@tequila99/githuman 0.8.0 → 0.9.0

package/dist/server/services/notes-identity.service.js

@@ -1,3 +1,5 @@
+import PQueue from 'p-queue';
+import { noteBasename, noteChildPath, noteParentPath } from "../../shared/notes/note-path.js";
 import { lstat } from 'node:fs/promises';
 import { isSystemError } from "../utils/system-error.js";
 import { randomUUID } from 'node:crypto';
@@ -13,6 +15,8 @@ import { sha256Hex } from "../utils/hash.js";
 import { safeDecodeURIComponent } from "../../shared/utils/safe-decode.js";
 // A second complete scan confirms absence, instead of treating an atomic save as deletion.
 const ABSENCE_GRACE_MS = 2500;
+// Longest file name that common file systems accept, in bytes.
+const MAX_FILENAME_BYTES = 255;
 function newRecord(id, path, version) {
     const now = new Date().toISOString();
     return {
@@ -22,6 +26,7 @@ function newRecord(id, path, version) {
         presence: 'present',
         createdAt: now,
         updatedAt: now,
+        deletedAt: null,
         redirectId: null
     };
 }
@@ -35,11 +40,26 @@ function portablePath(path) {
         }
     }
 }
+/**
+ * Path a deleted note moves to. The suffix frees the original name for a new
+ * note. The stem is cut by bytes so the name fits the file system limit.
+ */
+function deletedNotePath(path, uuid) {
+    const suffix = `_deleted_${uuid}.md`;
+    const stem = noteBasename(path).replace(/\.md$/i, '');
+    const room = MAX_FILENAME_BYTES - Buffer.byteLength(suffix);
+    let cut = stem;
+    while (Buffer.byteLength(cut) > room) {
+        cut = cut.slice(0, -1);
+    }
+    return noteChildPath(noteParentPath(path), cut + suffix);
+}
 export class NotesIdentityService {
     catalog;
     writer;
     operations;
-    queue = Promise.resolve();
+    // One action at a time: catalog and file changes must not interleave.
+    queue = new PQueue({ concurrency: 1 });
     cache = new Map();
     absentSince = new Map();
     // Signature of each file that failed to read, so a poll does not read it again.
@@ -72,19 +92,15 @@ export class NotesIdentityService {
         });
     }
     run(action) {
-        const next = this.queue
-            .catch(() => { })
-            .then(async () => {
+        return this.queue.add(async () => {
             if (this.closed)
                 throw new BadRequestError('Notes storage is closing.');
             return action();
         });
-        this.queue = next;
-        return next;
     }
     async close() {
         this.closed = true;
-        await this.queue.catch(() => { });
+        await this.queue.onIdle();
         await this.writer.close();
     }
     record(id) {
@@ -167,7 +183,8 @@ export class NotesIdentityService {
         const records = this.catalog.all();
         const byId = new Map(records.map(record => [record.id, record]));
         const presentByPath = new Map(records
-            .filter(record => record.presence === 'present' && !record.redirectId)
+            .filter(record => (record.presence === 'present' || record.deletedAt) &&
+            !record.redirectId)
             .map(record => [record.path, record]));
         const livePaths = new Set(documents.map(doc => doc.path));
         const counts = new Map();
@@ -245,7 +262,7 @@ export class NotesIdentityService {
                     (identity.id && identity.id !== record.id
                         ? 'The YAML ID conflicts with this note or is duplicated. The catalog identity is retained.'
                         : null);
-                if (warning) {
+                if (warning && !record.deletedAt) {
                     this.issue('metadata:' + record.id, warning, record.id, null, 'metadata');
                 }
                 else {
@@ -268,7 +285,7 @@ export class NotesIdentityService {
             group.push(candidate);
             byVersion.set(candidate.version, group);
         }
-        for (const old of current.filter(note => note.presence === 'missing' && !note.redirectId)) {
+        for (const old of current.filter(note => note.presence === 'missing' && !note.redirectId && !note.deletedAt)) {
             const samePath = currentByPath.get(old.path);
             const matches = (byVersion.get(old.version) ?? []).filter(candidate => !documentsByPath.get(candidate.path)?.yamlId);
             const candidate = samePath ?? (matches.length === 1 ? matches[0] : undefined);
@@ -278,7 +295,7 @@ export class NotesIdentityService {
         }
         for (const doc of documents) {
             const record = currentByPath.get(doc.path);
-            if (!record || !changed.has(record.id))
+            if (!record || record.deletedAt || !changed.has(record.id))
                 continue;
             const references = changes.length
                 ? noteReferences((await this.files.read(doc.path)).text)
