@promptowl/contextnest-community 1.11.0 → 1.12.0

package/CONFIGURATION.md

@@ -76,11 +76,15 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. |
 | `LOGO_URL` | _(unset)_ | Custom logo shown in the UI header + login screen. Must start with `https://`, `http://`, or `data:image/` — other schemes (`file://`, relative, `javascript:`) are rejected with a warning and the bundled icon is used. |
 | `PROMPTOWL_TEAMS_ENABLED` | _(unset — off)_ | Lets users who signed in with PromptOwl import their PromptOwl teams as local teams. Off by default; set `true` to enable, or toggle from Settings → Advanced. When off, `GET/POST /teams/promptowl` return `404` and the PromptOwl Teams panel is hidden. Independent of `PROMPTOWL_SIGN_IN_GATE`. |
+| `TYPE_ARTIFACT_ENABLED` | `true` | Set `false` to disable creation of **artifact** nodes server-wide (existing artifact nodes stay readable — never data loss). Runnable types (agent/skill/tool) are gated by `FEATURE_WORKFLOW_PLANE`, not here. Also editable from Settings (`/admin/settings`). |
+| `TYPE_TABLE_ENABLED` | `true` | Same as above for **table** nodes. |
 | `FEATURE_WORKFLOW_PLANE` | _(unset — off)_ | Enables the workflow plane: typed edges, edge-type registry, governed runs. Optional feature; also toggleable from Settings. |
 | `FEATURE_SUBAGENT_RUNS` | _(unset — off)_ | Lets runs spawn nested sub-agent runs (recursion). Gated separately from the plane; requires `FEATURE_WORKFLOW_PLANE`. Also toggleable from Settings → Advanced (turning the plane off forces this off too). Opens a recursion surface — enable only after reviewing the depth/fan-out caps. |
 | `SUBAGENT_MAX_DEPTH` | `8` | Max sub-agent nesting depth (clamped 1..32) — bounds the call tree's HEIGHT so it stays finite/haltable. |
 | `SUBAGENT_MAX_CHILDREN` | `16` | Max direct children a single run may spawn (clamped 1..128) — bounds the call tree's WIDTH. Together with `SUBAGENT_MAX_DEPTH` this caps total tree size so a runner can't fork-bomb the DB. |
 | `RUN_MAX_STEPS` | `10000` | Max steps a single run may accumulate (clamped 10..100000) — bounds a runaway/hostile runner's step log. |
+| `RUN_MAX_CONCURRENT_ROOTS` | `50` | Max concurrently-running root (depth-0) runs per nest (clamped 1..1000). The subagent caps bound a single tree; this bounds how many trees can run at once, so triggers can't flood a nest. |
+| `ANTHROPIC_API_KEY` | _(unset)_ | Server-wide default runner key for workflow-plane agent runs. Never returned by the API — the health endpoint reports presence only, and Settings shows a masked tail. |
 | `SLACK_WEBHOOK_URL` | _(unset — connector off)_ | Slack incoming-webhook URL for governance-event notifications (review submitted/approved/rejected, collaborator added). `https://` only — the URL embeds a secret. Also editable from Settings in the UI. |
 | `SMTP_URL` | _(unset — connector off)_ | SMTP connection URL for email notifications (`smtp://` or `smtps://`, credentials inline). Requires `NOTIFY_EMAIL_FROM` and `NOTIFY_EMAIL_TO`. Also editable from Settings. |
 | `NOTIFY_EMAIL_FROM` | _(unset)_ | From address for notification emails. |

package/README.md

@@ -113,67 +113,9 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 
 For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
 
