@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.5

package/node_modules/@oscharko-dev/keiko-server/dist/store/chats.js

@@ -1,7 +1,9 @@
 // ADR-0013 — chats CRUD scoped to a project. Parameterized SQL only.
 import { isAbsolute } from "node:path";
 import { SELECTED_SCOPE_KINDS, isValidScopePath, } from "@oscharko-dev/keiko-contracts/connected-context";
-import { DEFAULT_GROUNDING_LIMITS, MAX_CONNECTED_SOURCES, MAX_LOCAL_KNOWLEDGE_SOURCES, } from "@oscharko-dev/keiko-contracts/bff-wire";
+import { DEFAULT_GROUNDING_LIMITS, GROUNDING_LIMIT_CEILINGS, } from "@oscharko-dev/keiko-contracts/bff-wire";
+import { redact } from "@oscharko-dev/keiko-security";
+import { pathIsDenied } from "../files-deny.js";
 import { invalidRequest, notFound } from "./errors.js";
 const MAX_CONNECTED_SCOPE_PATHS = 50;
 const SELECTED_SCOPE_KIND_SET = new Set(SELECTED_SCOPE_KINDS);
@@ -49,6 +51,18 @@ function validateScopePathsForKind(kind, paths) {
     }
     return items;
 }
+function metadataIsSafe(value) {
+    const redacted = redact(value);
+    return typeof redacted !== "string" || redacted === value;
+}
+function assertMetadataSafe(value, label) {
+    if (!metadataIsSafe(value)) {
+        throw invalidRequest(`${label} must not contain credential-shaped metadata.`);
+    }
+}
+function allMetadataSafe(values) {
+    return values.every(metadataIsSafe);
+}
 // Epic #532 — the connected_scope_paths column now holds EITHER a single scope object (legacy)
 // OR a JSON array of scope objects (multi-source). The Issue #184 legacy form (a bare array of
 // path strings) is still tolerated as a single files scope. Disambiguation: an array whose first
@@ -62,8 +76,13 @@ function validateScopePathsForKind(kind, paths) {
 function decodeScopeRoot(raw) {
     if (raw === undefined)
         return { ok: true };
-    if (typeof raw === "string" && raw.length > 0 && isAbsolute(raw))
+    if (typeof raw === "string" &&
+        raw.length > 0 &&
+        isAbsolute(raw) &&
+        !pathIsDenied(raw) &&
+        metadataIsSafe(raw)) {
         return { ok: true, root: raw };
+    }
     return { ok: false };
 }
 function decodeSingleScopeObject(raw) {
@@ -72,6 +91,8 @@ function decodeSingleScopeObject(raw) {
     const relativePaths = validateScopePathsForKind(raw.kind, raw.relativePaths);
     if (relativePaths === undefined)
         return undefined;
+    if (!allMetadataSafe(relativePaths))
+        return undefined;
     const decodedRoot = decodeScopeRoot(raw.root);
     if (!decodedRoot.ok)
         return undefined;
@@ -88,10 +109,12 @@ function decodeSingleScopeObject(raw) {
 }
 function decodeLegacyFilesArray(parsed) {
     const relativePaths = validateScopePathsForKind("files", parsed);
-    return relativePaths === undefined ? undefined : { kind: "files", relativePaths };
+    if (relativePaths === undefined || !allMetadataSafe(relativePaths))
+        return undefined;
+    return { kind: "files", relativePaths };
 }
 function decodeScopeObjectArray(entries) {
-    if (entries.length > MAX_CONNECTED_SOURCES)
+    if (entries.length > GROUNDING_LIMIT_CEILINGS.maxConnectedSources)
         return undefined;
     const payloads = [];
     for (const entry of entries) {
@@ -180,8 +203,9 @@ function decodeLocalKnowledgeScopes(raw) {
     return single === undefined ? undefined : [single];
 }
 function decodeLocalKnowledgeScopeArray(entries) {
-    if (entries.length === 0 || entries.length > MAX_LOCAL_KNOWLEDGE_SOURCES)
+    if (entries.length === 0 || entries.length > GROUNDING_LIMIT_CEILINGS.maxLocalKnowledgeSources) {
         return undefined;
+    }
     const scopes = [];
     for (const entry of entries) {
         const decoded = decodeLocalKnowledgeScopeObject(entry);
@@ -326,9 +350,25 @@ function validateConnectedScopeShape(scope) {
     if (!Array.isArray(scope.relativePaths)) {
