clawvault 2.5.3 → 2.5.4

package/dist/{chunk-3FP5BJ42.js → chunk-4QYGFWRM.js}

@@ -2,7 +2,7 @@ import {
   QmdUnavailableError,
   hasQmd,
   qmdEmbed
-} from "./chunk-O7XHXF7F.js";
+} from "./chunk-MAKNAHAW.js";
 import {
   resolveVaultPath
 } from "./chunk-MXSSG3QU.js";

package/dist/{chunk-M25QVSJM.js → chunk-AXKYDCNN.js}

@@ -1,7 +1,7 @@
 import {
   hasQmd,
   withQmdIndexArgs
-} from "./chunk-O7XHXF7F.js";
+} from "./chunk-MAKNAHAW.js";
 import {
   DEFAULT_CATEGORIES
 } from "./chunk-2CDEETQN.js";

package/dist/{chunk-CLE2HHNT.js → chunk-IVRIKYFE.js}

@@ -9,17 +9,24 @@ var BLOCKED_PATHS = [
   "node_modules"
 ];
 var SUPPORTED_METHODS = ["GET", "PUT", "DELETE", "MKCOL", "PROPFIND", "OPTIONS", "HEAD", "MOVE", "COPY"];
+function toRequestSegments(requestPath) {
+  return requestPath.replace(/\\/g, "/").split("/").filter(Boolean);
+}
+function isWithinRoot(fullPath, rootPath) {
+  const resolvedRoot = path.resolve(rootPath);
+  const relative2 = path.relative(resolvedRoot, fullPath);
+  return !(relative2.startsWith("..") || path.isAbsolute(relative2));
+}
 function isPathSafe(requestPath, rootPath) {
-  if (requestPath.includes("..")) {
+  const pathParts = toRequestSegments(requestPath);
+  if (pathParts.includes("..")) {
     return false;
   }
-  const normalizedPath = path.normalize(requestPath).replace(/^\/+/, "");
-  const fullPath = path.resolve(rootPath, normalizedPath);
-  const resolvedRoot = path.resolve(rootPath);
-  if (!fullPath.startsWith(resolvedRoot + path.sep) && fullPath !== resolvedRoot) {
+  const normalizedRelativePath = path.normalize(pathParts.join(path.sep));
+  const fullPath = path.resolve(rootPath, normalizedRelativePath);
+  if (!isWithinRoot(fullPath, rootPath)) {
     return false;
   }
-  const pathParts = normalizedPath.split(path.sep);
   for (const part of pathParts) {
     if (BLOCKED_PATHS.includes(part)) {
       return false;
@@ -28,13 +35,13 @@ function isPathSafe(requestPath, rootPath) {
   return true;
 }
 function resolveWebDAVPath(requestPath, rootPath) {
-  if (requestPath.includes("..")) {
+  const pathParts = toRequestSegments(requestPath);
+  if (pathParts.includes("..")) {
     return null;
   }
-  const normalizedPath = path.normalize(requestPath).replace(/^\/+/, "");
-  const fullPath = path.resolve(rootPath, normalizedPath);
-  const resolvedRoot = path.resolve(rootPath);
-  if (!fullPath.startsWith(resolvedRoot + path.sep) && fullPath !== resolvedRoot) {
+  const normalizedRelativePath = path.normalize(pathParts.join(path.sep));
+  const fullPath = path.resolve(rootPath, normalizedRelativePath);
+  if (!isWithinRoot(fullPath, rootPath)) {
     return null;
   }
   return fullPath;

package/dist/{chunk-FG6RJMCN.js → chunk-JDLOL2PL.js}

@@ -1,6 +1,6 @@
 import {
   registerTailscaleCommands
-} from "./chunk-NZ4ZZNSR.js";
+} from "./chunk-THRJVD4L.js";
 import {
   registerObserveCommand
 } from "./chunk-OSMS7QIG.js";
@@ -9,10 +9,10 @@ import {
 } from "./chunk-2YDBJS7M.js";
 import {
   registerContextCommand
-} from "./chunk-GFJ3LIIB.js";
+} from "./chunk-XAVB4GB4.js";
 import {
   registerEmbedCommand
-} from "./chunk-3FP5BJ42.js";
+} from "./chunk-4QYGFWRM.js";
 import {
   registerInjectCommand
 } from "./chunk-GSD4ALSI.js";

package/dist/{chunk-AY4PGUVL.js → chunk-KL4NAOMO.js}

@@ -6,7 +6,7 @@ import {
   hasQmd,
   qmdEmbed,
   qmdUpdate
-} from "./chunk-O7XHXF7F.js";
+} from "./chunk-MAKNAHAW.js";
 import {
   DEFAULT_CATEGORIES,
   TYPE_TO_CATEGORY

