chapterhouse 0.8.2 → 0.9.1

package/dist/api/server.test.js

@@ -756,6 +756,24 @@ tags: [ops]
         assert.deepEqual(await missingResponse.json(), { error: "Page not found" });
     });
 });
+test("POST /api/wiki/page/pin rejects path traversal slugs", async () => {
+    await withStartedServer(async ({ baseUrl, authHeader }) => {
+        const response = await fetch(`${baseUrl}/api/wiki/page/pin`, {
+            method: "POST",
+            headers: {
+                authorization: authHeader,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                slug: "../../etc/passwd",
+                pinned: true,
+            }),
+        });
+        assert.equal(response.status, 400);
+        const body = await response.json();
+        assert.match(body.error ?? "", /unsafe wiki path/i);
+    });
+});
 test("server worker detail returns the stored dispatched prompt", async () => {
     await withStartedServer(async ({ baseUrl, authHeader, testRoot }) => {
         const db = new Database(join(testRoot, ".chapterhouse", "chapterhouse.db"));
@@ -891,6 +909,74 @@ test("server wiki route still returns 404 for other missing wiki pages", async (
         assert.deepEqual(await response.json(), { error: "Page not found" });
     });
 });
+test("GET /api/wiki/browser-pages maps wiki_pages rows to the browser contract and filters them", async () => {
+    await withStartedServer(async ({ baseUrl, authHeader, testRoot }) => {
+        const db = new Database(getProjectDbPath(testRoot));
+        try {
+            db.prepare(`
+        INSERT INTO wiki_pages (path, title, entity_type, tags, summary, last_updated, pinned)
+        VALUES (?, ?, ?, ?, ?, ?, ?)
+      `).run("pages/topics/rust/index.md", "Rust", "topics", "[]", "Systems programming language", "2026-05-15T12:00:00.000Z", 1);
+            db.prepare(`
+        INSERT INTO wiki_pages (path, title, entity_type, tags, summary, last_updated, pinned)
+        VALUES (?, ?, ?, ?, ?, ?, ?)
+      `).run("pages/projects/chapterhouse/index.md", "Chapterhouse", "projects", "[]", "Team AI assistant", "2026-05-14T12:00:00.000Z", 0);
+        }
+        finally {
+            db.close();
+        }
+        const response = await fetch(`${baseUrl}/api/wiki/browser-pages?type=topics&q=systems`, {
+            headers: { authorization: authHeader },
+        });
+        assert.equal(response.status, 200);
+        assert.deepEqual(await response.json(), {
+            pages: [
+                {
+                    slug: "topics/rust/index",
+                    title: "Rust",
+                    summary: "Systems programming language",
+                    type: "topics",
+                    last_updated: "2026-05-15T12:00:00.000Z",
+                    pinned: true,
+                },
+            ],
+        });
+    });
+});
+test("GET /api/wiki/browser-pages falls back to indexed and orphan wiki pages when wiki_pages is empty", async () => {
+    await withStartedServer(async ({ baseUrl, authHeader, testRoot }) => {
+        const indexedDir = join(testRoot, ".chapterhouse", "wiki", "pages", "topics", "fallback");
+        mkdirSync(indexedDir, { recursive: true });
+        writeFileSync(join(indexedDir, "index.md"), "# Fallback\n", "utf-8");
+        const orphanDir = join(testRoot, ".chapterhouse", "wiki", "pages", "projects", "orphan-browser");
+        mkdirSync(orphanDir, { recursive: true });
+        writeFileSync(join(orphanDir, "index.md"), "# Orphan Browser\n", "utf-8");
+        const db = new Database(getProjectDbPath(testRoot));
+        try {
+            db.prepare("DELETE FROM wiki_pages").run();
+        }
+        finally {
+            db.close();
+        }
+        const response = await fetch(`${baseUrl}/api/wiki/browser-pages?type=Unindexed&q=orphan`, {
+            headers: { authorization: authHeader },
+        });
+        assert.equal(response.status, 200);
+        const body = await response.json();
+        assert.deepEqual(body.pages.map((page) => ({
+            slug: page.slug,
+            title: page.title,
+            type: page.type,
+        })), [
+            {
+                slug: "projects/orphan-browser/index",
+                title: "pages/projects/orphan-browser/index.md",
+                type: "Unindexed",
+            },
+        ]);
+        assert.notEqual(body.pages[0]?.last_updated, "");
+    });
+});
 test("GET /api/wiki/pages coerces empty updated fields to page mtimes", async () => {
     await withStartedServer(async ({ baseUrl, authHeader, testRoot }) => {
         const indexedPath = join(testRoot, ".chapterhouse", "wiki", "pages", "topics", "coerced-updated", "index.md");
@@ -1541,8 +1627,8 @@ test("GET /api/wiki/korg/sessions returns grouped active research sessions", asy
                     id: "compiler-research",
                     name: "Compiler research",
                     source_count: 2,
-                    open_questions: 0,
-                    last_activity: "2026-05-14T22:00:00.000Z",
+                    open_questions_count: 0,
+                    last_activity_at: "2026-05-14T22:00:00.000Z",
                 },
             ],
         });