         throw invalidRequest("connectedScope.relativePaths must be an array.");
     }
-    if (validateScopePathsForKind(scope.kind, scope.relativePaths) === undefined) {
+    const relativePaths = validateScopePathsForKind(scope.kind, scope.relativePaths);
+    if (relativePaths === undefined) {
         throw invalidRequest("connectedScope.relativePaths must match connectedScope.kind and contain valid workspace-relative paths.");
     }
+    validateConnectedScopeTimestamp(scope);
+    validateConnectedScopeMetadata(relativePaths, scope.root);
+}
+function validateConnectedScopeMetadata(relativePaths, root) {
+    if (root !== undefined && pathIsDenied(root)) {
+        throw invalidRequest("connectedScope.root must not reference a deny-listed path.");
+    }
+    for (const relativePath of relativePaths) {
+        assertMetadataSafe(relativePath, "connectedScope.relativePaths");
+    }
+    if (root !== undefined) {
+        assertMetadataSafe(root, "connectedScope.root");
+    }
+}
+function validateConnectedScopeTimestamp(scope) {
     if (typeof scope.connectedAtMs !== "number" ||
         !Number.isInteger(scope.connectedAtMs) ||
         scope.connectedAtMs < 0) {
@@ -511,8 +551,44 @@ function localKnowledgeScopesUpdateParams(value) {
     }
     return { apply: 1, json: JSON.stringify(value.map(encodeLocalKnowledgeScopeObject)) };
 }
-export function updateChat(db, id, patch, now) {
-    validateChatPatch(patch);
+// Release 0.2.0 — combined source cap. "Up to 16 sources" is a TOTAL across both lists
+// (folders/files/repos in connectedScopes + knowledge connectors in localKnowledgeScopes),
+// mirroring the QI ingestion total cap (MAX_QI_SOURCES = 16) so "16 sources" means the same
+// thing everywhere. The cap is max(maxConnectedSources, maxLocalKnowledgeSources): never
+// smaller than either per-list limit, so each list's own cap stays reachable. Growth-only:
+// a pre-existing over-cap chat may shrink or hold its lists (no migration lock-out), but no
+// patch may grow the combined total past the cap.
+// Effective count after applying a resolved list patch: undefined = unchanged, null = cleared.
+function patchedCount(resolved, prev) {
+    if (resolved === undefined)
+        return prev;
+    return resolved === null ? 0 : resolved.length;
+}
+function combinedSourceCap(options) {
+    return Math.max(options?.maxConnectedSources ?? DEFAULT_GROUNDING_LIMITS.maxConnectedSources, options?.maxLocalKnowledgeSources ?? DEFAULT_GROUNDING_LIMITS.maxLocalKnowledgeSources);
+}
+function validateTotalSourceCap(db, id, patch, options) {
+    const nextConnected = resolveScopePatch(patch);
+    const nextLk = resolveLocalKnowledgeScopePatch(patch);
+    if (nextConnected === undefined && nextLk === undefined)
+        return;
+    const existing = findChatById(db, id);
+    if (existing === undefined)
+        return; // the UPDATE below raises notFound
+    const prevConnected = existing.connectedScopes ??
+        (existing.connectedScope !== undefined ? [existing.connectedScope] : []);
+    const prevLk = existing.localKnowledgeScopes ??
+        (existing.localKnowledgeScope !== undefined ? [existing.localKnowledgeScope] : []);
+    const total = patchedCount(nextConnected, prevConnected.length) + patchedCount(nextLk, prevLk.length);
+    const prevTotal = prevConnected.length + prevLk.length;
+    const cap = combinedSourceCap(options);
+    if (total > cap && total > prevTotal) {
+        throw invalidRequest(`A chat may connect at most ${String(cap)} sources in total (folders, files, repositories, and knowledge connectors combined).`);
+    }
+}
+export function updateChat(db, id, patch, now, options) {
+    validateChatPatch(patch, options);
+    validateTotalSourceCap(db, id, patch, options);
     if (patch.selectedModel !== undefined)
         validateSelectedModel(patch.selectedModel);
     const titleParam = patch.title ?? null;