package/dist/{chunk-O7XHXF7F.js → chunk-MAKNAHAW.js}

@@ -235,14 +235,14 @@ var SearchEngine = class {
     for (const qr of qmdResults) {
       const filePath = this.qmdUriToPath(qr.file);
       const relativePath = this.vaultPath ? path.relative(this.vaultPath, filePath) : filePath;
-      const normalizedRelativePath = relativePath.split(path.sep).join("/");
+      const normalizedRelativePath = relativePath.replace(/\\/g, "/");
       if (normalizedRelativePath.startsWith("ledger/archive/") || normalizedRelativePath.includes("/ledger/archive/")) {
         continue;
       }
-      const docId = relativePath.replace(/\.md$/, "");
-      let doc = this.documents.get(docId);
+      const docId = normalizedRelativePath.replace(/\.md$/, "");
+      let doc = this.documents.get(docId) ?? this.documents.get(docId.split("/").join(path.sep));
       const modifiedAt = this.resolveModifiedAt(doc, filePath);
-      const parts = relativePath.split(path.sep);
+      const parts = normalizedRelativePath.split("/");
       const docCategory = parts.length > 1 ? parts[0] : "root";
       if (category && docCategory !== category) continue;
       if (tags && tags.length > 0 && doc) {

package/dist/{chunk-NZ4ZZNSR.js → chunk-THRJVD4L.js}

@@ -9,7 +9,7 @@ import {
   serveVault,
   stopTailscaleServe,
   syncWithPeer
-} from "./chunk-4GBPTBFJ.js";
+} from "./chunk-TIGW564L.js";
 import {
   resolveVaultPath
 } from "./chunk-MXSSG3QU.js";

package/dist/{chunk-4GBPTBFJ.js → chunk-TIGW564L.js}

@@ -1,7 +1,7 @@
 import {
   WEBDAV_PREFIX,
   createWebDAVHandler
-} from "./chunk-CLE2HHNT.js";
+} from "./chunk-IVRIKYFE.js";
 
 // src/lib/tailscale.ts
 import { spawnSync, spawn } from "child_process";

package/dist/{chunk-LMEMZGUV.js → chunk-W2HNZC22.js}

@@ -10,10 +10,10 @@ import {
 import {
   ClawVault,
   findVault
-} from "./chunk-AY4PGUVL.js";
+} from "./chunk-KL4NAOMO.js";
 import {
   hasQmd
-} from "./chunk-O7XHXF7F.js";
+} from "./chunk-MAKNAHAW.js";
 import {
   loadMemoryGraphIndex
 } from "./chunk-ZZA73MFY.js";

package/dist/{chunk-GFJ3LIIB.js → chunk-XAVB4GB4.js}

@@ -1,6 +1,6 @@
 import {
   ClawVault
-} from "./chunk-AY4PGUVL.js";
+} from "./chunk-KL4NAOMO.js";
 import {
   parseObservationMarkdown
 } from "./chunk-FHFUXL6G.js";

package/dist/cli/index.js

@@ -1,22 +1,22 @@
 import {
   registerCliCommands
-} from "../chunk-FG6RJMCN.js";
-import "../chunk-NZ4ZZNSR.js";
-import "../chunk-4GBPTBFJ.js";
-import "../chunk-CLE2HHNT.js";
+} from "../chunk-JDLOL2PL.js";
+import "../chunk-THRJVD4L.js";
+import "../chunk-TIGW564L.js";
+import "../chunk-IVRIKYFE.js";
 import "../chunk-OSMS7QIG.js";
 import "../chunk-P5EPF6MB.js";
 import "../chunk-2YDBJS7M.js";
 import "../chunk-YOSEUUNB.js";
-import "../chunk-GFJ3LIIB.js";
+import "../chunk-XAVB4GB4.js";
 import "../chunk-IZEY5S74.js";
 import "../chunk-HRLWZGMA.js";
 import "../chunk-S2IG7VNM.js";
 import "../chunk-5GZFTAL7.js";
-import "../chunk-AY4PGUVL.js";
+import "../chunk-KL4NAOMO.js";
 import "../chunk-FHFUXL6G.js";
-import "../chunk-3FP5BJ42.js";
-import "../chunk-O7XHXF7F.js";
+import "../chunk-4QYGFWRM.js";
+import "../chunk-MAKNAHAW.js";
 import "../chunk-GSD4ALSI.js";
 import "../chunk-K3CDT7IH.js";
 import "../chunk-ITPEXLHA.js";

package/dist/commands/context.js

@@ -3,10 +3,10 @@ import {
   contextCommand,
   formatContextMarkdown,
   registerContextCommand
-} from "../chunk-GFJ3LIIB.js";
-import "../chunk-AY4PGUVL.js";
+} from "../chunk-XAVB4GB4.js";
+import "../chunk-KL4NAOMO.js";
 import "../chunk-FHFUXL6G.js";
-import "../chunk-O7XHXF7F.js";
+import "../chunk-MAKNAHAW.js";
 import "../chunk-2CDEETQN.js";
 import "../chunk-ZZA73MFY.js";
 import "../chunk-Z2XBWN7A.js";