@@ -290,7 +307,9 @@ export class NotesIdentityService {
                 this.cache.delete(path);
         }
         // Unreadable files stay visible through their issue, not as openable entries.
-        return entries.filter(entry => this.unreadable.get(entry.path) !== entry.signature);
+        const hiddenPaths = new Set(current.filter(note => note.deletedAt).map(note => note.path));
+        return entries.filter(entry => !hiddenPaths.has(entry.path) &&
+            this.unreadable.get(entry.path) !== entry.signature);
     }
     indexLinks(id, text, snapshot) {
         this.indexReferences(id, noteReferences(text), snapshot);
@@ -367,7 +386,13 @@ export class NotesIdentityService {
             entries,
             this.catalog
                 .all()
-                .map(note => [note.id, note.path, note.version, note.presence])
+                .map(note => [
+                note.id,
+                note.path,
+                note.version,
+                note.presence,
+                note.deletedAt
+            ])
         ]));
     }
     index() {
@@ -381,7 +406,9 @@ export class NotesIdentityService {
                 storage: this.files.root,
                 storageId: this.catalog.storageId,
                 revision: this.revision(entries),
-                issues: this.catalog.issues(),
+                issues: this.catalog
+                    .issues()
+                    .filter(issue => !issue.noteId || !this.record(issue.noteId).deletedAt),
                 entries: entries.map(entry => {
                     const record = recordsByPath.get(entry.path);
                     const metadata = entry.folder
@@ -405,13 +432,16 @@ export class NotesIdentityService {
             this.assertStorage(storageId);
             await this.synchronize();
             const registered = this.record(id);
-            const note = registered.presence === 'present' &&
-                !(await this.files.exists(registered.path))
-                ? { ...registered, presence: 'missing' }
-                : registered;
+            const note = registered.deletedAt
+                ? { ...registered, presence: 'deleted' }
+                : registered.presence === 'present' &&
+                    !(await this.files.exists(registered.path))
+                    ? { ...registered, presence: 'missing' }
+                    : registered;
             const backlinks = this.catalog
                 .all()
                 .filter(source => source.presence === 'present' &&
+                !source.deletedAt &&
                 this.catalog
                     .links(source.id)
                     .some(link => !!link.targetId && this.record(link.targetId).id === note.id));
@@ -432,7 +462,10 @@ export class NotesIdentityService {
             if (candidates.size !== 1) {
                 throw new BadRequestError('This path belongs to more than one note over time. Open a stable UUID link instead.');
             }
-            return this.record([...candidates][0]);
+            const record = this.record([...candidates][0]);
+            return record.deletedAt
+                ? { ...record, presence: 'deleted' }
+                : record;
         });
     }
     assertStorage(id) {
@@ -445,7 +478,7 @@ export class NotesIdentityService {
             this.assertStorage(storageId);
             await this.synchronize();
             const record = this.record(id);
-            if (record.presence !== 'present') {
+            if (record.presence !== 'present' || record.deletedAt) {
                 throw new NotFoundError('The note file is missing or deleted.');
             }
             return {
@@ -463,8 +496,9 @@ export class NotesIdentityService {
                 .find(note => note.path === path &&
                 note.presence === 'present' &&
                 !note.redirectId);
-            if (!record)
+            if (!record || record.deletedAt) {
                 throw new NotFoundError('Note not found.');
+            }
             return {
                 ...(await this.files.read(path)),
                 id: record.id,
@@ -480,13 +514,21 @@ export class NotesIdentityService {
             await this.files.path(path);
             await this.writer.acquire(true);
             await this.synchronize();
-            if (id)
-                path = this.record(id).path;
+            if (id) {
+                const identified = this.record(id);
+                if (identified.deletedAt) {
+                    throw new NotFoundError('This note was deleted.');
+                }
+                path = identified.path;
+            }
             let record = this.catalog
                 .all()
                 .find(note => note.path === path &&
                 note.presence === 'present' &&
