@remnic/core 9.69.33 → 9.69.34

package/src/activity/journal-read.test.ts

@@ -0,0 +1,242 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { readJournalForDate } from "./journal-read.js";
+import type { ActivityTimelineVaultConfig } from "./types.js";
+
+const START = "<!-- remnic:timeline:start -->";
+const END = "<!-- remnic:timeline:end -->";
+
+function makeVault(): string {
+  return mkdtempSync(path.join(tmpdir(), "remnic-journal-read-"));
+}
+
+function vaultConfig(vaultPath: string, overrides: Partial<ActivityTimelineVaultConfig> = {}): ActivityTimelineVaultConfig {
+  return {
+    enabled: true,
+    vaultPath,
+    dailyNotePath: "{yyyy}-{MM}-{dd}.md",
+    weeklyNotePath: "",
+    createMissingNotes: false,
+    noteTemplate: "",
+    sectionStrategy: "markers",
+    publish: {
+      timeline: { enabled: true, target: "daily", section: "Timeline" },
+      standup: { enabled: false, target: "daily", section: "Standup" },
+      weekly: { enabled: false, target: "weekly", section: "Weekly Review" },
+      locations: { enabled: false, target: "daily", section: "Locations" },
+    },
+    insertUnderHeading: "",
+    readback: { journalSection: "Journal" },
+    wikilinks: { places: false, placesFolder: "Places" },
+    properties: { mode: "off", prefix: "remnic_" },
+    autoPublish: true,
+    ...overrides,
+  };
+}
+
+test("resolves the note through the #1985 template resolver and returns provenance", () => {
+  const vault = makeVault();
+  try {
+    writeFileSync(
+      path.join(vault, "2026-08-20.md"),
+      ["## Journal", "user text", "## Other", ""].join("\n"),
+    );
+    const result = readJournalForDate({ vault: vaultConfig(vault), date: "2026-08-20" });
+    assert.equal(result.ok, true);
+    assert.ok(result.ok && result.exists);
+    assert.equal(result.filePath, path.join(vault, "2026-08-20.md"));
+    assert.equal(result.heading, "Journal");
+    assert.equal(result.text, "user text");
+  } finally {
+    rmSync(vault, { recursive: true, force: true });
+  }
+});
+
+test("every template layout the resolver supports works unchanged", () => {
+  const vault = makeVault();
+  try {
+    mkdirSync(path.join(vault, "days"), { recursive: true });
+    writeFileSync(path.join(vault, "days", "20.md"), ["## Journal", "nested", ""].join("\n"));
+    const result = readJournalForDate({
+      vault: vaultConfig(vault, { dailyNotePath: "days/{dd}.md" }),
+      date: "2026-08-20",
+    });
+    assert.ok(result.ok && result.exists);
+    assert.equal(result.text, "nested");
+  } finally {
+    rmSync(vault, { recursive: true, force: true });
+  }
+});
+
+test("missing note is a no-journal day, not an error, with the resolved path", () => {
+  const vault = makeVault();
+  try {
+    const result = readJournalForDate({ vault: vaultConfig(vault), date: "2026-08-20" });
+    assert.deepEqual(result, {
+      ok: true,
+      exists: false,
+      reason: "missing_file",
+      filePath: path.join(vault, "2026-08-20.md"),
+    });
+  } finally {
+    rmSync(vault, { recursive: true, force: true });
+  }
+});
+
+test("missing vault root is a no-journal day", () => {
+  const result = readJournalForDate({
+    vault: vaultConfig(path.join(tmpdir(), "remnic-journal-read-absent-root")),
+    date: "2026-08-20",
+  });
+  assert.ok(result.ok && !result.exists);
+});
+
+test("missing section is distinct from a missing note", () => {
+  const vault = makeVault();
+  try {
+    writeFileSync(path.join(vault, "2026-08-20.md"), "## Notes\nonly notes\n");
+    const result = readJournalForDate({ vault: vaultConfig(vault), date: "2026-08-20" });
+    assert.deepEqual(result, {
+      ok: true,
+      exists: false,
+      reason: "missing_heading",
+      filePath: path.join(vault, "2026-08-20.md"),
+    });
+  } finally {
+    rmSync(vault, { recursive: true, force: true });
+  }
+});
+
+test("duplicate headings refuse with line numbers", () => {
+  const vault = makeVault();
+  try {
+    writeFileSync(
+      path.join(vault, "2026-08-20.md"),
+      ["## Journal", "one", "## Notes", "## Journal", "two", ""].join("\n"),
+    );
+    const result = readJournalForDate({ vault: vaultConfig(vault), date: "2026-08-20" });
+    assert.ok(!result.ok);
+    assert.ok(result.reason === "duplicate_heading");
+    assert.deepEqual(result.lines, [1, 4]);
+  } finally {
