@promptowl/contextnest-community 1.11.0 → 1.13.0

package/CONFIGURATION.md

@@ -73,14 +73,19 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
 | `TRACE_RETENTION_DAYS` | `14` | Activity-trace retention window in days (the `api_events` rows behind `GET /admin/trace` and `GET /nests/:id/trace`). Rows older than this are pruned opportunistically (every ~500 inserts). `0` = keep forever (pruning is skipped entirely). Capped at `3650`; invalid/negative values fall back to `14`. Also editable from Settings → Advanced. |
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
-| `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. |
+| `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. The asset-upload route (`POST /nests/:id/assets`) is exempt up to the video cap below. |
+| `VIDEO_MAX_MB` | `30` | Max size (in MB) of a video uploaded into a doc. Default `30` keeps it under Cloud Run's ~32 MiB HTTP/1 request-body limit, so an oversized video is rejected with a clear message instead of a bare `413` from the platform. Raise only where the deployment can actually accept larger request bodies (not behind Cloud Run, or on HTTP/2 / direct-to-bucket upload). Images are fixed at 10 MB. |
 | `LOGO_URL` | _(unset)_ | Custom logo shown in the UI header + login screen. Must start with `https://`, `http://`, or `data:image/` — other schemes (`file://`, relative, `javascript:`) are rejected with a warning and the bundled icon is used. |
 | `PROMPTOWL_TEAMS_ENABLED` | _(unset — off)_ | Lets users who signed in with PromptOwl import their PromptOwl teams as local teams. Off by default; set `true` to enable, or toggle from Settings → Advanced. When off, `GET/POST /teams/promptowl` return `404` and the PromptOwl Teams panel is hidden. Independent of `PROMPTOWL_SIGN_IN_GATE`. |
+| `TYPE_ARTIFACT_ENABLED` | `true` | Set `false` to disable creation of **artifact** nodes server-wide (existing artifact nodes stay readable — never data loss). Runnable types (agent/skill/tool) are gated by `FEATURE_WORKFLOW_PLANE`, not here. Also editable from Settings (`/admin/settings`). |
+| `TYPE_TABLE_ENABLED` | `true` | Same as above for **table** nodes. |
 | `FEATURE_WORKFLOW_PLANE` | _(unset — off)_ | Enables the workflow plane: typed edges, edge-type registry, governed runs. Optional feature; also toggleable from Settings. |
 | `FEATURE_SUBAGENT_RUNS` | _(unset — off)_ | Lets runs spawn nested sub-agent runs (recursion). Gated separately from the plane; requires `FEATURE_WORKFLOW_PLANE`. Also toggleable from Settings → Advanced (turning the plane off forces this off too). Opens a recursion surface — enable only after reviewing the depth/fan-out caps. |
 | `SUBAGENT_MAX_DEPTH` | `8` | Max sub-agent nesting depth (clamped 1..32) — bounds the call tree's HEIGHT so it stays finite/haltable. |
 | `SUBAGENT_MAX_CHILDREN` | `16` | Max direct children a single run may spawn (clamped 1..128) — bounds the call tree's WIDTH. Together with `SUBAGENT_MAX_DEPTH` this caps total tree size so a runner can't fork-bomb the DB. |
 | `RUN_MAX_STEPS` | `10000` | Max steps a single run may accumulate (clamped 10..100000) — bounds a runaway/hostile runner's step log. |
+| `RUN_MAX_CONCURRENT_ROOTS` | `50` | Max concurrently-running root (depth-0) runs per nest (clamped 1..1000). The subagent caps bound a single tree; this bounds how many trees can run at once, so triggers can't flood a nest. |
+| `ANTHROPIC_API_KEY` | _(unset)_ | Server-wide default runner key for workflow-plane agent runs. Never returned by the API — the health endpoint reports presence only, and Settings shows a masked tail. |
 | `SLACK_WEBHOOK_URL` | _(unset — connector off)_ | Slack incoming-webhook URL for governance-event notifications (review submitted/approved/rejected, collaborator added). `https://` only — the URL embeds a secret. Also editable from Settings in the UI. |
 | `SMTP_URL` | _(unset — connector off)_ | SMTP connection URL for email notifications (`smtp://` or `smtps://`, credentials inline). Requires `NOTIFY_EMAIL_FROM` and `NOTIFY_EMAIL_TO`. Also editable from Settings. |
 | `NOTIFY_EMAIL_FROM` | _(unset)_ | From address for notification emails. |

package/README.md

@@ -101,7 +101,7 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 | Custom logo / branding | ✅ | ✅ |
 | Admin password reset + user removal (in-platform) | ✅ | ✅ |
 | Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
-| Rich editor — tables, callouts, toggles, code highlight, find/replace | ✅ | ✅ |
+| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
 | Steward version revert | ✅ | ✅ |
 | MCP server for AI agents | ✅ | ✅ |
 | Centralized multi-tenant admin console | — | ✅ |
@@ -113,67 +113,9 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 
 For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
 