                 !note.redirectId);
+            if (this.catalog.all().some(note => note.path === path && note.deletedAt)) {
+                throw new NoteExistsError();
+            }
             if (version === undefined) {
                 portablePath(path);
                 if (record)
@@ -528,6 +570,10 @@ export class NotesIdentityService {
             }
             if (id && this.record(id).path !== path)
                 throw new NoteConflictError();
+            if (!folder &&
+                this.catalog.all().some(note => note.path === path && note.deletedAt)) {
+                throw new NotFoundError('This note was deleted.');
+            }
             if (!target &&
                 (name !== name.trim() ||
                     name.includes('/') ||
@@ -543,12 +589,17 @@ export class NotesIdentityService {
             if (folder ? !sourceStat.isDirectory() : !sourceStat.isFile()) {
                 throw new BadRequestError('Entry type changed.');
             }
-            const destination = target ?? [...path.split('/').slice(0, -1), name].join('/');
+            const destination = target ?? noteChildPath(noteParentPath(path), name);
             portablePath(destination);
             await this.files.path(destination, !folder);
             if (destination === path) {
                 return { operationId: randomUUID(), complete: true };
             }
+            if (this.catalog
+                .all()
+                .some(note => note.deletedAt && note.path === destination)) {
+                throw new NoteExistsError();
+            }
             if (await this.files.exists(destination)) {
                 const caseOnly = process.platform === 'win32' &&
                     path.toLowerCase() === destination.toLowerCase() &&
@@ -585,6 +636,36 @@ export class NotesIdentityService {
             return { operationId: operation.id, complete };
         });
     }
+    deleteId(id, storageId) {
+        return this.run(async () => {
+            this.assertStorage(storageId);
+            await this.synchronize();
+            const note = this.record(id);
+            if (note.deletedAt)
+                return;
+            await this.writer.acquire(true);
+            await this.writer.assertOwner();
+            if (this.catalog
+                .operations()
+                .some(operation => operation.moves.some(move => move.id === note.id) ||
+                operation.writes.some(write => write.id === note.id && !write.done))) {
+                throw new NoteConflictError();
+            }
+            // The note leaves its name, so a new note can use it. The catalog keeps the identity.
+            // Only a present file exists on disk and needs the move.
+            const path = deletedNotePath(note.path, randomUUID());
+            if (note.presence === 'present' && !note.redirectId) {
+                await this.files.moveEntry(note.path, path, false);
+            }
+            this.catalog.put({
+                ...note,
+                path,
+                deletedAt: new Date().toISOString()
+            });
+            this.catalog.dismiss('missing:' + note.id, true);
+            this.catalog.dismiss('metadata:' + note.id);
+        });
+    }
     retry() {
         return this.run(() => this.operations.retry());
     }
@@ -644,9 +725,11 @@ export class NotesIdentityService {
             this.assertStorage(storageId);
             await this.synchronize();
             const source = this.record(sourceId);
+            if (source.deletedAt)
+                throw new NotFoundError('This note was deleted.');
             const paths = this.catalog
                 .all()
-                .filter(note => note.presence === 'present' && !note.redirectId)
+                .filter(note => note.presence === 'present' && !note.redirectId && !note.deletedAt)
                 .map(note => note.path);
             const refs = noteReferences(text)
                 .flatMap(ref => (ref.displayStarts ?? [ref.start]).map(displayPosition => ({
@@ -709,10 +792,12 @@ export class NotesIdentityService {
     graph() {
         return this.run(async () => {
             await this.synchronize();
-            const nodes = this.catalog.all().filter(note => !note.redirectId);
+            const nodes = this.catalog
+                .all()
+                .filter(note => !note.redirectId && !note.deletedAt);
             const edges = nodes
                 .filter(note => note.presence === 'present')
-                .flatMap(note => this.catalog.links(note.id).flatMap(link => link.targetId
+                .flatMap(note => this.catalog.links(note.id).flatMap(link => link.targetId && !this.record(link.targetId).deletedAt
                 ? [
                     {
                         sourceId: note.id,

