@promptowl/contextnest-community 1.6.0 → 1.8.0

package/CONFIGURATION.md

@@ -66,6 +66,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
 | `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. |
 | `LOGO_URL` | _(unset)_ | Custom logo shown in the UI header + login screen. Must start with `https://`, `http://`, or `data:image/` — other schemes (`file://`, relative, `javascript:`) are rejected with a warning and the bundled icon is used. |
+| `SLACK_WEBHOOK_URL` | _(unset — connector off)_ | Slack incoming-webhook URL for governance-event notifications (review submitted/approved/rejected, collaborator added). `https://` only — the URL embeds a secret. Also editable from Settings in the UI. |
 
 ---
 

package/dist/{chunk-2TUMMVBG.js → chunk-PJTAUVD7.js}

@@ -3,7 +3,7 @@ import {
   getDb,
   insertOrReplace,
   nowExpr
-} from "./chunk-7V33Z6CS.js";
+} from "./chunk-PLAHCDQG.js";
 import {
   ANON_USER_ID
 } from "./chunk-SLTQACJW.js";
@@ -921,6 +921,15 @@ async function buildTitleMap(nestId) {
     return /* @__PURE__ */ new Map();
   }
 }
+function folderForNode(nodeId) {
+  return nodeId.replace(/^nodes\//, "").split("/").slice(0, -1).join("/");
+}
+async function describeNode(nestId, nodeId) {
+  const titles = await buildTitleMap(nestId);
+  const title = titles.get(nodeId) || nodeId;
+  const folder = folderForNode(nodeId);
+  return folder ? `${title} (in ${folder})` : title;
+}
 
 // src/shared/access.ts
 var PERMISSION_LEVELS = {
@@ -1007,7 +1016,6 @@ function collabPermToRole(permission) {
 var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
 var canViewWith = (roles) => roles.length > 0;
 var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
-var canManageWith = (roles) => includesAny(roles, ["owner", "admin"]);
 var PRECEDENCE = [
   "owner",
   "admin",
@@ -1352,9 +1360,10 @@ async function resolveUserRoles(nestId, userEmail, opts) {
   for (const role of stewardRoles) roles.add(role);
   return [...roles];
 }
-function canManageStewards(userEmail) {
+async function canManageStewards(nestId, userId) {
   if (config.AUTH_MODE === "open") return true;
-  return isLicenseAdminEmail(userEmail) || isSuperAdmin(userEmail);
+  const perm = await resolveNestPermission(nestId, userId);
+  return perm === "owner" || perm === "admin";
 }
 async function canCreateInNest(nestId, userEmail) {
   if (config.AUTH_MODE === "open" || isSuperAdmin(userEmail)) return true;
@@ -1580,7 +1589,8 @@ export {
   deleteNest,
   engineCache,
   buildTitleMap,
-  canManageWith,
+  describeNode,
+  collabPermToRole,
   assignSteward,
   removeSteward,
   updateSteward,