+    rmSync(vault, { recursive: true, force: true });
+  }
+});
+
+test("non-ASCII heading resolves and extracts identically to ASCII", () => {
+  const vault = makeVault();
+  try {
+    writeFileSync(
+      path.join(vault, "2026-08-20.md"),
+      ["## Tagebuch 📝", "Heute ruhig.", "## Andere", ""].join("\n"),
+    );
+    const result = readJournalForDate({
+      vault: vaultConfig(vault, { readback: { journalSection: "Tagebuch 📝" } }),
+      date: "2026-08-20",
+    });
+    assert.ok(result.ok && result.exists);
+    assert.equal(result.heading, "Tagebuch 📝");
+    assert.equal(result.text, "Heute ruhig.");
+  } finally {
+    rmSync(vault, { recursive: true, force: true });
+  }
+});
+
+test("embedded remnic regions are stripped before the text is returned", () => {
+  const vault = makeVault();
+  try {
+    writeFileSync(
+      path.join(vault, "2026-08-20.md"),
+      ["## Journal", "I walked.", START, "card", END, "Still thinking.", ""].join("\n"),
+    );
+    const result = readJournalForDate({ vault: vaultConfig(vault), date: "2026-08-20" });
+    assert.ok(result.ok && result.exists);
+    assert.match(result.text, /I walked\./);
+    assert.match(result.text, /Still thinking\./);
+    assert.doesNotMatch(result.text, /card/);
+    assert.doesNotMatch(result.text, /remnic:/);
+  } finally {
+    rmSync(vault, { recursive: true, force: true });
+  }
+});
+
+test("heading-strategy publisher sections nested inside the journal section are stripped", () => {
+  const vault = makeVault();
+  try {
+    writeFileSync(
+      path.join(vault, "2026-08-20.md"),
+      ["## Journal", "mine", "### Timeline", "published", "## After", ""].join("\n"),
+    );
+    const markers = readJournalForDate({
+      vault: vaultConfig(vault),
+      date: "2026-08-20",
+    });
+    assert.ok(markers.ok && markers.exists);
+    assert.equal(markers.text, "mine\n### Timeline\npublished");
+
+    const heading = readJournalForDate({
+      vault: vaultConfig(vault, { sectionStrategy: "heading" }),
+      date: "2026-08-20",
+    });
+    assert.ok(heading.ok && heading.exists);
+    assert.equal(heading.text, "mine");
+  } finally {
+    rmSync(vault, { recursive: true, force: true });
+  }
+});
+
+test("reads exactly one file per call — the note is read once", () => {
+  const vault = makeVault();
+  try {
+    const notePath = path.join(vault, "2026-08-20.md");
+    writeFileSync(notePath, "## Journal\nuser\n");
+    const before = readFileSync(notePath, "utf8");
+    const result = readJournalForDate({ vault: vaultConfig(vault), date: "2026-08-20" });
+    assert.ok(result.ok && result.exists);
+    // Snapshot semantics: the note is untouched by reads.
+    assert.equal(readFileSync(notePath, "utf8"), before);
+  } finally {
+    rmSync(vault, { recursive: true, force: true });
+  }
+});
+
+test("refuses a daily note that is a symlink", () => {
+  const vault = makeVault();
+  const outside = makeVault();
+  try {
+    writeFileSync(path.join(outside, "escaped.md"), "## Journal\nstolen\n");
+    symlinkSync(path.join(outside, "escaped.md"), path.join(vault, "2026-08-20.md"));
+    const result = readJournalForDate({ vault: vaultConfig(vault), date: "2026-08-20" });
+    assert.equal(result.ok, false);
+    assert.equal(result.ok === false ? result.reason : "", "symlink_escape");
+  } finally {
+    rmSync(vault, { recursive: true, force: true });
+    rmSync(outside, { recursive: true, force: true });
+  }
+});
+
+test("refuses an ancestor directory swapped for a symlink out of the vault", () => {
+  const vault = makeVault();
+  const outside = makeVault();
+  try {
+    const nested = path.join(vault, "days");
+    mkdirSync(nested);
+    writeFileSync(path.join(nested, "2026-08-20.md"), "## Journal\nmine\n");
+    writeFileSync(path.join(outside, "2026-08-20.md"), "## Journal\nstolen\n");
+    rmSync(nested, { recursive: true, force: true });
+    symlinkSync(outside, nested);
+    const result = readJournalForDate({
+      vault: vaultConfig(vault, { dailyNotePath: "days/{yyyy}-{MM}-{dd}.md" }),
+      date: "2026-08-20",
+    });
+    assert.equal(result.ok, false);
+    assert.equal(result.ok === false ? result.reason : "", "symlink_escape");
+  } finally {
+    rmSync(vault, { recursive: true, force: true });
+    rmSync(outside, { recursive: true, force: true });
+  }
+});

