@openparachute/vault 0.7.1 → 0.7.2-rc.3

package/core/src/store.ts

@@ -17,6 +17,7 @@ import {
   clearQueuedLink,
 } from "./wikilinks.js";
 import { pathTitle } from "./paths.js";
+import { timestampToMs } from "./cursor.js";
 import { transaction } from "./txn.js";
 import { HookRegistry } from "./hooks.js";
 import {
@@ -360,9 +361,18 @@ export class BunSqliteStore implements Store {
     // the importer write a specific historical timestamp. Skips hooks
     // by design: this isn't a user-edit, it's a state restoration.
     // See vault#308 PR 2.
+    //
+    // This is THE path by which non-canonical timestamps (space-form,
+    // `+02:00` offset, no-`Z`) land in a vault — frontmatter is preserved
+    // VERBATIM (byte-identical re-export round-trip), so `updated_at` is NOT
+    // canonicalized here. The keyset ordering key `updated_at_ms` (vault#586)
+    // is derived UTC-correctly from that verbatim value: `timestampToMs` does
+    // NOT read space-form as local time. A genuinely unparseable `updated_at`
+    // falls back to `created_at`'s ms, then to 0 — never NULL, never a throw.
+    const updatedAtMs = timestampToMs(updatedAt) ?? timestampToMs(createdAt) ?? 0;
     this.db
-      .prepare("UPDATE notes SET created_at = ?, updated_at = ? WHERE id = ?")
-      .run(createdAt, updatedAt, id);
+      .prepare("UPDATE notes SET created_at = ?, updated_at = ?, updated_at_ms = ? WHERE id = ?")
+      .run(createdAt, updatedAt, updatedAtMs, id);
   }
 
   async deleteNote(id: string): Promise<void> {

package/core/src/txn.test.ts

@@ -89,9 +89,12 @@ describe("transaction (sync)", () => {
     expect(calls).toEqual(["BEGIN IMMEDIATE", "COMMIT", "ROLLBACK"]);
   });
 
-  it("preserves the callback error even when ROLLBACK also fails", () => {
+  it("preserves the callback error when ROLLBACK fails for the expected 'already-resolved' reason", () => {
     const callbackErr = new Error("callback boom");
-    const rollbackErr = new Error("rollback boom");
+    // The one swallowed case: the txn was already resolved, so ROLLBACK is a
+    // no-op that reports "no transaction is active". The ORIGINAL callback
+    // error is the root cause and must still propagate.
+    const rollbackErr = new Error("cannot rollback - no transaction is active");
     const { db } = fakeDb({ rollbackThrows: rollbackErr });
     let thrown: unknown;
     try {
@@ -101,6 +104,22 @@ describe("transaction (sync)", () => {
     }
     expect(thrown).toBe(callbackErr);
   });
+
+  it("re-throws an UNEXPECTED ROLLBACK failure instead of silently masking it (vault#589 NIT 2)", () => {
+    const callbackErr = new Error("callback boom");
+    // A rollback failure that is NOT the benign "already-resolved" case (a
+    // corrupt connection / lost write lock) means the transaction may NOT have
+    // rolled back — surfacing it beats a false "clean rollback".
+    const rollbackErr = new Error("database disk image is malformed");
+    const { db } = fakeDb({ rollbackThrows: rollbackErr });
+    let thrown: unknown;
+    try {
+      transaction(db, () => { throw callbackErr; });
+    } catch (e) {
+      thrown = e;
+    }
+    expect(thrown).toBe(rollbackErr);
+  });
 });
 
 describe("transaction — native transactionSync preference (DO backend)", () => {
@@ -214,9 +233,9 @@ describe("transactionAsync", () => {
     expect(calls).toEqual(["BEGIN IMMEDIATE", "COMMIT", "ROLLBACK"]);
   });
 