package/dist/server/services/notes-operations.service.js

@@ -1,3 +1,4 @@
+import { noteChildPath, noteParentPath } from "../../shared/notes/note-path.js";
 import { randomUUID } from 'node:crypto';
 import { lstat } from 'node:fs/promises';
 import { noteReferences, referenceTarget, rewriteReferences, sameReference } from "../../shared/notes/references.js";
@@ -42,7 +43,7 @@ export class NotesOperationsService {
         };
         if (restore)
             operation.restore = restore;
-        const records = (preview ?? this.catalog.all()).filter(note => note.presence === 'present' && !note.redirectId);
+        const records = (preview ?? this.catalog.all()).filter(note => note.presence === 'present' && !note.redirectId && !note.deletedAt);
         const oldPath = (note) => moves.find(move => move.id === note.id)?.from ?? note.path;
         const newPath = (note) => moves.find(move => move.id === note.id)?.to ?? note.path;
         const oldPaths = records.map(oldPath);
@@ -111,10 +112,7 @@ export class NotesOperationsService {
                 operation.source !== operation.target &&
                 operation.source.toLowerCase() === operation.target.toLowerCase();
             if (caseOnly && !operation.temporary) {
-                operation.temporary = [
-                    ...operation.source.split('/').slice(0, -1),
-                    '__ght-case-' + operation.id + (operation.folder ? '' : '.md')
-                ].join('/');
+                operation.temporary = noteChildPath(noteParentPath(operation.source), '__ght-case-' + operation.id + (operation.folder ? '' : '.md'));
                 this.catalog.operation(operation);
             }
             let fromPath = operation.source;