package/node_modules/@oscharko-dev/keiko-server/dist/store/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/store/db.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,OAAO,KAAK,EAMV,OAAO,EACP,qBAAqB,EAItB,MAAM,YAAY,CAAC;AAiCpB,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAM9E;AA6JD,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAa3C,wBAAgB,qBAAqB,CAAC,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAI3E;AAgCD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAkB/D;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAEhG;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAEvF"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/store/db.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,OAAO,KAAK,EAMV,OAAO,EACP,qBAAqB,EAKtB,MAAM,YAAY,CAAC;AAiCpB,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAM9E;AA+JD,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAa3C,wBAAgB,qBAAqB,CAAC,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAI3E;AAgCD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAkB/D;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAEhG;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAEvF"}

package/node_modules/@oscharko-dev/keiko-server/dist/store/db.js

@@ -93,10 +93,12 @@ function buildStore(db, options) {
         deleteProject: (path) => {
             deleteProjectRecord(db, path);
         },
-        listChats: (projectPath, limit) => limit === undefined ? sqlListChats(db, projectPath) : sqlListChatsLimited(db, projectPath, limit),
+        listChats: (projectPath, limit) => limit === undefined
+            ? sqlListChats(db, projectPath)
+            : sqlListChatsLimited(db, projectPath, limit),
         findChatById: (id) => sqlFindChatById(db, id),
         createChat: (projectPath, title, selectedModel, opts) => createChatRecord(db, options, projectPath, title, selectedModel, opts),
-        updateChat: (id, patch) => sqlUpdateChat(db, id, patch, options.now()),
+        updateChat: (id, patch, updateOptions) => sqlUpdateChat(db, id, patch, options.now(), updateOptions),
         deleteChat: (id) => {
             sqlDeleteChat(db, id);
         },

package/node_modules/@oscharko-dev/keiko-server/dist/store/index.d.ts

@@ -1,4 +1,4 @@
-export type { Chat, ChatConnectedScope, ChatLocalKnowledgeScope, ChatMessage, ChatRole, CreateChatOptions, NewChatMessage, Project, UiStore, UiStoreFactoryOptions, UpdateChatMessagePatch, UpdateChatPatch, UpdateProjectPatch, WorkflowStatus, } from "./types.js";
+export type { Chat, ChatConnectedScope, ChatLocalKnowledgeScope, ChatMessage, ChatRole, CreateChatOptions, NewChatMessage, Project, UiStore, UiStoreFactoryOptions, UpdateChatOptions, UpdateChatMessagePatch, UpdateChatPatch, UpdateProjectPatch, WorkflowStatus, } from "./types.js";
 export { UiStoreError, type UiStoreErrorCode, invalidPath, invalidRequest, notFound, pathNotDirectory, pathNotFound, projectExists, } from "./errors.js";
 export { classifyPathShape, validateProjectPath, type PathShape, type ValidateProjectPathOptions, } from "./validation.js";
 export { assertUiDbOutsideProject, resolveUiDbPath, UI_DB_FILENAME, UI_DB_DIRNAME, } from "./paths.js";

package/node_modules/@oscharko-dev/keiko-server/dist/store/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/store/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,IAAI,EACJ,kBAAkB,EAClB,uBAAuB,EACvB,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACd,OAAO,EACP,OAAO,EACP,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,KAAK,gBAAgB,EACrB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,0BAA0B,GAChC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/store/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,IAAI,EACJ,kBAAkB,EAClB,uBAAuB,EACvB,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACd,OAAO,EACP,OAAO,EACP,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,KAAK,gBAAgB,EACrB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,0BAA0B,GAChC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,SAAS,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/store/types.d.ts

@@ -8,7 +8,7 @@ export interface UiStore {
     readonly listChats: (projectPath: string, limit?: number) => readonly Chat[];
     readonly findChatById: (id: string) => Chat | undefined;
     readonly createChat: (projectPath: string, title: string, selectedModel: string, opts?: CreateChatOptions) => Chat;
-    readonly updateChat: (id: string, patch: UpdateChatPatch) => Chat;
+    readonly updateChat: (id: string, patch: UpdateChatPatch, options?: UpdateChatOptions) => Chat;
     readonly deleteChat: (id: string) => void;
     readonly listMessages: (chatId: string, limit?: number) => readonly ChatMessage[];
     readonly findMessageById: (id: string) => ChatMessage | undefined;
@@ -17,6 +17,10 @@ export interface UiStore {
     readonly updateMessage: (id: string, patch: UpdateChatMessagePatch) => ChatMessage;
     readonly close: () => void;
 }
+export interface UpdateChatOptions {
+    readonly maxConnectedSources?: number;
+    readonly maxLocalKnowledgeSources?: number;
+}
 export interface UiStoreFactoryOptions {
     readonly now?: () => number;
     readonly newId?: () => string;