-## What's new in 1.6.0
-
-- **PostgreSQL / Cloud SQL backend** — run the server on PostgreSQL alongside SQLite via an async DB adapter, so metadata survives on Cloud Run and other deployments where local disk isn't durable. Supports the Cloud SQL Auth Proxy (unix socket) and TCP + TLS. New `DB_*` env vars (`DB_DRIVER`, `DATABASE_URL`, `CLOUD_SQL_CONNECTION_NAME`, `DB_HOST`/`DB_PORT`/`DB_USER`/`DB_PASSWORD`/`DB_NAME`, `DB_POOL_MAX`, `DB_SSL`, `DB_SSL_CA`); SQLite stays the default when nothing is configured. See [CONFIGURATION.md](./CONFIGURATION.md).
-- **Configurable `NEST_STORAGE_ROOT`** — store nest vault files (markdown + version history) outside `DATA_ROOT` — e.g. on a Cloud Storage (GCS) volume mount — while the database stays on `DATA_ROOT`. Defaults to `<DATA_ROOT>/nests`, so existing deployments are unchanged. On a GCS FUSE mount, set `DRIFT_SCAN_INTERVAL_MS=0` and run a single instance.
-- **Security fix** — the admin guard on `/admin/settings` (GET/PATCH) is now correctly awaited; without it a non-admin could read or change server-wide settings in key mode.
-- **AdminLoginModal respects `PROMPTOWL_SIGN_IN_GATE`** — the "Sign in with PromptOwl" affordance follows the configured gate (`open` / `admin-only` / `disabled`).
-- **Drift scanner toggle** — `DRIFT_SCAN_INTERVAL_MS=0` now actually disables the drift scanner (previously reset to the 30s default).
-- **Safer folder sync** — unsynced-folder detection no longer treats a configured nest storage root as a sync candidate, preventing accidental duplication/removal of live nests when `NEST_STORAGE_ROOT` is nested under `DATA_ROOT`.
-
-Full history in [CHANGELOG.md](./CHANGELOG.md).
-
-## What's new in 1.3.0
-
-- **Server super-admins** — emails listed in `access.yaml: super_admins` administer every nest (change visibility, manage collaborators and stewards) without being added per-nest. Owner-only operations (delete, transfer) still require the nest owner. See [STEWARDSHIP.md](./STEWARDSHIP.md).
-- **License persistence under `DATA_ROOT`** — `PROMPTOWL_KEY` now writes to `$DATA_ROOT/.env` (was `$cwd/.env`, which is root-owned `/app` in the official Docker image and silently lost the key on container recreate). The License Setup Page also surfaces write failures instead of failing quietly. Override via `ENV_FILE_PATH`. See [CONFIGURATION.md](./CONFIGURATION.md).
-- **Case-insensitive email** across registration, login, invite, and access checks. Migration dedupes existing accounts that differ only in case; fixes "I can't log in because I capitalized my email" and access-guard / lockout mismatches.
-- **Document version history + inline diff** — every saved version is browsable in the document detail view, and an inline diff highlights what changed between any two versions.
-- **Nest Overview / index landing** — every nest opens on a grouped table-of-contents with a "recently edited" strip instead of a flat list.
-- **Public/private toggle on the nest header** — visibility is set directly from the header, not buried in a dialog.
-- **Review queue surfaces submitted-for-review edits** — reviewers see the pending versions a contributor staged, not just net-new documents.
-- **Internal-folder sync over MCP** — agents can list a nest's unsynced filesystem folders and pull them into the nest on demand. New `unsynced-service.ts` + MCP tools, covered by `test/unsynced-folder.test.ts` and `test/mcp-unsynced.test.ts`.
-- **Telemetry `batch_id` + user email** — usage events carry a stable `batch_id` (de-duped on the receiver) and the authenticated user email alongside the user id, so the PromptOwl ingest bridge can meter credits to the right account.
-- **Hyperlink navigation fix** — hyperlinks in the editor and viewer navigate to their configured target URL correctly.
-- **Repo / DX** — `CLAUDE.md` at the repo root with project-specific guidance for Claude Code; `claude.yml` (PR assistant) and `claude-code-review.yml` (auto review on PRs) GitHub Actions workflows.
-
-Full history in [CHANGELOG.md](./CHANGELOG.md).