package/dist/{chunk-7V33Z6CS.js → chunk-PLAHCDQG.js}

@@ -20,6 +20,7 @@ if (envFileLoaded && !isTestRun) {
 }
 var canonicalEnvFile = process.env.ENV_FILE_PATH || join(dataRoot(), ".env");
 var canonicalEnvLoaded = null;
+var slackUrlWarned = false;
 if (!isTestRun && canonicalEnvFile !== envFileLoaded && existsSync(canonicalEnvFile)) {
   dotenv.config({ path: canonicalEnvFile, override: true });
   canonicalEnvLoaded = canonicalEnvFile;
@@ -189,6 +190,26 @@ var config = {
   get AUTH_MODE() {
     return process.env.AUTH_MODE || "key";
   },
+  /**
+   * Optional Slack incoming-webhook URL for team notifications (review
+   * submitted/approved/rejected, nest shared). Empty/unset = connector off.
+   * https only — a webhook carries an implicit secret in its path, so it
+   * never travels plaintext.
+   */
+  get SLACK_WEBHOOK_URL() {
+    const raw = process.env.SLACK_WEBHOOK_URL?.trim();
+    if (!raw) return null;
+    if (!/^https:\/\//i.test(raw)) {
+      if (!slackUrlWarned) {
+        slackUrlWarned = true;
+        console.warn(
+          "[config] SLACK_WEBHOOK_URL rejected: must be an https:// URL. Slack notifications disabled."
+        );
+      }
+      return null;
+    }
+    return raw;
+  },
   /**
    * CORS origin allowlist. Comma-separated list of origins or "*".
    * Defaults to "*" in open mode (read-heavy, no credentials to steal)
@@ -764,6 +785,168 @@ function runMigrations(db) {
     })();
     recordMigration("011_comments");
   }
+  if (!hasMigration("012_merge_case_colliding_users")) {
+    db.transaction(() => {
+      const { groups, merged } = mergeCaseCollidingUsers(db);
+      if (merged > 0) {
+        console.warn(
+          `[migration 012] merged ${merged} duplicate user row(s) across ${groups} case-collision group(s).`
+        );
+      }
+      db.exec(
+        "UPDATE users SET email = LOWER(email) WHERE email <> LOWER(email)"
+      );
+      db.exec(
+        "CREATE UNIQUE INDEX IF NOT EXISTS idx_users_email_nocase ON users(email COLLATE NOCASE)"
+      );
+    })();
+    recordMigration("012_merge_case_colliding_users");
+  }
+  if (!hasMigration("013_node_deletion_tombstones")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS node_deletions (
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          deleted_by TEXT,
+          deleted_at TEXT NOT NULL,
+          PRIMARY KEY (nest_id, node_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_node_deletions_time
+          ON node_deletions(nest_id, deleted_at);
+      `);
+    })();
+    recordMigration("013_node_deletion_tombstones");
+  }
+  if (!hasMigration("014_api_events")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS api_events (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts TEXT NOT NULL,
+          kind TEXT NOT NULL CHECK(kind IN ('api', 'mcp')),
+          method TEXT,                 -- HTTP method (api rows)
+          path TEXT,                   -- request path (api rows)
+          tool TEXT,                   -- tool name (mcp rows)
+          nest_id TEXT,
+          user_id TEXT,
+          user_email TEXT,
+          status INTEGER,              -- HTTP status (api rows)
+          duration_ms INTEGER
+        );
+        CREATE INDEX IF NOT EXISTS idx_api_events_ts ON api_events(ts);
+      `);
+    })();
+    recordMigration("014_api_events");
+  }
+}
+function mergeCaseCollidingUsers(db) {
+  const groups = db.prepare(
+    `SELECT LOWER(email) AS le
+         FROM users
+        WHERE id != ?
+        GROUP BY LOWER(email)
+       HAVING COUNT(*) > 1`
+  ).all(ANON_USER_ID);
+  const emailCols = [
+    ["annotation_threads", "created_by"],
+    ["annotation_threads", "resolved_by"],
+    ["annotation_comments", "author"],
+    ["review_requests", "requested_by"],