package/node_modules/@oscharko-dev/keiko-server/dist/store/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,OAAO,EACP,IAAI,EACJ,kBAAkB,EAClB,uBAAuB,EACvB,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,EACvB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EACV,OAAO,EACP,IAAI,EACJ,kBAAkB,EAClB,uBAAuB,EACvB,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,GACvB,CAAC;AAEF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,SAAS,OAAO,EAAE,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACjE,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC;IAC7E,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAE/C,QAAQ,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC;IAC7E,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,CACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,iBAAiB,KACrB,IAAI,CAAC;IACV,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAClE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAE1C,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,SAAS,WAAW,EAAE,CAAC;IAClF,QAAQ,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,WAAW,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,KAAK,SAAS,WAAW,EAAE,CAAC;IACzF,QAAQ,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,KAAK,WAAW,CAAC;IAEnF,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;CAC5B;AAID,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CACnD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,OAAO,EACP,IAAI,EACJ,kBAAkB,EAClB,uBAAuB,EACvB,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,EACvB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EACV,OAAO,EACP,IAAI,EACJ,kBAAkB,EAClB,uBAAuB,EACvB,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,GACvB,CAAC;AAEF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,SAAS,OAAO,EAAE,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACjE,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC;IAC7E,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAE/C,QAAQ,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC;IAC7E,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,CACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,iBAAiB,KACrB,IAAI,CAAC;IACV,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC/F,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAE1C,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,SAAS,WAAW,EAAE,CAAC;IAClF,QAAQ,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,WAAW,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,KAAK,SAAS,WAAW,EAAE,CAAC;IACzF,QAAQ,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,KAAK,WAAW,CAAC;IAEnF,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAC5C;AAID,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CACnD"}

package/node_modules/@oscharko-dev/keiko-server/dist/store-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-handlers.d.ts","sourceRoot":"","sources":["../src/store-handlers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAuH/C,iBAAS,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAEpD;AAqMD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAGvF;AAMD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAUtB;AAeD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAQtB;AAMD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CASvF;AAgBD,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAYnF;AAMD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAetB;AA+XD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAoBtB;AAMD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAQpF;AAMD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAgBtF;AAMD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAwBtB;AA6CD,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAWtB;AAuBD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAgBtB;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"store-handlers.d.ts","sourceRoot":"","sources":["../src/store-handlers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAwH/C,iBAAS,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAEpD;AAmND,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAMvF;AAMD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAatB;AAeD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAQtB;AAMD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAcvF;AAgBD,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAYnF;AAMD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAetB;AA0bD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAuBtB;AAMD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAQpF;AAMD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAkBtF;AAMD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAwBtB;AA6CD,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAWtB;AAuBD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAgBtB;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/store-handlers.js