package/dist/server/services/notes.service.js

@@ -10,6 +10,8 @@ import { BadRequestError } from "../errors/http.js";
 import { errorMessage } from "../../shared/utils/error-message.js";
 import { MAX_NOTE_ASSET_BYTES } from "../../shared/notes/constants.js";
 import { detectNoteAssetFormat } from "../utils/note-asset-format.js";
+// Git error text depends on the locale. The "not a git repository" check below needs English.
+const GIT_ENV = { ...process.env, LC_ALL: 'C' };
 const execFileAsync = promisify(execFile);
 export class NotesService {
     repository;
@@ -32,18 +34,18 @@ export class NotesService {
     }
     async visibility(ensureIgnored = false) {
         try {
-            const { stdout: gitRoot } = await execFileAsync('git', ['rev-parse', '--show-toplevel'], { cwd: this.projectPath });
+            const { stdout: gitRoot } = await execFileAsync('git', ['rev-parse', '--show-toplevel'], { cwd: this.projectPath, env: GIT_ENV });
             const path = relative(gitRoot.trim(), this.root).replaceAll('\\', '/');
             if (path.startsWith('../'))
                 return;
-            const { stdout: tracked } = await execFileAsync('git', ['ls-files', '--', path + '/'], { cwd: gitRoot.trim() });
+            const { stdout: tracked } = await execFileAsync('git', ['ls-files', '--', path + '/'], { cwd: gitRoot.trim(), env: GIT_ENV });
             if (tracked && this.local) {
                 this.warning =
                     'Some notes are already tracked by Git. Ignoring them does not remove them from Git.';
             }
             if (!this.local || !ensureIgnored)
                 return;
-            const { stdout: exclude } = await execFileAsync('git', ['rev-parse', '--git-path', 'info/exclude'], { cwd: this.projectPath });
+            const { stdout: exclude } = await execFileAsync('git', ['rev-parse', '--git-path', 'info/exclude'], { cwd: this.projectPath, env: GIT_ENV });
             const target = resolve(this.projectPath, exclude.trim());
             const rule = '/' + path.replace(/[*?[\]#! ]/g, char => '\\' + char) + '/';
             const content = await readFile(target, 'utf8').catch(() => '');
@@ -67,7 +69,7 @@ export class NotesService {
             index,
             this.identity.catalog
                 .all()
-                .map(note => [note.id, note.version, note.presence]),
+                .map(note => [note.id, note.version, note.presence, note.deletedAt]),
             this.warning
         ]);
         return { ...index, warning: this.warning };
@@ -92,11 +94,18 @@ export class NotesService {
         this.bus.publish({ type: 'notes:changed' });
         return note;
     }
+    async delete(id, storageId) {
+        await this.identity.deleteId(id, storageId);
+        this.bus.publish({ type: 'notes:changed' });
+    }
     async uploadAsset(bytes) {
         if (!bytes.length || bytes.length > MAX_NOTE_ASSET_BYTES) {
             throw new BadRequestError('Image must be under 10 MB');
         }
         const format = await detectNoteAssetFormat(bytes);
+        if (format.display !== 'image') {
+            throw new BadRequestError('Only image uploads are supported');
+        }
         this.exclusion ??= this.visibility(true);
         await this.exclusion;
         const id = await this.identity.run(async () => {
@@ -107,6 +116,22 @@ export class NotesService {
         });
         return { url: '/api/notes/assets/' + id };
     }
+    async importAsset(chunks, extension, signal) {
+        this.exclusion ??= this.visibility(true);
+        await this.exclusion;
+        const staged = await this.repository.stageAsset(chunks, extension, signal);
+        try {
+            const id = await this.identity.run(async () => {
+                await this.identity.writer.acquire(true);
+                await this.identity.writer.assertOwner();
+                return staged.commit();
+            });
+            return '/api/notes/assets/' + id;
+        }
+        finally {
+            await staged.dispose();
+        }
+    }
     readAsset(id) {
         return this.repository.readAsset(id);
     }

package/dist/server/utils/note-asset-format.js

@@ -13,7 +13,7 @@ export async function detectNoteAssetFormat(bytes) {
         NOTE_ASSET_FORMATS.find(candidate => candidate.extension === detected.ext ||
             candidate.aliases.some(alias => alias === detected.ext));
     if (!format) {
-        throw new BadRequestError('Supported images: ' + SUPPORTED_NOTE_ASSETS);
+        throw new BadRequestError('Supported attachments: ' + SUPPORTED_NOTE_ASSETS);
     }
     return format;
 }