+    ["review_requests", "resolved_by"],
+    ["node_versions", "author"],
+    ["approved_versions", "approved_by"],
+    ["comments", "author"],
+    ["comments", "resolved_by"],
+    ["license_cache", "owner_email"],
+    ["stewards", "assigned_by"]
+  ];
+  let merged = 0;
+  for (const { le } of groups) {
+    const rows = db.prepare(
+      `SELECT u.id, u.email, u.is_invited, u.is_admin, u.name, u.created_at,
+                (SELECT COUNT(*) FROM api_keys k WHERE k.user_id = u.id) AS keys,
+                (SELECT COUNT(*) FROM sessions s WHERE s.user_id = u.id) AS sessions
+           FROM users u
+          WHERE LOWER(u.email) = ? AND u.id != ?`
+    ).all(le, ANON_USER_ID);
+    if (rows.length < 2) continue;
+    rows.sort((a, b) => {
+      if (a.is_invited !== b.is_invited) return a.is_invited - b.is_invited;
+      const aCred = a.keys + a.sessions > 0 ? 1 : 0;
+      const bCred = b.keys + b.sessions > 0 ? 1 : 0;
+      if (aCred !== bCred) return bCred - aCred;
+      return b.created_at.localeCompare(a.created_at);
+    });
+    const winner = rows[0];
+    const losers = rows.slice(1);
+    const anyAdmin = rows.some((r) => r.is_admin) ? 1 : 0;
+    const winnerName = winner.name ?? rows.find((r) => r.name)?.name ?? null;
+    for (const loser of losers) {
+      const w = winner.id;
+      const l = loser.id;
+      const loserLower = loser.email.toLowerCase();
+      db.prepare("UPDATE sessions SET user_id = ? WHERE user_id = ?").run(w, l);
+      db.prepare(
+        "UPDATE nest_collaborators SET granted_by = ? WHERE granted_by = ?"
+      ).run(w, l);
+      db.prepare("UPDATE stewards SET user_id = ? WHERE user_id = ?").run(w, l);
+      db.prepare(
+        `UPDATE nests SET user_id = ?
+           WHERE user_id = ?
+             AND slug NOT IN (SELECT slug FROM nests WHERE user_id = ?)`
+      ).run(w, l, w);
+      db.prepare(
+        `UPDATE nests
+            SET slug = slug || '-merged-' || substr(id, 1, 8), user_id = ?
+          WHERE user_id = ?`
+      ).run(w, l);
+      db.prepare(
+        `DELETE FROM api_keys
+           WHERE user_id = ?
+             AND EXISTS (SELECT 1 FROM api_keys WHERE user_id = ?)`
+      ).run(l, w);
+      db.prepare("UPDATE api_keys SET user_id = ? WHERE user_id = ?").run(w, l);
+      db.prepare(
+        `DELETE FROM nest_collaborators
+           WHERE user_id = ?
+             AND nest_id IN (SELECT nest_id FROM nest_collaborators WHERE user_id = ?)`
+      ).run(l, w);
+      db.prepare(
+        "UPDATE nest_collaborators SET user_id = ? WHERE user_id = ?"
+      ).run(w, l);
+      db.prepare(
+        `DELETE FROM nest_collaborators
+           WHERE user_id = ?
+             AND nest_id IN (SELECT id FROM nests WHERE user_id = ?)`
+      ).run(w, w);
+      for (const [table, col] of emailCols) {
+        db.prepare(
+          `UPDATE ${table} SET ${col} = ? WHERE LOWER(${col}) = ?`
+        ).run(le, loserLower);
+      }
+      db.prepare(
+        `DELETE FROM stewards
+           WHERE is_active = 1
+             AND LOWER(user_email) = ?
+             AND id NOT IN (
+               SELECT MIN(id) FROM stewards
+                WHERE is_active = 1 AND LOWER(user_email) = ?
+                GROUP BY nest_id, scope,
+                         IFNULL(node_pattern, ''), IFNULL(tag_name, '')
+             )`
+      ).run(le, le);
+      db.prepare(
+        "UPDATE stewards SET user_email = ?, user_id = ? WHERE LOWER(user_email) = ?"
+      ).run(le, w, le);
+      db.prepare("DELETE FROM users WHERE id = ?").run(l);
+      merged++;
+    }
+    db.prepare(
+      "UPDATE users SET email = ?, is_admin = ?, name = ? WHERE id = ?"
+    ).run(le, anyAdmin, winnerName, winner.id);
+  }
+  return { groups: groups.length, merged };
 }
 