-## What's new in 1.6.0
+## What's new
 
-- **PostgreSQL / Cloud SQL backend** — run the server on PostgreSQL alongside SQLite via an async DB adapter, so metadata survives on Cloud Run and other deployments where local disk isn't durable. Supports the Cloud SQL Auth Proxy (unix socket) and TCP + TLS. New `DB_*` env vars (`DB_DRIVER`, `DATABASE_URL`, `CLOUD_SQL_CONNECTION_NAME`, `DB_HOST`/`DB_PORT`/`DB_USER`/`DB_PASSWORD`/`DB_NAME`, `DB_POOL_MAX`, `DB_SSL`, `DB_SSL_CA`); SQLite stays the default when nothing is configured. See [CONFIGURATION.md](./CONFIGURATION.md).
-- **Configurable `NEST_STORAGE_ROOT`** — store nest vault files (markdown + version history) outside `DATA_ROOT` — e.g. on a Cloud Storage (GCS) volume mount — while the database stays on `DATA_ROOT`. Defaults to `<DATA_ROOT>/nests`, so existing deployments are unchanged. On a GCS FUSE mount, set `DRIFT_SCAN_INTERVAL_MS=0` and run a single instance.
-- **Security fix** — the admin guard on `/admin/settings` (GET/PATCH) is now correctly awaited; without it a non-admin could read or change server-wide settings in key mode.
-- **AdminLoginModal respects `PROMPTOWL_SIGN_IN_GATE`** — the "Sign in with PromptOwl" affordance follows the configured gate (`open` / `admin-only` / `disabled`).
-- **Drift scanner toggle** — `DRIFT_SCAN_INTERVAL_MS=0` now actually disables the drift scanner (previously reset to the 30s default).
-- **Safer folder sync** — unsynced-folder detection no longer treats a configured nest storage root as a sync candidate, preventing accidental duplication/removal of live nests when `NEST_STORAGE_ROOT` is nested under `DATA_ROOT`.
-
-Full history in [CHANGELOG.md](./CHANGELOG.md).
-
-## What's new in 1.3.0
-
-- **Server super-admins** — emails listed in `access.yaml: super_admins` administer every nest (change visibility, manage collaborators and stewards) without being added per-nest. Owner-only operations (delete, transfer) still require the nest owner. See [STEWARDSHIP.md](./STEWARDSHIP.md).
-- **License persistence under `DATA_ROOT`** — `PROMPTOWL_KEY` now writes to `$DATA_ROOT/.env` (was `$cwd/.env`, which is root-owned `/app` in the official Docker image and silently lost the key on container recreate). The License Setup Page also surfaces write failures instead of failing quietly. Override via `ENV_FILE_PATH`. See [CONFIGURATION.md](./CONFIGURATION.md).
-- **Case-insensitive email** across registration, login, invite, and access checks. Migration dedupes existing accounts that differ only in case; fixes "I can't log in because I capitalized my email" and access-guard / lockout mismatches.
-- **Document version history + inline diff** — every saved version is browsable in the document detail view, and an inline diff highlights what changed between any two versions.
-- **Nest Overview / index landing** — every nest opens on a grouped table-of-contents with a "recently edited" strip instead of a flat list.
-- **Public/private toggle on the nest header** — visibility is set directly from the header, not buried in a dialog.
-- **Review queue surfaces submitted-for-review edits** — reviewers see the pending versions a contributor staged, not just net-new documents.
-- **Internal-folder sync over MCP** — agents can list a nest's unsynced filesystem folders and pull them into the nest on demand. New `unsynced-service.ts` + MCP tools, covered by `test/unsynced-folder.test.ts` and `test/mcp-unsynced.test.ts`.
-- **Telemetry `batch_id` + user email** — usage events carry a stable `batch_id` (de-duped on the receiver) and the authenticated user email alongside the user id, so the PromptOwl ingest bridge can meter credits to the right account.
-- **Hyperlink navigation fix** — hyperlinks in the editor and viewer navigate to their configured target URL correctly.
-- **Repo / DX** — `CLAUDE.md` at the repo root with project-specific guidance for Claude Code; `claude.yml` (PR assistant) and `claude-code-review.yml` (auto review on PRs) GitHub Actions workflows.
-
-Full history in [CHANGELOG.md](./CHANGELOG.md).
-
-## What's new in 1.2.0
-
-- **Admin user management (no email server needed)** — `POST /auth/admin/reset-password/:userId` sets a user's password or returns a one-time temp password; `DELETE /auth/users/:userId` removes a user and revokes their API keys, sessions, and role rows. New self-service **Change password** in the user menu blocks reusing the current password.
-- **`PROMPTOWL_SIGN_IN_GATE`** — `open` / `admin-only` / `disabled` restricts "Sign in with PromptOwl" (admin reaches it via `?admin=1`). See [CONFIGURATION.md](./CONFIGURATION.md).
-- **Plain-text agent view** — `?format=markdown` on a node returns frontmatter + body as `text/markdown` for LLM-friendly consumption.
-- **Steward version revert** — `POST .../revert` restores an earlier version as a new one; pending-review docs are now editable (saving withdraws the review).
-- **Editor — always-editable surface** — Notion-style buttery headline, selection bubble toolbar (format-on-highlight), turn-into block conversion, Cmd+F find & replace, rich blocks (tables, callouts, toggles, syntax-highlighted code, columns), and wiki/code-safety fixes.
-- **Wiki usability** — backlinks panel ("Linked from N documents"), outline/TOC for 3+-heading docs, hover-preview on `[[wiki links]]`, multi-tag AND filtering with clickable chips, per-doc copy link, rename-safety warning for title-form links, link-health report (broken links + orphans), recently-edited strip.
-- **Sharing clarity** — share button reads "Share nest"; dialog clarifies nest-wide scope; deep links open documents directly.
-- **Security** — hardened scanner gate (PolinRider + Shai-Hulud preflight) in `bin/`.
-
-Full history in [CHANGELOG.md](./CHANGELOG.md).
-
-## What's new in 1.1.0
-
-- **Vault import** — import an existing folder of markdown files into a new nest in one step, from the dashboard ("Import folder") or via the API. Frontmatter, wiki links, and folder structure are preserved.
-- **Nest sharing + collaborators** — set per-nest visibility and add collaborators with read or write access. A Share affordance is now inline in the document view.
-- **Public read-only nests** — flip a nest to `visibility=public` to serve it to unauthenticated readers (bypasses auth for GETs only); writes still require a key.
-- **Custom logo / branding** — set `LOGO_URL` to show your own logo in the UI header and login screen. See [CONFIGURATION.md](./CONFIGURATION.md).
-- **Governance** — nest owners can self-approve their own changes; new per-nest auto-approve toggle; role-based action gating (buttons reflect the viewer's role); stewards can edit scope during a role change.
-- **Editor** — `[[wikilink]]` autocomplete, broken-link click creates a new doc with the title pre-filled, tag chips filter the nest list, Notion-style H1 title, click-to-edit, and an unsaved-changes warning.
-- **Stability** — added an error boundary so a render error in one view no longer blanks the whole app; bumped `uuid` to 14.
-
-Full history in [CHANGELOG.md](./CHANGELOG.md).
-
-## What's new in 1.0.1
-
-- **Document hashing pipeline** — external-edit detection, conflict-aware safe-publish, and inline version diffs powered by `@promptowl/contextnest-engine`. When a file is edited outside the UI, the editor shows an "External edit detected" banner with a side-by-side diff and an adopt / keep choice.
-- **Markdown rendering** — new `DocumentViewer` (react-markdown + remark-gfm + wikilink support) renders CLI/MCP-authored markdown correctly, with a view/edit toggle.
-- **License revocation now blocks writes synchronously** — revoke flips an in-process "writes blocked" flag immediately; the next write returns `503`.
-- **Dashboard stats** — new `GET /stats` endpoint surfaces nest / document / user counts.
-- **Docker fix** — Dockerfile now installs via npm against the shipped `package-lock.json`; base image bumped to `node:22-slim`.
-
-Full history in [CHANGELOG.md](./CHANGELOG.md).
+Release notes live in [CHANGELOG.md](./CHANGELOG.md).
 