@@ -10,6 +10,7 @@ import { UiStoreError, assertUiDbOutsideProject, isProjectAvailable, validatePro
 import { pathIsDenied } from "./files-deny.js";
 import { clearGroundedContextIndexesForConversation, clearGroundedContextIndexesForWorkspace, } from "./grounded-context-index.js";
 import { clearGroundedTurnsForConversation, clearGroundedTurnsForWorkspace, } from "./grounded-turn-registry.js";
+import { isLegacyEmptyAssistantPlaceholder } from "./assistant-response.js";
 // Issue #184 — workspace-relative path gate. isValidScopePath is the canonical validator from
 // @oscharko-dev/keiko-contracts/connected-context (issue #178). Reusing it here keeps the BFF
 // boundary aligned with the rest of the connected-repo surface and avoids regex drift.
@@ -94,6 +95,9 @@ function badRequest(code, message) {
 function notFoundResult(message) {
     return { status: 404, body: errorBody("not_found", message) };
 }
+function forbiddenResult(code, message) {
+    return { status: 403, body: errorBody(code, message) };
+}
 function payloadTooLarge() {
     return {
         status: 413,
@@ -235,6 +239,14 @@ function optionalBoundedQueryInteger(ctx, name, fallback, max) {
 function projectWithAvailability(p) {
     return { ...p, available: isProjectAvailable(p) };
 }
+function putPreferredProjectFirst(projects, preferredProjectPath) {
+    if (preferredProjectPath === undefined)
+        return projects;
+    const preferred = projects.find((project) => project.path === preferredProjectPath);
+    if (preferred === undefined)
+        return projects;
+    return [preferred, ...projects.filter((project) => project.path !== preferredProjectPath)];
+}
 function chatBelongsToProject(deps, projectPath, chatId) {
     return deps.store.findChatById(chatId)?.projectPath === projectPath;
 }
@@ -251,7 +263,7 @@ function messageBelongsToChat(deps, chatId, messageId) {
 // Route 13 — GET /api/projects
 // ──────────────────────────────────────────────────────────────────────────
 export function handleListProjects(_ctx, deps) {
-    const projects = deps.store.listProjects().map(projectWithAvailability);
+    const projects = putPreferredProjectFirst(deps.store.listProjects().map(projectWithAvailability), deps.preferredProjectPath);
     return { status: 200, body: { projects } };
 }
 // ──────────────────────────────────────────────────────────────────────────
@@ -263,6 +275,9 @@ export async function handleCreateProject(ctx, deps) {
         const path = requireString(body, "path");
         const name = optionalString(body, "name");
         const normalizedPath = validateProjectPath(path, { mustExist: true });
+        if (pathIsDenied(normalizedPath)) {
+            return forbiddenResult("DENIED", "The project path is excluded from Keiko's safe read surface.");
+        }
         assertUiDbOutsideProject(deps.uiDbPath, normalizedPath);
         const project = deps.store.createProject(normalizedPath, name);
         return { status: 201, body: { project: projectWithAvailability(project) } };
@@ -295,7 +310,12 @@ export function handleDeleteProject(ctx, deps) {
     return runHandlerSync(() => {
         const targetPath = requireQuery(ctx, "path");
         const normalizedPath = validateProjectPath(targetPath, { mustExist: false });
+        const deletedChats = deps.store.listChats(normalizedPath);
         deps.store.deleteProject(normalizedPath);
+        for (const chat of deletedChats) {
+            clearGroundedContextIndexesForConversation(chat.id);
+            clearGroundedTurnsForConversation(chat.id);
+        }
         clearGroundedContextIndexesForWorkspace(normalizedPath);
         clearGroundedTurnsForWorkspace(normalizedPath);
         return { status: 204, body: null };
@@ -405,6 +425,9 @@ function scopeTargetPath(realProjectRoot, relativePath) {
         return realProjectRoot;
     return resolve(realProjectRoot, ...relativePath.split("/").filter((part) => part.length > 0));
 }
+function scopeRelativePath(realProjectRoot, absolutePath) {
+    return relative(realProjectRoot, absolutePath).split("\\").join("/");
+}
 function assertScopePathMetadataSafe(deps, relativePath) {
     if (pathIsDenied(relativePath)) {
         throw new InvalidRequest("Connected scope is excluded from Keiko's safe read surface.");
@@ -427,6 +450,9 @@ function validateScopePathAccess(deps, realProjectRoot, kind, entry) {
     if (!isContainedPath(realProjectRoot, targetReal)) {
         throw new InvalidRequest("Connected scope path must stay inside the selected project.");
     }
+    if (pathIsDenied(scopeRelativePath(realProjectRoot, targetReal))) {
+        throw new InvalidRequest("Connected scope is excluded from Keiko's safe read surface.");
+    }
     let info;
     try {
         info = statSync(targetReal);
@@ -444,7 +470,7 @@ function validateScopePathAccess(deps, realProjectRoot, kind, entry) {
 function resolveRealRoot(rootInput, notAccessibleMessage) {
     const root = validateProjectPath(rootInput, { mustExist: true });
     try {
-        return realpathSync(root);
+        return { root, realRoot: realpathSync(root) };
     }
     catch {
         throw new InvalidRequest(notAccessibleMessage);
@@ -454,10 +480,10 @@ function resolveRealRoot(rootInput, notAccessibleMessage) {
 // (a folder outside the chat's project, so non-developers can connect any folder). Validate it like