package/src/activity/journal-read.ts

@@ -0,0 +1,183 @@
+/**
+ * Filesystem readJournal(D) for the vault daily-note journal (issue #1987).
+ *
+ * Reuses the #1985 template resolver (every layout #1985 can resolve works
+ * here — no separate path configuration) and the #1985 containment
+ * discipline: symlinked vault roots and notes that escape the vault are
+ * refused before any byte is read. Exactly ONE readFile per call; a
+ * missing note is a legitimate no-journal day, not an error (§22).
+ */
+import { closeSync, constants as fsConstants, fstatSync, lstatSync, openSync, readFileSync, realpathSync, statSync } from "node:fs";
+import path from "node:path";
+
+import { expandTildePath } from "../utils/path.js";
+import { readVaultJournal } from "./journal-vault-read.js";
+import type { ActivityTimelineVaultConfig } from "./types.js";
+import { resolveVaultNotePath } from "./vault-path.js";
+
+export type ReadJournalResult =
+  | { ok: true; exists: false; reason: "missing_file" | "missing_heading"; filePath: string }
+  | {
+      ok: true;
+      exists: true;
+      text: string;
+      heading: string;
+      warnings: readonly string[];
+      filePath: string;
+    }
+  | { ok: false; reason: "duplicate_heading"; lines: readonly number[]; filePath: string }
+  | { ok: false; reason: "not_directory" | "path_escape" | "symlink_escape"; filePath: string };
+
+/** Publisher-owned daily-note heading sections that must never count as journal text. */
+export function publisherOwnedSectionNames(vault: ActivityTimelineVaultConfig): string[] {
+  if (vault.sectionStrategy !== "heading") return [];
+  const names: string[] = [];
+  for (const target of Object.values(vault.publish)) {
+    if (target.enabled && target.target === "daily" && target.section.trim().length > 0) {
+      names.push(target.section);
+    }
+  }
+  return names;
+}
+
+export function readJournalForDate(input: {
+  vault: ActivityTimelineVaultConfig;
+  date: string;
+  timezone?: string;
+}): ReadJournalResult {
+  const journalSection = input.vault.readback.journalSection;
+  const relative = resolveVaultNotePath(input.vault.dailyNotePath, input.date, {
+    timezone: input.timezone,
+  });
+  const root = path.resolve(expandTildePath(input.vault.vaultPath));
+  const filePath = path.join(root, relative);
+
+  try {
+    const rootStat = lstatSync(root);
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+      return { ok: false, reason: "not_directory", filePath };
+    }
+  } catch {
+    // The vault root itself is missing: no note can exist, so this is a
+    // no-journal day, not a configuration error.
+    return { ok: true, exists: false, reason: "missing_file", filePath };
+  }
+
+  const lexical = path.relative(root, filePath);
+  if (
+    lexical.length === 0 ||
+    lexical === ".." ||
+    lexical.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(lexical)
+  ) {
+    return { ok: false, reason: "path_escape", filePath };
+  }
+  if (!containedBySymlinks(root, filePath)) {
+    return { ok: false, reason: "symlink_escape", filePath };
+  }
+
+  // One read of a no-follow fd. Ancestor/note symlink swaps cannot redirect
+  // the bytes: the path is verified, then the same fd is read once.
+  let fileText: string;
+  try {
+    fileText = readVerifiedDailyNote(root, filePath);
