@unbrained/pm-web 2026.8.17 → 2026.8.29

package/dist/routes/pm.js

@@ -1,6 +1,6 @@
 import { Router } from "express";
 import { requireAuth } from "../middleware/auth.js";
-import { ensureGraphExtension, runPm, runGetItemAt, readPmSettings, PmCliError, EXIT_CODE } from "../services/pm-runner.js";
+import { ensureGraphExtension, readCompletePmItems, runPm, runGetItemAt, readPmSettings, PmCliError, EXIT_CODE } from "../services/pm-runner.js";
 // The search-tuning resolvers live only on the narrow sdk/query entrypoint — the
 // aggregate sdk barrel documents itself as re-exporting every supported export but
 // omits 45 of them, these three included (upstream: unbraind/pm-cli#740).
@@ -392,7 +392,10 @@ function scheduleGraphSync(projectId, project, reason) {
             });
         })
             .catch((err) => {
-            console.error(`Neo4j graph auto-sync failed for ${projectId} after ${reason}:`, err);
+            // Use `%s` specifiers and pass the values as arguments instead of
+            // interpolating them into the format string, so a tainted `reason` or
+            // `projectId` cannot inject `console` format specifiers.
+            console.error("Neo4j graph auto-sync failed for %s after %s:", projectId, reason, err);
             broadcastProjectEvent(projectId, {
                 type: "graph-sync-failed",
                 data: { reason, error: err instanceof Error ? err.message : String(err) },
@@ -428,31 +431,26 @@ function broadcastDependencyEvent(projectId, kind, data) {
         },
     });
 }
-function itemsFromListAll(parsed) {
+function itemsFromCompleteList(parsed) {
     return ((parsed?.items) ?? []);
 }
 /**
- * Build a project graph from `pm list-all` when no graph extension is available.
+ * Build a project graph from a certified complete pm read when no graph extension is available.
  *
- * Runs `list-all` as the project owner and assembles the graph from the returned
- * items using their embedded `deps`/`dependencies` (no per-item subprocess calls),
- * avoiding an N+1 fan-out. Throws when the items cannot be loaded.
+ * Reads every item through the public SDK's high-level complete-list operation
+ * and assembles the graph from embedded `deps`/`dependencies` (no per-item
+ * calls), avoiding an N+1 fan-out. Throws when the corpus cannot be certified.
  *
  * @param ownerUserId - The project owner's user id.
  * @param slug - The project slug.
  * @returns A pm-web-sourced project graph.
  */
 async function fallbackGraphForProject(ownerUserId, slug) {
-    const itemsResult = await runPm({
-        args: ["list-all"],
-        userId: ownerUserId,
-        slug,
-        jsonOutput: true,
-    });
+    const itemsResult = await readCompletePmItems(ownerUserId, slug);
     if (!itemsResult.ok)
         throw new Error(itemsResult.stderr || "Failed to load items for graph");
-    const items = itemsFromListAll(itemsResult.parsed);
-    // Deps are already embedded in list-all output (item.deps / item.dependencies).
+    const items = itemsFromCompleteList(itemsResult.result);
+    // Deps are already embedded in the full item rows (item.deps / item.dependencies).
     // Avoid N+1 subprocess calls by using only the embedded data.
     return graphFromItems(items, new Map());
 }
@@ -694,7 +692,10 @@ router.get("/list-all", async (req, res) => {
         return;
     }
     const { type, limit, after } = req.query;
-    const args = ["list-all"];
+    // Preserve the public HTTP compatibility route while invoking the canonical
+    // CLI/SDK command internally. This route is intentionally paginated and is
+    // therefore distinct from readCompletePmItems used by whole-corpus views.
+    const args = ["list", "--all"];
     if (type)
         args.push("--type", type);
     if (limit)
@@ -727,16 +728,16 @@ router.get("/board", async (req, res) => {
         ? contracts.parsed["runtime_schema"]
         : undefined;
     const statuses = Array.isArray(rt?.["statuses"]) ? rt["statuses"] : [];
-    const listed = await runPm({ args: ["list-all", "--json"], userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
+    const listed = await readCompletePmItems(project.ownerUserId, project.slug);
     if (!listed.ok) {
         res.json({ error: listed.stderr, columns: [] });
         return;
     }
-    const items = itemsFromListAll(listed.parsed);
+    const items = itemsFromCompleteList(listed.result);
     res.json({ columns: boardColumns(items, statuses), statuses, count: items.length });
 });
 // GET /api/projects/:projectId/pm/search?q=...
-// Full-text search over id/title/tags/body via a single list-all read.
+// Full-text search over id/title/tags/body via one certified complete read.
 router.get("/search", async (req, res) => {
     const project = await verifyProject(req.user.userId, routeParam(req, "projectId"));
     if (!project) {
@@ -744,12 +745,12 @@ router.get("/search", async (req, res) => {
         return;
     }
     const query = String(req.query["q"] ?? "");
-    const listed = await runPm({ args: ["list-all", "--json", "--include-body"], userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
+    const listed = await readCompletePmItems(project.ownerUserId, project.slug, true);
     if (!listed.ok) {
         res.json({ error: listed.stderr, items: [] });
         return;
     }
-    const items = filterItemsByQuery(itemsFromListAll(listed.parsed), query);
+    const items = filterItemsByQuery(itemsFromCompleteList(listed.result), query);
     res.json({ query, items, count: items.length });
 });
 // POST /api/projects/:projectId/pm/create
@@ -1215,8 +1216,8 @@ router.get("/calendar", async (req, res) => {
 });
 // GET /api/projects/:projectId/pm/calendar.ics
 // RFC 5545 iCalendar feed of item deadlines, for subscribing in Google
-// Calendar / Outlook / Apple Calendar. Reuses the same list-all read as the
-// calendar view. Auth works via the usual token (header/cookie) or a
+// Calendar / Outlook / Apple Calendar. Reads one certified complete corpus.
+// Auth works via the usual token (header/cookie) or a
 // `?token=` query param, since calendar clients cannot send cookies.
 router.get("/calendar.ics", async (req, res) => {
     const project = await verifyProject(req.user.userId, routeParam(req, "projectId"));
@@ -1224,17 +1225,12 @@ router.get("/calendar.ics", async (req, res) => {
         res.status(404).json({ error: "Project not found" });
         return;
     }
-    const listed = await runPm({
-        args: ["list-all", "--json"],
-        userId: project.ownerUserId,
-        slug: project.slug,
-        jsonOutput: true,
-    });
+    const listed = await readCompletePmItems(project.ownerUserId, project.slug);
     if (!listed.ok) {
         res.status(502).json({ error: listed.stderr || "Failed to load items" });
         return;
     }
-    const items = itemsFromListAll(listed.parsed)
+    const items = itemsFromCompleteList(listed.result)
         .filter((i) => Boolean(i.deadline))
         .map((i) => ({
         id: i.id,
@@ -1963,18 +1959,12 @@ router.get("/export", async (req, res) => {
         return;
     }
     const format = req.query["format"] || "json";
-    // Use --full --include-body to get the richest available list-level metadata
-    const result = await runPm({
-        args: ["list-all", "--limit", "10000", "--full", "--include-body"],
-        userId: project.ownerUserId,
-        slug: project.slug,
-        jsonOutput: true,
-    });
+    const result = await readCompletePmItems(project.ownerUserId, project.slug, true);
     if (!result.ok) {
         res.status(500).json({ error: result.stderr || "Export failed" });
         return;
     }
-    const data = result.parsed;
+    const data = result.result;
     const exportedAt = new Date().toISOString();
     if (format === "csv") {
         const items = data?.items ?? [];