-
-## What's new in 1.2.0
-
-- **Admin user management (no email server needed)** — `POST /auth/admin/reset-password/:userId` sets a user's password or returns a one-time temp password; `DELETE /auth/users/:userId` removes a user and revokes their API keys, sessions, and role rows. New self-service **Change password** in the user menu blocks reusing the current password.
-- **`PROMPTOWL_SIGN_IN_GATE`** — `open` / `admin-only` / `disabled` restricts "Sign in with PromptOwl" (admin reaches it via `?admin=1`). See [CONFIGURATION.md](./CONFIGURATION.md).
-- **Plain-text agent view** — `?format=markdown` on a node returns frontmatter + body as `text/markdown` for LLM-friendly consumption.
-- **Steward version revert** — `POST .../revert` restores an earlier version as a new one; pending-review docs are now editable (saving withdraws the review).
-- **Editor — always-editable surface** — Notion-style buttery headline, selection bubble toolbar (format-on-highlight), turn-into block conversion, Cmd+F find & replace, rich blocks (tables, callouts, toggles, syntax-highlighted code, columns), and wiki/code-safety fixes.
-- **Wiki usability** — backlinks panel ("Linked from N documents"), outline/TOC for 3+-heading docs, hover-preview on `[[wiki links]]`, multi-tag AND filtering with clickable chips, per-doc copy link, rename-safety warning for title-form links, link-health report (broken links + orphans), recently-edited strip.
-- **Sharing clarity** — share button reads "Share nest"; dialog clarifies nest-wide scope; deep links open documents directly.
-- **Security** — hardened scanner gate (PolinRider + Shai-Hulud preflight) in `bin/`.
-
-Full history in [CHANGELOG.md](./CHANGELOG.md).
-
-## What's new in 1.1.0
-
-- **Vault import** — import an existing folder of markdown files into a new nest in one step, from the dashboard ("Import folder") or via the API. Frontmatter, wiki links, and folder structure are preserved.
-- **Nest sharing + collaborators** — set per-nest visibility and add collaborators with read or write access. A Share affordance is now inline in the document view.
-- **Public read-only nests** — flip a nest to `visibility=public` to serve it to unauthenticated readers (bypasses auth for GETs only); writes still require a key.
-- **Custom logo / branding** — set `LOGO_URL` to show your own logo in the UI header and login screen. See [CONFIGURATION.md](./CONFIGURATION.md).
-- **Governance** — nest owners can self-approve their own changes; new per-nest auto-approve toggle; role-based action gating (buttons reflect the viewer's role); stewards can edit scope during a role change.
-- **Editor** — `[[wikilink]]` autocomplete, broken-link click creates a new doc with the title pre-filled, tag chips filter the nest list, Notion-style H1 title, click-to-edit, and an unsaved-changes warning.
-- **Stability** — added an error boundary so a render error in one view no longer blanks the whole app; bumped `uuid` to 14.
-
-Full history in [CHANGELOG.md](./CHANGELOG.md).
-
-## What's new in 1.0.1
-
-- **Document hashing pipeline** — external-edit detection, conflict-aware safe-publish, and inline version diffs powered by `@promptowl/contextnest-engine`. When a file is edited outside the UI, the editor shows an "External edit detected" banner with a side-by-side diff and an adopt / keep choice.
-- **Markdown rendering** — new `DocumentViewer` (react-markdown + remark-gfm + wikilink support) renders CLI/MCP-authored markdown correctly, with a view/edit toggle.
-- **License revocation now blocks writes synchronously** — revoke flips an in-process "writes blocked" flag immediately; the next write returns `503`.
-- **Dashboard stats** — new `GET /stats` endpoint surfaces nest / document / user counts.
-- **Docker fix** — Dockerfile now installs via npm against the shipped `package-lock.json`; base image bumped to `node:22-slim`.
-
-Full history in [CHANGELOG.md](./CHANGELOG.md).
+## What's new
+
+Release notes live in [CHANGELOG.md](./CHANGELOG.md).
 