-  it("preserves the callback error even when ROLLBACK also fails", async () => {
+  it("preserves the callback error when ROLLBACK fails for the expected 'already-resolved' reason", async () => {
     const callbackErr = new Error("callback boom");
-    const rollbackErr = new Error("rollback boom");
+    const rollbackErr = new Error("cannot rollback - no transaction is active");
     const { db } = fakeDb({ rollbackThrows: rollbackErr });
     let thrown: unknown;
     try {
@@ -226,4 +245,81 @@ describe("transactionAsync", () => {
     }
     expect(thrown).toBe(callbackErr);
   });
+
+  it("re-throws an UNEXPECTED ROLLBACK failure instead of silently masking it (vault#589 NIT 2)", async () => {
+    const callbackErr = new Error("callback boom");
+    const rollbackErr = new Error("database disk image is malformed");
+    const { db } = fakeDb({ rollbackThrows: rollbackErr });
+    let thrown: unknown;
+    try {
+      await transactionAsync(db, async () => { throw callbackErr; });
+    } catch (e) {
+      thrown = e;
+    }
+    expect(thrown).toBe(rollbackErr);
+  });
+});
+
+describe("transaction — re-entrancy via SAVEPOINTs (vault#589)", () => {
+  it("a nested sync transaction uses SAVEPOINT/RELEASE, not a second BEGIN", () => {
+    const { db, calls } = fakeDb();
+    const out = transaction(db, () => {
+      const inner = transaction(db, () => "inner");
+      expect(inner).toBe("inner");
+      return "outer";
+    });
+    expect(out).toBe("outer");
+    expect(calls).toEqual([
+      "BEGIN IMMEDIATE",
+      "SAVEPOINT parachute_sp_1",
+      "RELEASE parachute_sp_1",
+      "COMMIT",
+    ]);
+  });
+
+  it("an inner throw rolls back to the savepoint; the outer can still commit", () => {
+    const db = freshDb();
+    transaction(db, () => {
+      db.exec("INSERT INTO t (id, v) VALUES (1, 'keep')");
+      try {
+        transaction(db, () => {
+          db.exec("INSERT INTO t (id, v) VALUES (2, 'drop')");
+          throw new Error("inner boom");
+        });
+      } catch {
+        // Outer decides to continue past the failed nested block.
+      }
+      db.exec("INSERT INTO t (id, v) VALUES (3, 'keep2')");
+    });
+    // Only the savepoint'd insert (2) was undone; 1 and 3 committed.
+    const ids = (db.prepare("SELECT id FROM t ORDER BY id").all() as { id: number }[]).map((r) => r.id);
+    expect(ids).toEqual([1, 3]);
+  });
+
+  it("an UNCAUGHT inner throw rolls back the WHOLE outer transaction", () => {
+    const db = freshDb();
+    expect(() =>
+      transaction(db, () => {
+        db.exec("INSERT INTO t (id, v) VALUES (1, 'a')");
+        transaction(db, () => {
+          db.exec("INSERT INTO t (id, v) VALUES (2, 'b')");
+          throw new Error("boom");
+        });
+      }),
+    ).toThrow("boom");
+    expect((db.prepare("SELECT COUNT(*) AS c FROM t").get() as { c: number }).c).toBe(0);
+  });
+
+  it("transactionAsync composes a nested sync transaction via SAVEPOINT (the atomic blow-away shape)", async () => {
+    const { db, calls } = fakeDb();
+    await transactionAsync(db, async () => {
+      transaction(db, () => "nested-sync-write");
+    });
+    expect(calls).toEqual([
+      "BEGIN IMMEDIATE",
+      "SAVEPOINT parachute_sp_1",
+      "RELEASE parachute_sp_1",
+      "COMMIT",
+    ]);
+  });
 });