package/dist/server/utils/remote-asset-request.js

@@ -0,0 +1,193 @@
+import { lookup } from 'node:dns/promises';
+import { BlockList, isIP } from 'node:net';
+import { Agent, request } from 'undici';
+import { BadRequestError } from "../errors/http.js";
+import { isCredentialFreeWebUrl } from "../../shared/utils/web-url.js";
+// Stop connection attempts that cannot establish a socket promptly.
+const CONNECTION_TIMEOUT_MS = 10000;
+// Stop responses that send no headers or no body data.
+const RESPONSE_IDLE_TIMEOUT_MS = 15000;
+// Bound the size of response headers.
+const MAX_HEADER_BYTES = 16384;
+// Stop redirect chains and loops.
+const MAX_REDIRECTS = 5;
+// Only these statuses ask the client to follow a Location header.
+const REDIRECT_STATUSES = [301, 302, 303, 307, 308];
+// Network failures that mean the remote server cannot serve the attachment.
+const UNREACHABLE_CODES = new Set([
+    'ENOTFOUND',
+    'ECONNREFUSED',
+    'ECONNRESET',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'ETIMEDOUT',
+    'UND_ERR_SOCKET'
+]);
+// Ask servers for the exact bytes: compressed bodies are not supported.
+const REQUEST_HEADERS = {
+    'accept-encoding': 'identity',
+    'user-agent': 'githuman-note-assets'
+};
+// Exclude non-public IPv4 ranges before opening any socket.
+const BLOCKED_IPV4 = new BlockList();
+// IPv6 routing must be public and must exclude special-purpose ranges.
+const PUBLIC_IPV6 = new BlockList();
+const BLOCKED_IPV6 = new BlockList();
+for (const [address, prefix] of [
+    ['0.0.0.0', 8],
+    ['10.0.0.0', 8],
+    ['100.64.0.0', 10],
+    ['127.0.0.0', 8],
+    ['169.254.0.0', 16],
+    ['172.16.0.0', 12],
+    ['192.0.0.0', 24],
+    ['192.0.2.0', 24],
+    ['192.88.99.0', 24],
+    ['192.168.0.0', 16],
+    ['198.18.0.0', 15],
+    ['198.51.100.0', 24],
+    ['203.0.113.0', 24],
+    ['224.0.0.0', 3]
+]) {
+    BLOCKED_IPV4.addSubnet(address, prefix, 'ipv4');
+}
+// Only globally routable IPv6 is eligible, with special-purpose ranges excluded.
+PUBLIC_IPV6.addSubnet('2000::', 3, 'ipv6');
+BLOCKED_IPV6.addSubnet('2001::', 23, 'ipv6');
+BLOCKED_IPV6.addSubnet('2001:db8::', 32, 'ipv6');
+BLOCKED_IPV6.addSubnet('2002::', 16, 'ipv6');
+BLOCKED_IPV6.addSubnet('3fff::', 20, 'ipv6');
+export function isPublicAssetAddress(address) {
+    const family = isIP(address);
+    if (family === 4)
+        return !BLOCKED_IPV4.check(address, 'ipv4');
+    return (family === 6 &&
+        PUBLIC_IPV6.check(address, 'ipv6') &&
+        !BLOCKED_IPV6.check(address, 'ipv6'));
+}
+/**
+ * Resolves a host name and refuses non-public results. The socket connects to
+ * the checked address, so no second lookup can change the target.
+ */
+export function createPublicLookup(resolveHost = lookup) {
+    return (hostname, options, callback) => {
+        void (async () => {
+            let addresses;
+            try {
+                addresses = await resolveHost(hostname, { all: true, verbatim: true });
+            }
+            catch (error) {
+                callback(error instanceof Error ? error : new Error(String(error)), '');
+                return;
+            }
+            const first = addresses[0];
+            if (!first ||
+                addresses.some(item => !isPublicAssetAddress(item.address))) {
+                callback(new BadRequestError('Attachment address is not public'), '');
+            }
+            else if (options.all) {
+                callback(null, addresses);
+            }
+            else {
+                callback(null, first.address, first.family);
+            }
+        })();
+    };
+}
+function createAgent(resolveHost) {
+    return new Agent({
+        connect: {
+            lookup: createPublicLookup(resolveHost),
+            timeout: CONNECTION_TIMEOUT_MS
+        },
+        connectTimeout: CONNECTION_TIMEOUT_MS,
+        headersTimeout: RESPONSE_IDLE_TIMEOUT_MS,
+        bodyTimeout: RESPONSE_IDLE_TIMEOUT_MS,
+        maxHeaderSize: MAX_HEADER_BYTES
+    });
+}
+// Undici ignores an abort while it waits for a socket, so the wait ends here.
+async function untilAborted(work, signal, discard) {
+    let abort;
+    const aborted = new Promise((_resolve, reject) => {
+        abort = () => reject(signal.reason);
+        signal.addEventListener('abort', abort, { once: true });
+    });
+    try {
+        return await Promise.race([work, aborted]);
+    }
+    catch (error) {
+        // A request that finishes after the abort still owns a socket.
+        work.then(discard, () => undefined);
+        throw error;
+    }
+    finally {
+        if (abort)
+            signal.removeEventListener('abort', abort);
+    }
+}
+let sharedAgent;
+function parseAssetUrl(value, message, base) {
+    let url;
+    try {
+        url = new URL(value, base);
+    }
+    catch {
+        throw new BadRequestError(message);
+    }
+    if (!isCredentialFreeWebUrl(url)) {
+        throw new BadRequestError('Only public HTTP and HTTPS attachments are supported');
+    }
+    return url;
+}
+export async function remoteAssetRequest(source, method, signal, options = {}) {
+    const dispatcher = options.dispatcher ??
+        (options.resolveHost
+            ? createAgent(options.resolveHost)
+            : (sharedAgent ??= createAgent()));
+    let url = parseAssetUrl(source, 'Invalid attachment URL');
+    for (let redirects = 0;; redirects++) {
+        signal.throwIfAborted();
+        // The socket layer skips the lookup for IP literals, so check them here.
+        const host = url.hostname.replace(/^\[|\]$/g, '');
+        if (isIP(host) && !isPublicAssetAddress(host)) {
+            throw new BadRequestError('Attachment address is not public');
+        }
+        const { statusCode, headers, body } = await untilAborted(request(url, { method, signal, dispatcher, headers: REQUEST_HEADERS }), signal, late => late.body.destroy());
+        if (!REDIRECT_STATUSES.includes(statusCode)) {
+            return Object.assign(body, { statusCode, headers });
+        }
+        body.destroy();
+        if (redirects >= MAX_REDIRECTS) {
+            throw new BadRequestError('Too many attachment redirects');
+        }
+        const location = headers.location;
+        if (!location || Array.isArray(location)) {
+            throw new BadRequestError('Attachment redirect has no valid location');
+        }
+        const next = parseAssetUrl(location, 'Invalid attachment redirect', url);
+        if (url.protocol === 'https:' && next.protocol !== 'https:') {
+            throw new BadRequestError('Insecure attachment redirect');
+        }
+        url = next;
+    }
+}
+/** Maps transport failures to client errors; other errors pass through. */
+export function translateRemoteAssetError(error) {
+    const code = typeof error === 'object' && error !== null && 'code' in error
+        ? error.code
+        : undefined;
+    if (error instanceof DOMException && error.name === 'TimeoutError') {
+        return new BadRequestError('Attachment download took too long');
+    }
+    if (code === 'UND_ERR_CONNECT_TIMEOUT') {
+        return new BadRequestError('Attachment connection timed out');
+    }
+    if (code === 'UND_ERR_HEADERS_TIMEOUT' || code === 'UND_ERR_BODY_TIMEOUT') {
+        return new BadRequestError('Attachment download stalled');
+    }
+    if (typeof code === 'string' && UNREACHABLE_CODES.has(code)) {
+        return new BadRequestError('Attachment server could not be reached');
+    }
+    return error;
+}

