extname(file.name).toLowerCase();
-    if (!ALLOWED_EXTENSIONS.has(ext)) {
-      return json({ error: `File type ${ext} not allowed` }, 400);
+    // Strip trailing dots/whitespace before extracting the extension so a
+    // `evil.html.` / `evil.svg ` can't slip past the blocklist
+    // (extname("evil.html.") === "."). The blocklist is belt-and-suspenders;
+    // anything that still gets through serves as octet-stream + nosniff anyway.
+    const ext = extname(file.name.replace(/[.\s]+$/, "")).toLowerCase();
+    if (BLOCKED_EXTENSIONS.has(ext)) {
+      // Active-content types only — blocked because they execute as script when
+      // served same-origin from /storage/ (see BLOCKED_EXTENSIONS). Everything
+      // else (incl. unknown/arbitrary files) is accepted and served as a
+      // download (octet-stream + nosniff).
+      return json({ error: `File type ${ext} not allowed (active/executable content)` }, 400);
     }
 
     const date = new Date().toISOString().split("T")[0]!;
@@ -2970,6 +3130,12 @@ export async function handleStorage(
       headers: {
         "Content-Type": contentType,
         "Content-Length": String(stat.size),
+        // Defense-in-depth: never let a browser MIME-sniff a stored asset into
+        // an active type (e.g. an octet-stream body sniffed as text/html).
+        // Combined with the upload blocklist (no .svg/.html) this closes the
+        // same-origin XSS surface for served attachments. Mirrors routing.ts's
+        // SPA-asset stance.
+        "X-Content-Type-Options": "nosniff",
       },
     });
   }