package/core/src/txn.ts

@@ -14,12 +14,40 @@
  * one of them only ever wrote, so acquiring the write lock eagerly is a
  * strict improvement (no lazy busy-upgrade) and never a semantic change.
  *
- * **Nesting is unsupported**, matching the pre-seam code exactly: SQLite
- * throws "cannot start a transaction within a transaction" on a nested
- * `BEGIN`, and none of the migrated call sites nest (a batch wraps individual
- * `createNote`s, none of which open their own transaction). If a nested
- * caller ever appears, the fix is SAVEPOINT-based re-entrancy *in the bun
- * implementation here* — the call sites stay untouched.
+ * **Nesting via SAVEPOINTs** (vault#589): the outermost `transaction` /
+ * `transactionAsync` on a connection opens a real `BEGIN IMMEDIATE`; a nested
+ * call (one whose connection is already inside a transaction) opens a
+ * `SAVEPOINT` instead, so composing an atomic block out of primitives that
+ * each open their own transaction never hits SQLite's "cannot start a
+ * transaction within a transaction". This is the re-entrancy the original
+ * seam anticipated ("the fix is SAVEPOINT-based re-entrancy in the bun
+ * implementation here — the call sites stay untouched"). The nesting depth is
+ * tracked per connection in {@link txnDepth}; a non-nested caller (depth 0 →
+ * 1) is byte-for-byte the old `BEGIN … COMMIT` / `ROLLBACK` path, so existing
+ * single-level callers are unaffected. The motivating nested caller is the
+ * atomic blow-away import (`importVault` wrapping schema/note/link writes,
+ * several of which open their own `transaction`).
+ *
+ * The `transactionSync` (Durable-Object) delegate path is unchanged — a DO
+ * backend supplies its own natively re-entrant primitive, so the SAVEPOINT
+ * bookkeeping here only governs the bun `BEGIN` path.
+ *
+ * **Shared-connection invariant (load-bearing for {@link transactionAsync}).**
+ * The bun backend is a single synchronous connection. A `transactionAsync`
+ * body — AND anything it calls — must not `await` genuine, slow I/O while the
+ * transaction is open: every `await` yields the event loop, and any work that
+ * runs during that yield and touches the store (a concurrent request, a
+ * mutation hook that writes before its first real await) will `SAVEPOINT`-JOIN
+ * this open transaction on the shared connection — committing/rolling back
+ * with it, its writes cross-wiped by a `ROLLBACK TO`. The blow-away import
+ * (the sole `transactionAsync` wrapping non-batch work) is safe by
+ * construction: its replay awaits only already-resolved promises over the
+ * synchronous bun store, so it never actually yields to unrelated work
+ * mid-transaction, and the mutation hooks it fires do no synchronous store
+ * writes (they defer via `queueMicrotask` and arm debounces / kick idempotent
+ * workers — see hooks.ts). Any NEW `transactionAsync` caller must preserve
+ * this: keep the body's awaits confined to the same synchronous connection,
+ * never awaiting network/disk/subprocess I/O with the transaction open.
  */
 
 /** The minimal DB surface the transaction seam needs — kept structural (no
@@ -38,6 +66,79 @@ export interface TxnCapableDb {
   transactionSync?<T>(fn: () => T): T;
 }
 