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code === "ENOENT") {
+      return { ok: true, exists: false, reason: "missing_file", filePath };
+    }
+    if (code === "ELOOP" || code === "EISDIR") {
+      return { ok: false, reason: "symlink_escape", filePath };
+    }
+    throw err;
+  }
+
+  const result = readVaultJournal({
+    fileText,
+    journalSection,
+    publishSectionNames: publisherOwnedSectionNames(input.vault),
+  });
+  return { ...result, filePath };
+}
+
+/**
+ * Containment under symlinks (mirrors the #1985 publisher helper): the
+ * deepest existing ancestor of the note must still resolve inside the
+ * real vault root. A symlink chain that leaves the vault is refused
+ * before any note byte is read.
+ */
+function containedBySymlinks(root: string, dest: string): boolean {
+  const realRoot = realpathSync(root);
+  let probe = dest;
+  for (;;) {
+    try {
+      if (statSync(probe).isFile() || statSync(probe).isDirectory()) {
+        const real = realpathSync(probe);
+        return real === realRoot || real.startsWith(`${realRoot}${path.sep}`);
+      }
+    } catch {
+      // ENOENT: walk up to the parent.
+    }
+    const parent = path.dirname(probe);
+    if (parent === probe) return false;
+    probe = parent;
+  }
+}
+
+function symlinkRejected(): NodeJS.ErrnoException {
+  const err = new Error("symlink refused") as NodeJS.ErrnoException;
+  err.code = "ELOOP";
+  return err;
+}
+
+/**
+ * Open the verified daily note with O_NOFOLLOW, fstat a regular file whose
+ * identity still matches the path, then read that same fd once. Any symlink
+ * in the root→note chain is refused.
+ */
+function readVerifiedDailyNote(root: string, filePath: string): string {
+  const relative = path.relative(root, filePath);
+  const parts = relative.split(path.sep).filter((part) => part.length > 0 && part !== ".");
+  let cursor = root;
+  for (const part of parts) {
+    cursor = path.join(cursor, part);
+    const st = lstatSync(cursor);
+    if (st.isSymbolicLink()) throw symlinkRejected();
+  }
+
+  const parent = path.dirname(filePath);
+  const parentLstat = lstatSync(parent);
+  if (parentLstat.isSymbolicLink() || !parentLstat.isDirectory()) throw symlinkRejected();
+  const nofollow = fsConstants.O_NOFOLLOW ?? 0;
+  const parentFd = openSync(parent, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | nofollow);
+  try {
+    const parentFstat = fstatSync(parentFd);
+    if (parentFstat.ino !== parentLstat.ino || parentFstat.dev !== parentLstat.dev) {
+      throw symlinkRejected();
+    }
+  } finally {
+    closeSync(parentFd);
+  }
+
+  const fd = openSync(filePath, fsConstants.O_RDONLY | nofollow);
+  try {
+    const opened = fstatSync(fd);
+    if (!opened.isFile()) throw symlinkRejected();
+    const pathLstat = lstatSync(filePath);
+    if (pathLstat.isSymbolicLink() || pathLstat.ino !== opened.ino || pathLstat.dev !== opened.dev) {
+      throw symlinkRejected();
+    }
+    try {
+      const fdPath = realpathSync(`/proc/self/fd/${fd}`);
+      const realRoot = realpathSync(root);
+      if (fdPath !== realRoot && !fdPath.startsWith(`${realRoot}${path.sep}`)) {
+        throw symlinkRejected();
+      }
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code === "ELOOP") throw err;
+    }
+    return readFileSync(fd, "utf8");
+  } finally {
+    closeSync(fd);
+  }
+}