 ## Licensing
 

package/dist/index.js

@@ -194,6 +194,12 @@ async function createSession(userId, userAgent) {
      VALUES (?, ?, ?, ?)`,
     [id, userId, expiryIso(), userAgent || null]
   );
+  try {
+    await db.run("UPDATE users SET is_invited = 0 WHERE id = ? AND is_invited = 1", [
+      userId
+    ]);
+  } catch {
+  }
   return id;
 }
 async function resolveSession(id) {
@@ -974,12 +980,6 @@ authRoutes.post("/login", async (c) => {
   console.log(`[auth] login OK \u2014 counter reset ip=${ip} email=${emailLower}`);
   if (hasIp) clear(ipKey);
   clear(emailKey);
-  if (user.is_invited === 1) {
-    try {
-      await db.run("UPDATE users SET is_invited = 0 WHERE id = ?", [user.id]);
-    } catch {
-    }
-  }
   if (check.needsRehash) {
     try {
       const newHash = await hashPassword(body.password);
@@ -1051,9 +1051,7 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
   );
 });
 authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
-  const body = await c.req.json().catch(
-    () => ({})
-  );
+  const body = await c.req.json().catch(() => ({}));
   const db = getDb();
   const userId = c.get("userId");
   const apiKey = generateApiKey();
@@ -1062,6 +1060,7 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
     "SELECT label, nest_id FROM api_keys WHERE user_id = ?",
     [userId]
   );
+  const nestScope = "nest_id" in body ? body.nest_id || null : prior?.nest_id ?? null;
   await db.transaction(async (tx) => {
     await tx.run("DELETE FROM api_keys WHERE user_id = ?", [userId]);
     await tx.run(
@@ -1071,7 +1070,7 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
         userId,
         hashApiKey(apiKey),
         getKeyPrefix(apiKey),
-        body.nest_id ?? prior?.nest_id ?? null,
+        nestScope,
         body.label ?? prior?.label ?? null
       ]
     );
@@ -10712,18 +10711,31 @@ function createApp() {
     const nestId = parts[0];
     const userId = c.get("userId");
     const nestScope = c.get("nestScope");
+    const isMcpTransport = parts.length === 2 && parts[1] === "mcp";
+    const deny = async (status, error, extra) => {
+      if (!isMcpTransport) return c.json({ error, ...extra }, status);
+      let id = null;
+      try {
+        id = (await c.req.json())?.id ?? null;
+      } catch {
+      }
+      const message = typeof extra?.reason === "string" ? `${error} \u2014 ${extra.reason}` : error;
+      return c.json(
+        { jsonrpc: "2.0", id, error: { code: -32e3, message } },
+        status
+      );
+    };
     if (nestScope && nestScope !== nestId) {
-      return c.json({ error: "API key not authorized for this nest" }, 403);
+      return deny(
+        403,
+        `API key not authorized for this nest \u2014 this key is scoped to nest "${nestScope}". Use that nest's MCP URL, or mint a user-level key in the Connect dialog.`
+      );
     }
     if (isSuspended() && c.req.method !== "GET") {
-      return c.json(
-        {
-          error: "Server suspended by PromptOwl",
-          reason: getSuspensionReason(),
-          contact: "support@promptowl.ai"
-        },
-        503
-      );
+      return deny(503, "Server suspended by PromptOwl", {
+        reason: getSuspensionReason(),
+        contact: "support@promptowl.ai"
+      });
     }
     {
       const path2 = c.req.path;
@@ -10735,14 +10747,10 @@ function createApp() {
       if (needsLicense) {
         const lic = getCurrentLicense();
         if (!lic?.valid) {
-          return c.json(
-            {
-              error: "License required",
-              reason: "Install a PromptOwl license key via the setup screen or POST /license/install.",
-              setup_url: "/setup"
-            },
-            503
-          );
+          return deny(503, "License required", {
+            reason: "This server has no valid PromptOwl license installed. Ask the server admin to install one via the setup screen or POST /license/install.",
+            setup_url: "/setup"
+          });
         }
       }
     }
@@ -10770,7 +10778,9 @@ function createApp() {
         grantNestVisible = await hasAnyGrant(nestId, userId);
       }
       if (!grantRole && !grantNestVisible) {
-        return c.json({ error: "Nest not found" }, 404);
+        return deny(404, "Nest not found", {
+          reason: "The nest id may be wrong, or these credentials have no access to it. Ask the nest owner to share the nest with you, then reconnect."
+        });
       }
     }
     let required = "read";
@@ -10796,7 +10806,7 @@ function createApp() {
       required = c.req.method === "GET" ? "write" : "admin";
     } else if (parts[1] === "hooks") {
       required = "write";
-    } else if (c.req.method !== "GET" && !isStewardActionPath && !isCommentAction && !isAnnotationAction && !isReadQuery) {
+    } else if (c.req.method !== "GET" && !isStewardActionPath && !isCommentAction && !isAnnotationAction && !isReadQuery && !isMcpTransport) {
       required = "write";
     }
     const isNodeAction = c.req.method === "POST" && parts.length >= 4 && (parts[parts.length - 1] === "revert" || parts[parts.length - 1] === "move");
@@ -10825,13 +10835,13 @@ function createApp() {
     const grantLevel = grantRole ? permissionLevel(grantRole) : grantNestVisible ? permissionLevel("read") : 0;
     const effectiveLevel = Math.max(permissionLevel(permission), grantLevel);
     if (!stewardEditorBypass && effectiveLevel < permissionLevel(required)) {
-      return c.json(
+      return deny(
+        403,
+        `You don't have access to perform this action on this nest. Required permission: '${required}', your permission: '${permission}'. Ask the nest owner or a server admin to grant you ${required} access.`,
         {
-          error: `You don't have access to perform this action on this nest. Required permission: '${required}', your permission: '${permission}'. Ask the nest owner or a server admin to grant you ${required} access.`,
           required_permission: required,
           your_permission: permission
-        },
-        403
+        }
       );
     }
     c.set(