+/**
+ * Per-connection nesting depth for the bun `BEGIN` path. Keyed on the db
+ * handle so two connections track independently; a `WeakMap` so a dropped
+ * connection's entry is collected. Depth 0 = no open transaction; the first
+ * `transaction`/`transactionAsync` opens `BEGIN IMMEDIATE` and sets depth 1;
+ * each further nested call opens a `SAVEPOINT` and bumps the depth. See the
+ * file header (vault#589).
+ */
+const txnDepth = new WeakMap<TxnCapableDb, number>();
+
+/** One entry on the nesting stack: whether this frame owns the outer
+ *  `BEGIN … COMMIT`/`ROLLBACK` (outermost) or a `SAVEPOINT` (nested), plus the
+ *  depth to restore on exit. */
+interface TxnFrame {
+  outermost: boolean;
+  savepoint: string | null;
+  priorDepth: number;
+}
+
+/** Open a transaction frame: `BEGIN IMMEDIATE` at depth 0, else a uniquely
+ *  named `SAVEPOINT`. Bumps {@link txnDepth} only after the SQL succeeds. */
+function enterTxn(db: TxnCapableDb): TxnFrame {
+  const priorDepth = txnDepth.get(db) ?? 0;
+  if (priorDepth === 0) {
+    db.exec("BEGIN IMMEDIATE");
+    txnDepth.set(db, 1);
+    return { outermost: true, savepoint: null, priorDepth };
+  }
+  const savepoint = `parachute_sp_${priorDepth}`;
+  db.exec(`SAVEPOINT ${savepoint}`);
+  txnDepth.set(db, priorDepth + 1);
+  return { outermost: false, savepoint, priorDepth };
+}
+
+/** Commit a frame: `COMMIT` for the outermost, `RELEASE` for a savepoint
+ *  (which merges its writes into the enclosing transaction). */
+function commitTxn(db: TxnCapableDb, frame: TxnFrame): void {
+  if (frame.outermost) db.exec("COMMIT");
+  else db.exec(`RELEASE ${frame.savepoint}`);
+  txnDepth.set(db, frame.priorDepth);
+}
+
+/** Roll a frame back: `ROLLBACK` for the outermost (whole transaction),
+ *  `ROLLBACK TO` + `RELEASE` for a savepoint (unwind just this frame; the
+ *  error still propagates so an enclosing frame decides its own fate).
+ *  Best-effort — if the COMMIT itself threw, the transaction is already
+ *  resolved and these throw "no transaction"/"no such savepoint"; swallow so
+ *  the original error propagates. */
+function rollbackTxn(db: TxnCapableDb, frame: TxnFrame): void {
+  try {
+    if (frame.outermost) {
+      db.exec("ROLLBACK");
+    } else {
+      db.exec(`ROLLBACK TO ${frame.savepoint}`);
+      db.exec(`RELEASE ${frame.savepoint}`);
+    }
+  } catch (rollbackErr) {
+    // Only swallow the ONE expected case: the COMMIT/RELEASE itself already
+    // resolved the transaction, so there's nothing left to unwind — SQLite
+    // reports "cannot rollback - no transaction is active" / "no such
+    // savepoint". Any OTHER rollback failure is a real problem (a corrupt
+    // connection, a lost write lock) and must not be masked — re-throw it so
+    // the caller sees a failed rollback rather than a false success. Depth is
+    // restored first so the connection's bookkeeping stays consistent even on
+    // the re-throw path.
+    txnDepth.set(db, frame.priorDepth);
+    const msg = String((rollbackErr as Error)?.message ?? rollbackErr);
+    if (/no transaction is active|no such savepoint/i.test(msg)) return;
+    throw rollbackErr;
+  }
+  txnDepth.set(db, frame.priorDepth);
+}
+
 /**
  * Run `fn` inside a single write transaction, committing its result or
  * rolling back on throw. Synchronous — the callback must not await (see
@@ -55,20 +156,13 @@ export function transaction<T>(db: TxnCapableDb, fn: () => T): T {
   if (typeof db.transactionSync === "function") {
     return db.transactionSync(fn);
   }
-  db.exec("BEGIN IMMEDIATE");
+  const frame = enterTxn(db);
   try {
     const result = fn();
-    db.exec("COMMIT");
+    commitTxn(db, frame);
     return result;
   } catch (err) {
-    // Best-effort rollback — if the COMMIT itself threw the transaction is
-    // already resolved and ROLLBACK would throw "no transaction is active";
-    // swallow that so the original error is the one that propagates.
-    try {
-      db.exec("ROLLBACK");
-    } catch {
-      // no active transaction to roll back
-    }
+    rollbackTxn(db, frame);
     throw err;
   }
 }
@@ -86,20 +180,21 @@ export function transaction<T>(db: TxnCapableDb, fn: () => T): T {
  * so it cannot wrap an `async` body that awaits the Store facade between writes.
  * A DO backend that needs an atomic async batch has to reshape the batch as a
  * synchronous unit (or use an async DO transaction primitive) — out of scope
- * for this seam; the raw `BEGIN IMMEDIATE` path stays the single implementation.
+ * for this seam; the bun `BEGIN IMMEDIATE` path stays the single implementation.
+ *
+ * Re-entrant (vault#589): if the connection is already inside a transaction —
+ * e.g. the atomic blow-away import wraps this around store writes that
+ * themselves call {@link transaction} — a nested call opens a SAVEPOINT rather
+ * than a second `BEGIN`. See the file header.
  */
 export async function transactionAsync<T>(db: TxnCapableDb, fn: () => Promise<T>): Promise<T> {
-  db.exec("BEGIN IMMEDIATE");
+  const frame = enterTxn(db);
   try {
     const result = await fn();
-    db.exec("COMMIT");
+    commitTxn(db, frame);
     return result;
   } catch (err) {
-    try {
-      db.exec("ROLLBACK");
-    } catch {
-      // no active transaction to roll back
-    }
+    rollbackTxn(db, frame);
     throw err;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.7.1",
+  "version": "0.7.2-rc.3",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/cli.ts