 ## Licensing
 

package/dist/{chunk-3M7677XW.js → chunk-5QQ7WKAI.js}

@@ -12,6 +12,7 @@ import { join, dirname } from "path";
 import { existsSync } from "fs";
 import { fileURLToPath } from "url";
 import dotenv from "dotenv";
+import { z } from "zod";
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = dirname(__filename);
 var envCandidates = [
@@ -29,8 +30,9 @@ var slackUrlWarned = false;
 var emailFromWarned = false;
 var emailToWarned = false;
 var oidcIssuerWarned = false;
+var EMAIL_SCHEMA = z.email();
 function isEmailish(v) {
-  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v) && !/[\r\n]/.test(v);
+  return EMAIL_SCHEMA.safeParse(v.trim()).success && !/[\r\n]/.test(v);
 }
 function isEmailListish(v) {
   return v.split(",").every((e) => isEmailish(e.trim()));
@@ -494,6 +496,17 @@ var config = {
    */
   get MAX_BODY_BYTES() {
     return parseInt(process.env.MAX_BODY_BYTES || String(10 * 1024 * 1024), 10);
+  },
+  /**
+   * Max video upload size in bytes. Default 30 MB — kept under Cloud Run's
+   * 32 MiB HTTP/1 request-body limit so a too-big video is rejected cleanly by
+   * our own check (clear message) instead of a bare 413 from the platform.
+   * Raise via VIDEO_MAX_MB only when the deployment can actually accept it
+   * (e.g. not behind Cloud Run, or on HTTP/2 / direct-to-bucket upload).
+   */
+  get VIDEO_MAX_BYTES() {
+    const mb = parseInt(process.env.VIDEO_MAX_MB || "30", 10);
+    return (Number.isFinite(mb) && mb > 0 ? mb : 30) * 1024 * 1024;
   }
 };
 