package/src/activity/journal-source.test.ts

@@ -3,34 +3,34 @@ import test from "node:test";
 
 import { resolveJournalSource } from "./journal-source.js";
 
-test("source file resolves to file mode", () => {
-  assert.deepEqual(resolveJournalSource({ source: "file", heading: "" }), {
+test("source memoryDir resolves to memoryDir mode", () => {
+  assert.deepEqual(resolveJournalSource({ source: "memoryDir" }), {
     ok: true,
-    mode: "file",
+    mode: "memoryDir",
   });
 });
 
-test("source vault with a heading resolves to vault mode", () => {
-  assert.deepEqual(resolveJournalSource({ source: "vault", heading: "Journal" }), {
+test("source vault resolves to vault mode", () => {
+  assert.deepEqual(resolveJournalSource({ source: "vault" }), {
     ok: true,
     mode: "vault",
-    heading: "Journal",
   });
 });
 
-test("source vault with an empty heading is missing_heading", () => {
-  assert.deepEqual(resolveJournalSource({ source: "vault", heading: "" }), {
-    ok: false,
-    error: "missing_heading",
-  });
-  assert.deepEqual(resolveJournalSource({ source: "vault", heading: "   " }), {
-    ok: false,
-    error: "missing_heading",
+test("legacy source file aliases memoryDir", () => {
+  assert.deepEqual(resolveJournalSource({ source: "file" }), {
+    ok: true,
+    mode: "memoryDir",
+    deprecatedAlias: "file",
   });
 });
 
 test("unknown source is unknown_source", () => {
-  assert.deepEqual(resolveJournalSource({ source: "memoryDir", heading: "Journal" }), {
+  assert.deepEqual(resolveJournalSource({ source: "" }), {
+    ok: false,
+    error: "unknown_source",
+  });
+  assert.deepEqual(resolveJournalSource({ source: "disk" }), {
     ok: false,
     error: "unknown_source",
   });

package/src/activity/journal-source.ts

@@ -1,23 +1,30 @@
 /**
- * Resolve journal source mode (issue #1987 leftover).
+ * Resolve journal source mode (issue #1987).
  *
- * Pure. File mode ignores heading. Vault mode needs a non-empty heading.
+ * Pure. `memoryDir` mode reads `<memoryDir>/journal/<date>.md` (#1984
+ * behavior, the default); `vault` mode reads the configured section of
+ * the vault daily note. The heading is NOT resolved here — vault
+ * prerequisites (vault.enabled, dailyNotePath, readback.journalSection)
+ * are checked by journal-vault-prereq.ts at config parse time.
+ *
+ * Legacy `source: "file"` is accepted as an alias of `memoryDir` and
+ * flagged so config parse can emit a deprecation warning.
  */
 
+export type JournalSource = "memoryDir" | "vault";
+
+const JOURNAL_SOURCES: readonly JournalSource[] = ["memoryDir", "vault"];
+
 export type JournalSourceResult =
-  | { ok: true; mode: "file" }
-  | { ok: true; mode: "vault"; heading: string }
-  | { ok: false; error: "missing_heading" | "unknown_source" };
+  | { ok: true; mode: JournalSource; deprecatedAlias?: "file" }
+  | { ok: false; error: "unknown_source" };
 
-export function resolveJournalSource(input: {
-  source: string;
-  heading: string;
-}): JournalSourceResult {
-  if (input.source === "file") return { ok: true, mode: "file" };
-  if (input.source === "vault") {
-    const heading = input.heading.trim();
-    if (heading.length === 0) return { ok: false, error: "missing_heading" };
-    return { ok: true, mode: "vault", heading };
+export function resolveJournalSource(input: { source: string }): JournalSourceResult {
+  if (input.source === "file") {
+    return { ok: true, mode: "memoryDir", deprecatedAlias: "file" };
+  }
+  if ((JOURNAL_SOURCES as readonly string[]).includes(input.source)) {
+    return { ok: true, mode: input.source as JournalSource };
   }
   return { ok: false, error: "unknown_source" };
 }

package/src/activity/journal-state.lock-worker.ts

@@ -0,0 +1,30 @@
+/**
+ * Cross-process helper for journal date-lock tests. Spawned as a child:
+ * reread hash → optional candidate marker → commit, all under withJournalDateLock.
+ */
+import { appendFileSync } from "node:fs";
+
+import {
+  commitJournalHash,
+  hashJournalText,
+  journalUnchanged,
+  readTimelineState,
+  withJournalDateLock,
+} from "./journal-state.js";
+
+const memoryDir = process.env.JOURNAL_LOCK_DIR;
+const date = process.env.JOURNAL_LOCK_DATE;
+const text = process.env.JOURNAL_LOCK_TEXT;
+const marker = process.env.JOURNAL_LOCK_MARKER;
+
+if (!memoryDir || !date || !text || !marker) {
+  throw new Error("journal lock worker missing JOURNAL_LOCK_* env");
+}
+
+await withJournalDateLock(memoryDir, date, async () => {
+  const state = readTimelineState(memoryDir);
+  if (journalUnchanged(state, date, text)) return;
+  await new Promise((resolve) => setTimeout(resolve, 80));
+  appendFileSync(marker, "1");
+  await commitJournalHash(memoryDir, date, hashJournalText(text));
+});