@@ -2983,6 +2983,12 @@ async function cmdImport(args: string[]) {
     if (stats.skipped_attachments.length > 0) {
       console.log(`Skipped ${stats.skipped_attachments.length} attachment(s) — see warnings above.`);
     }
+    if (stats.skipped_duplicate_ids.length > 0) {
+      console.log(
+        `Skipped ${stats.skipped_duplicate_ids.length} file(s) with duplicate/blank note id(s) — ` +
+        `kept the first of each collision; see warnings above.`,
+      );
+    }
     return;
   }
 

package/src/mirror-import.ts

@@ -523,6 +523,11 @@ function importResultFromStats(
       `Dropped parent_names on tag "${sp.tag}": ${sp.reason}`,
     );
   }
+  for (const sd of stats.skipped_duplicate_ids) {
+    warnings.push(
+      `Skipped file (id "${sd.id}", path=${sd.path ?? "—"}): ${sd.reason}`,
+    );
+  }
   const result: ImportResult = {
     notes_imported: stats.notes_created + stats.notes_updated,
     tags_imported: stats.schemas_restored,

package/src/routes.ts

@@ -31,7 +31,7 @@ import {
   getContentWikilinkWarnings,
 } from "../core/src/wikilinks.ts";
 import { transactionAsync } from "../core/src/txn.ts";
-import { getNote, getNotes, getNoteTags, getNoteByTitle, toNoteIndex, filterMetadata, mergeMetadata, MAX_BATCH_SIZE, validateExtension, ExtensionValidationError, PathConflictError, getVaultMap } from "../core/src/notes.ts";
+import { getNote, getNotes, getNoteTags, getNoteByTitle, toNoteIndex, filterMetadata, mergeMetadata, MAX_BATCH_SIZE, validateExtension, ExtensionValidationError, PathConflictError, validatePath, PathValidationError, getVaultMap } from "../core/src/notes.ts";
 import { normalizePath } from "../core/src/paths.ts";
 import {
   parseContentRange,
@@ -1811,6 +1811,9 @@ async function handleNotesInner(
           const extension = item.extension !== undefined
             ? validateExtension(item.extension)
             : undefined;
+          // Reject NUL / `..` paths at the write surface (vault#589 / FIX 2).
+          // Same batch-transaction throw semantics as extension validation.
+          validatePath(item.path);
           const effectiveExtension = extension ?? "md";
           const ifExists: string = item.if_exists ?? "error";
           const upsertMode = ifExists === "ignore" || ifExists === "update" || ifExists === "replace";
@@ -1958,6 +1961,13 @@ async function handleNotesInner(
             400,
           );
         }
+        // Bad `path` value (vault#589 / FIX 2) — NUL byte or `..` segment.
+        if (e && e.code === "INVALID_PATH") {
+          return json(
+            { error_type: "invalid_path", error: "invalid_path", path: e.path, reason: e.reason, message: e.message },
+            400,
+          );
+        }
         throw e;
       }
 
@@ -2253,6 +2263,9 @@ async function handleNotesInner(
           const createExt = body.extension !== undefined
             ? validateExtension(body.extension)
             : undefined;
+          // Reject NUL / `..` paths at the write surface (vault#589 / FIX 2).
+          // Covers both the explicit `path` and the idOrPath-as-path shape.
+          validatePath(explicitPath ?? (idLooksLikePath ? idOrPathStr : undefined));
           const createOpts: Parameters<Store["createNote"]>[1] = {
             ...(idLooksLikePath ? { path: explicitPath ?? idOrPathStr } : { id: idOrPathStr, ...(explicitPath !== undefined ? { path: explicitPath } : {}) }),
             ...(tagsArr.length > 0 ? { tags: tagsArr } : {}),
@@ -2499,7 +2512,12 @@ async function handleNotesInner(
         if (body.append !== undefined) updates.append = body.append;
         if (body.prepend !== undefined) updates.prepend = body.prepend;
       }
-      if (body.path !== undefined) updates.path = body.path;
+      if (body.path !== undefined) {
+        // Reject NUL / `..` paths at the write surface (vault#589 / FIX 2).
+        // Throws PathValidationError → 400 in the outer catch.
+        validatePath(body.path);
+        updates.path = body.path;
+      }
       if (body.extension !== undefined) {
         // Validate up front (vault#328). Throws ExtensionValidationError
         // which the outer catch converts to a 400.
@@ -2756,6 +2774,13 @@ async function handleNotesInner(
           400,
         );
       }
+      // Bad `path` value (vault#589 / FIX 2) — NUL byte or `..` segment.
+      if (e && e.code === "INVALID_PATH") {
+        return json(
+          { error_type: "invalid_path", error: "invalid_path", path: e.path, reason: e.reason, message: e.message },
+          400,
+        );
+      }
       throw e;
     }
   }

package/src/vault.test.ts

@@ -539,6 +539,37 @@ describe("MCP tools", async () => {
     expect(result.tags).toContain("daily");
   });
 