 // a project root, then refuse credential/secret locations (deny-list) and credential-shaped path
 // metadata so home-directory browsing can never bind a secret folder as a grounded scope.
-function validateConnectedScopeRoot(deps, rootInput) {
-    const realRoot = resolveRealRoot(rootInput, "Connected scope root is not accessible.");
-    if (pathIsDenied(realRoot)) {
-        throw new InvalidRequest("Connected scope root is excluded from Keiko's safe read surface.");
+function validateAccessibleRoot(deps, rootInput, notAccessibleMessage, deniedMessage) {
+    const { root, realRoot } = resolveRealRoot(rootInput, notAccessibleMessage);
+    if (pathIsDenied(root) || pathIsDenied(realRoot)) {
+        throw new InvalidRequest(deniedMessage);
     }
     const redacted = deps.redactor(realRoot);
     if (typeof redacted === "string" && redacted !== realRoot) {
@@ -465,15 +491,23 @@ function validateConnectedScopeRoot(deps, rootInput) {
     }
     return realRoot;
 }
+function validateConnectedScopeRoot(deps, rootInput) {
+    return validateAccessibleRoot(deps, rootInput, "Connected scope root is not accessible.", "Connected scope root is excluded from Keiko's safe read surface.");
+}
+function validateFallbackProjectRoot(deps, projectPath) {
+    return validateAccessibleRoot(deps, projectPath, "Selected project is not accessible.", "Selected project is excluded from Keiko's safe read surface.");
+}
 function validateConnectedScopeAccess(deps, chat, scope) {
     const realRoot = scope.root !== undefined
         ? validateConnectedScopeRoot(deps, scope.root)
-        : resolveRealRoot(chat.projectPath, "Selected project is not accessible.");
-    if (scope.kind === "workspace-root")
-        return;
+        : validateFallbackProjectRoot(deps, chat.projectPath);
+    if (scope.kind === "workspace-root") {
+        return scope.root === undefined ? scope : { ...scope, root: realRoot };
+    }
     for (const entry of scope.relativePaths) {
         validateScopePathAccess(deps, realRoot, scope.kind, entry);
     }
+    return scope.root === undefined ? scope : { ...scope, root: realRoot };
 }
 function validateScopeConnectedAtMs(value) {
     if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
@@ -642,6 +676,23 @@ function scopesRequiringAccessValidation(patch) {
     }
     return [];
 }
+function canonicalizeConnectedScopePatch(deps, chat, patch) {
+    if (patch.connectedScopes !== undefined) {
+        return {
+            ...patch,
+            connectedScopes: patch.connectedScopes === null
+                ? null
+                : patch.connectedScopes.map((scope) => validateConnectedScopeAccess(deps, chat, scope)),
+        };
+    }
+    if (patch.connectedScope !== undefined && patch.connectedScope !== null) {
+        return {
+            ...patch,
+            connectedScope: validateConnectedScopeAccess(deps, chat, patch.connectedScope),
+        };
+    }
+    return patch;
+}
 // Epic #189 — the grounded index is invalidated when ANY grounding source changes: a connected
 // folder scope (#532) OR a local-knowledge connector scope. The hybrid path reads both.
 function patchTouchesGroundingScope(patch) {
@@ -656,16 +707,19 @@ export async function handleUpdateChat(ctx, deps) {
         const body = await readJsonObject(ctx.req);
         const patch = buildChatPatch(deps, body);
         const scopesToCheck = scopesRequiringAccessValidation(patch);
+        let safePatch = patch;
         if (scopesToCheck.length > 0) {
             const existing = findChatById(deps, id);
             if (existing === undefined)
                 return notFoundResult("Chat not found.");
-            for (const scope of scopesToCheck) {
-                validateConnectedScopeAccess(deps, existing, scope);
-            }
+            safePatch = canonicalizeConnectedScopePatch(deps, existing, patch);
         }
-        const chat = deps.store.updateChat(id, patch);
-        if (patchTouchesGroundingScope(patch) || patch.status === "closed") {
+        const limits = currentGroundingLimits(deps);
+        const chat = deps.store.updateChat(id, safePatch, {
+            maxConnectedSources: limits.maxConnectedSources,
+            maxLocalKnowledgeSources: limits.maxLocalKnowledgeSources,
+        });
+        if (patchTouchesGroundingScope(safePatch) || safePatch.status === "closed") {
             clearGroundedContextIndexesForConversation(id);
             clearGroundedTurnsForConversation(id);
         }
@@ -695,7 +749,9 @@ export function handleListMessages(ctx, deps) {
         if (!chatBelongsToProject(deps, projectPath, chatId)) {
             return notFoundResult("Chat not found.");
         }
-        const messages = deps.store.listMessages(chatId, limit);
+        const messages = deps.store
+            .listMessages(chatId, limit)
+            .filter((message) => !isLegacyEmptyAssistantPlaceholder(message));
         return { status: 200, body: { messages } };
     });
 }

package/node_modules/@oscharko-dev/keiko-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oscharko-dev/keiko-server",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.0-beta.5",
   "private": true,
   "type": "module",
   "license": "Apache-2.0",
@@ -15,7 +15,7 @@
   },
   "scripts": {
     "build": "tsc -b tsconfig.json",
-    "typecheck": "tsc -b tsconfig.json --noEmit",
+    "typecheck": "tsc -b tsconfig.json",
     "test": "vitest run"
   },
   "files": [