package/dist/server/utils/request-abort.js

@@ -0,0 +1,20 @@
+/**
+ * Runs `work` with a signal that aborts when the client closes the connection
+ * before the response ends. A normal finish does not abort the signal.
+ */
+export async function withRequestSignal(reply, work) {
+    const controller = new AbortController();
+    const abort = () => {
+        if (!reply.raw.writableFinished)
+            controller.abort();
+    };
+    if (reply.raw.destroyed)
+        abort();
+    reply.raw.once('close', abort);
+    try {
+        return await work(controller.signal);
+    }
+    finally {
+        reply.raw.removeListener('close', abort);
+    }
+}

package/dist/shared/agents/schemas.js

@@ -37,6 +37,20 @@ export const FileSearchQuery = Type.Object({
     }))
 });
 export const ContextItem = Type.Union([
+    Type.Object({
+        kind: Type.Literal('note', { description: 'A project note.' }),
+        noteId: Type.String({ minLength: 1, description: 'Stable note UUID.' }),
+        storageId: Type.String({
+            minLength: 1,
+            description: 'Notes storage identity.'
+        }),
+        name: Type.String({
+            minLength: 1,
+            description: 'Display name when attached.'
+        })
+    }, {
+        description: 'The current Markdown of a note, including YAML properties.'
+    }),
     Type.Object({
         kind: Type.Literal('diff', { description: 'Live working-tree diff.' }),
         source: DiffSourceNameSchema,