+  // FIX 2 (vault#589) — the MCP door rejects illegal paths too. The core tool
+  // throws a `PathValidationError` (error_type invalid_path) exactly like
+  // ExtensionValidationError; mcp-http.ts's generic error_type mapping turns it
+  // into a structured domain error at the transport. Assert the MCP tool path
+  // itself refuses the write (parity with the REST-door tests below).
+  test("create-note MCP tool rejects a '..' path with error_type invalid_path", async () => {
+    const tools = generateMcpTools(store);
+    const createNote = tools.find((t) => t.name === "create-note")!;
+    let thrown: any;
+    try {
+      await createNote.execute({ content: "x", path: "../escape" });
+    } catch (e) { thrown = e; }
+    expect(thrown).toBeTruthy();
+    expect(thrown.error_type).toBe("invalid_path");
+    expect(thrown.code).toBe("INVALID_PATH");
+    // Nothing written.
+    expect(await store.getNoteByPath("escape")).toBeNull();
+  });
+
+  test("create-note MCP tool rejects a NUL path with error_type invalid_path", async () => {
+    const NUL = String.fromCharCode(0);
+    const tools = generateMcpTools(store);
+    const createNote = tools.find((t) => t.name === "create-note")!;
+    let thrown: any;
+    try {
+      await createNote.execute({ content: "x", path: `bad${NUL}path` });
+    } catch (e) { thrown = e; }
+    expect(thrown).toBeTruthy();
+    expect(thrown.error_type).toBe("invalid_path");
+  });
+
   test("every tool has inputSchema and execute", () => {
     const tools = generateMcpTools(store);
     for (const tool of tools) {
@@ -2664,6 +2695,63 @@ describe("HTTP /notes", async () => {
     expect(body.error_type).toBe("invalid_extension");
   });
 
+  // FIX 2 (vault#589) — a note path with a NUL byte or a `..` segment is
+  // rejected at the write surface (400 invalid_path), never persisted. A
+  // NUL-in-path note otherwise slips the export traversal guard and then
+  // aborts the entire vault export; a `..` note is silently un-round-trippable.
+  test("POST /notes rejects a NUL-byte path with 400 invalid_path (not 201)", async () => {
+    const NUL = String.fromCharCode(0);
+    const res = await handleNotes(
+      mkReq("POST", "/notes", { content: "x", path: `bad${NUL}path` }),
+      store,
+      "",
+    );
+    expect(res.status).toBe(400);
+    const body = await res.json() as any;
+    expect(body.error_type).toBe("invalid_path");
+    // Nothing was written.
+    expect(await store.getNoteByPath("bad")).toBeNull();
+  });
+
+  test("POST /notes rejects a '..' path with 400 invalid_path", async () => {
+    const res = await handleNotes(
+      mkReq("POST", "/notes", { content: "x", path: "../escape" }),
+      store,
+      "",
+    );
+    expect(res.status).toBe(400);
+    const body = await res.json() as any;
+    expect(body.error_type).toBe("invalid_path");
+  });
+
+  test("POST /notes still accepts a legitimate path with dots (regression)", async () => {
+    const res = await handleNotes(
+      mkReq("POST", "/notes", { content: "ok", path: "Projects/v1.2/notes" }),
+      store,
+      "",
+    );
+    expect(res.status).toBeLessThan(400);
+    const body = await res.json() as any;
+    expect(body.path).toBe("Projects/v1.2/notes");
+  });
+
+  test("PATCH /notes/:id rejects a '..' path with 400 invalid_path", async () => {
+    const note = await store.createNote("hi", { id: "path-bad", path: "p" });
+    const res = await handleNotes(
+      mkReq("PATCH", "/notes/path-bad", {
+        path: "../../etc/passwd",
+        if_updated_at: note.updatedAt,
+      }),
+      store,
+      "/path-bad",
+    );
+    expect(res.status).toBe(400);
+    const body = await res.json() as any;
+    expect(body.error_type).toBe("invalid_path");
+    // The note's original path is untouched.
+    expect((await store.getNote("path-bad"))!.path).toBe("p");
+  });
+
   test("GET /notes?extension=csv filters by extension", async () => {
     await store.createNote("md note", { path: "a" });
     await store.createNote("csv note", { path: "b", extension: "csv" });