 // src/db/adapter.sqlite.ts
@@ -873,7 +1056,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-YOODX2BI.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-NVJAGBSF.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-VCG45LMK.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);

package/dist/{chunk-T5L4LYU4.js → chunk-XNGOO6RI.js}

@@ -2,7 +2,7 @@ import {
   getDb,
   insertOrReplace,
   nowExpr
-} from "./chunk-7V33Z6CS.js";
+} from "./chunk-PLAHCDQG.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";

package/dist/{chunk-MZGFKBOK.js → chunk-Z3Y46ZGU.js}

@@ -1,22 +1,68 @@
 import {
   createVersion,
   setApprovedVersion
-} from "./chunk-T5L4LYU4.js";
+} from "./chunk-XNGOO6RI.js";
 import {
   buildTitleMap,
   canUserApprove,
+  describeNode,
   engineCache,
   resolveStewardsForNode
-} from "./chunk-2TUMMVBG.js";
+} from "./chunk-PJTAUVD7.js";
 import {
+  config,
   getDb,
   insertOrReplace,
   nowExpr
-} from "./chunk-7V33Z6CS.js";
+} from "./chunk-PLAHCDQG.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid } from "uuid";
 
+// src/notify/slack.ts
+var warnedOnce = false;
+async function notifySlackForNest(nestId, message) {
+  if (!config.SLACK_WEBHOOK_URL) return;
+  let nestName = nestId;
+  try {
+    const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
+      nestId
+    ]);
+    if (row?.name) nestName = row.name;
+  } catch {
+  }
+  return notifySlack(`*[${nestName}]* ${message}`);
+}
+function escapeMrkdwn(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+async function notifySlack(text) {
+  const url = config.SLACK_WEBHOOK_URL;
+  if (!url) return;
+  try {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 3e3);
+    try {
+      await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ text: escapeMrkdwn(text) }),
+        signal: ctrl.signal
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch (err) {
+    if (!warnedOnce) {
+      warnedOnce = true;
+      console.warn(
+        "[slack] notification failed (suppressing further warnings):",
+        err instanceof Error ? err.message : err
+      );
+    }
+  }
+}
+
 // src/governance/safe-publish.ts
 import {
   publishDocument,
@@ -73,6 +119,10 @@ async function submitForReview(params) {
     "UPDATE node_versions SET status = 'pending_review' WHERE nest_id = ? AND node_id = ? AND version = ?",
     [params.nestId, params.nodeId, params.version]
   );
+  void notifySlackForNest(
+    params.nestId,
+    `:memo: Review requested on *${await describeNode(params.nestId, params.nodeId)}* (v${params.version}) by ${params.requestedBy}${params.note ? ` \u2014 "${params.note}"` : ""}`
+  );
   return await getReviewRequest(id);
 }
 async function approve(params) {
@@ -148,6 +198,10 @@ async function approve(params) {
       err
     );
   }
+  void notifySlackForNest(
+    params.nestId,
+    `:white_check_mark: *${await describeNode(params.nestId, params.nodeId)}* v${params.version} approved by ${params.approvedBy}`
+  );
   return await getReviewRequest(pending.id);
 }
 async function reject(params) {
@@ -177,6 +231,10 @@ async function reject(params) {
     "UPDATE node_versions SET status = 'rejected' WHERE nest_id = ? AND node_id = ? AND version = ?",
     [params.nestId, params.nodeId, params.version]
   );
+  void notifySlackForNest(
+    params.nestId,
+    `:x: *${await describeNode(params.nestId, params.nodeId)}* v${params.version} rejected by ${params.rejectedBy} \u2014 "${params.note}"`
+  );
   return await getReviewRequest(pending.id);
 }
 async function cancelReview(params) {
@@ -293,6 +351,7 @@ function rowToReviewRequest(row) {
 
 export {
   safePublishDocument,
+  notifySlackForNest,
   submitForReview,
   approve,
   reject,