package/dist/{chunk-JHIU6RZU.js → chunk-EG77SQHO.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-XQ46F76G.js";
 import {
   getDb
-} from "./chunk-3M7677XW.js";
+} from "./chunk-5QQ7WKAI.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
@@ -41,6 +41,38 @@ async function createVersion(params) {
     status: params.status
   };
 }
+async function upsertVersion(params) {
+  const db = getDb();
+  const contentHash = hashContent(params.content);
+  const sql = insertOrReplace(
+    db,
+    `INSERT INTO node_versions (nest_id, node_id, version, content_hash, author, status, change_note, tags_json)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+    ["nest_id", "node_id", "version"],
+    // Reset created_at on conflict too: SQLite's INSERT OR REPLACE deletes+
+    // reinserts (created_at → now), so mirror that on Postgres — otherwise a
+    // draft edited in place would keep its original (import-time) "edited at".
+    `content_hash = excluded.content_hash, author = excluded.author, status = excluded.status, change_note = excluded.change_note, tags_json = excluded.tags_json, created_at = ${nowExpr(db)}`
+  );
+  await db.run(sql, [
+    params.nestId,
+    params.nodeId,
+    params.version,
+    contentHash,
+    params.author,
+    params.status,
+    params.changeNote || null,
+    params.tags ? JSON.stringify(params.tags) : null
+  ]);
+  return {
+    version: params.version,
+    content: params.content,
+    editedBy: params.author,
+    editedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    changeNote: params.changeNote,
+    status: params.status
+  };
+}
 async function getVersions(nestId, nodeId) {
   const db = getDb();
   const rows = await db.all(
@@ -172,6 +204,7 @@ export {
   SYSTEM_AUTHOR_PREFIX,
   systemAuthor,
   createVersion,
+  upsertVersion,
   getVersions,
   getVersion,
   getCurrentVersion,

package/dist/{chunk-XB7T3THE.js → chunk-PAIP5KHB.js}

@@ -2,12 +2,12 @@ import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-ZMSU7BCC.js";
+} from "./chunk-ZQS5W45U.js";
 import {
   createVersion,
   getApprovedVersion,
   setApprovedVersion
-} from "./chunk-JHIU6RZU.js";
+} from "./chunk-EG77SQHO.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -18,7 +18,7 @@ import {
   isPublicReader,
   isStewardshipEnabled,
   resolveStewardsForNode
-} from "./chunk-F7EKYNXG.js";
+} from "./chunk-Q5NRCDD4.js";
 import {
   ConflictError,
   NotFoundError,
@@ -31,7 +31,7 @@ import {
 import {
   config,
   getDb
-} from "./chunk-3M7677XW.js";
+} from "./chunk-5QQ7WKAI.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid3 } from "uuid";
@@ -1226,6 +1226,13 @@ async function getReviewQueue(params) {
     whereClauses.push("nest_id = ?");
     args.push(params.nestId);
   }
+  if (params.nestIds) {
+    if (params.nestIds.length === 0) return { requests: [], total: 0 };
+    whereClauses.push(
+      `nest_id IN (${params.nestIds.map(() => "?").join(",")})`
+    );
+    args.push(...params.nestIds);
+  }
   if (params.status) {
     const statuses = Array.isArray(params.status) ? params.status : [params.status];
     whereClauses.push(
@@ -1234,10 +1241,12 @@ async function getReviewQueue(params) {
     args.push(...statuses);
   }
   const where = whereClauses.length > 0 ? `WHERE ${whereClauses.join(" AND ")}` : "";
-  const total = (await db.get(
-    `SELECT COUNT(*) as c FROM review_requests ${where}`,
-    args
-  )).c;
+  const total = Number(
+    (await db.get(
+      `SELECT COUNT(*) as c FROM review_requests ${where}`,
+      args
+    )).c
+  );
   const limit = params.limit || 50;
   const offset = params.offset || 0;
   const rows = await db.all(