package/dist/commands/doctor.js

@@ -1,6 +1,6 @@
 import {
   doctor
-} from "../chunk-LMEMZGUV.js";
+} from "../chunk-W2HNZC22.js";
 import "../chunk-7ZRP733D.js";
 import "../chunk-4VQTUVH7.js";
 import "../chunk-J7ZWCI2C.js";
@@ -8,9 +8,9 @@ import "../chunk-IZEY5S74.js";
 import "../chunk-HRLWZGMA.js";
 import "../chunk-S2IG7VNM.js";
 import "../chunk-5GZFTAL7.js";
-import "../chunk-AY4PGUVL.js";
+import "../chunk-KL4NAOMO.js";
 import "../chunk-FHFUXL6G.js";
-import "../chunk-O7XHXF7F.js";
+import "../chunk-MAKNAHAW.js";
 import "../chunk-ITPEXLHA.js";
 import "../chunk-2CDEETQN.js";
 import "../chunk-ZZA73MFY.js";

package/dist/commands/embed.js

@@ -1,8 +1,8 @@
 import {
   embedCommand,
   registerEmbedCommand
-} from "../chunk-3FP5BJ42.js";
-import "../chunk-O7XHXF7F.js";
+} from "../chunk-4QYGFWRM.js";
+import "../chunk-MAKNAHAW.js";
 import "../chunk-MXSSG3QU.js";
 export {
   embedCommand,

package/dist/commands/setup.js

@@ -1,7 +1,7 @@
 import {
   setupCommand
-} from "../chunk-M25QVSJM.js";
-import "../chunk-O7XHXF7F.js";
+} from "../chunk-AXKYDCNN.js";
+import "../chunk-MAKNAHAW.js";
 import "../chunk-2CDEETQN.js";
 export {
   setupCommand

package/dist/commands/sleep.js

@@ -10,11 +10,11 @@ import {
 import "../chunk-5GZFTAL7.js";
 import {
   ClawVault
-} from "../chunk-AY4PGUVL.js";
+} from "../chunk-KL4NAOMO.js";
 import "../chunk-FHFUXL6G.js";
 import {
   qmdUpdate
-} from "../chunk-O7XHXF7F.js";
+} from "../chunk-MAKNAHAW.js";
 import "../chunk-K3CDT7IH.js";
 import "../chunk-ITPEXLHA.js";
 import "../chunk-2CDEETQN.js";

package/dist/commands/status.js

@@ -13,13 +13,13 @@ import "../chunk-S2IG7VNM.js";
 import "../chunk-5GZFTAL7.js";
 import {
   ClawVault
-} from "../chunk-AY4PGUVL.js";
+} from "../chunk-KL4NAOMO.js";
 import "../chunk-FHFUXL6G.js";
 import {
   QmdUnavailableError,
   hasQmd,
   withQmdIndexArgs
-} from "../chunk-O7XHXF7F.js";
+} from "../chunk-MAKNAHAW.js";
 import "../chunk-ITPEXLHA.js";
 import "../chunk-2CDEETQN.js";
 import {

package/dist/commands/tailscale.js

@@ -8,9 +8,9 @@ import {
   tailscaleServeCommand,
   tailscaleStatusCommand,
   tailscaleSyncCommand
-} from "../chunk-NZ4ZZNSR.js";
-import "../chunk-4GBPTBFJ.js";
-import "../chunk-CLE2HHNT.js";
+} from "../chunk-THRJVD4L.js";
+import "../chunk-TIGW564L.js";
+import "../chunk-IVRIKYFE.js";
 import "../chunk-MXSSG3QU.js";
 export {
   registerTailscaleCommands,

package/dist/commands/wake.js

@@ -4,11 +4,11 @@ import {
 import "../chunk-7ZRP733D.js";
 import {
   ClawVault
-} from "../chunk-AY4PGUVL.js";
+} from "../chunk-KL4NAOMO.js";
 import {
   parseObservationMarkdown
 } from "../chunk-FHFUXL6G.js";
-import "../chunk-O7XHXF7F.js";
+import "../chunk-MAKNAHAW.js";
 import "../chunk-2CDEETQN.js";
 import "../chunk-ZZA73MFY.js";
 import {

package/dist/index.js

@@ -9,7 +9,7 @@ import {
 } from "./chunk-ZKGY7WTT.js";
 import {
   setupCommand
-} from "./chunk-M25QVSJM.js";
+} from "./chunk-AXKYDCNN.js";
 import {
   registerSyncBdCommand,
   syncBdCommand
@@ -29,7 +29,7 @@ import {
 } from "./chunk-4IV3R2F5.js";
 import {
   doctor
-} from "./chunk-LMEMZGUV.js";
+} from "./chunk-W2HNZC22.js";
 import "./chunk-7ZRP733D.js";
 import {
   graphCommand,
@@ -49,7 +49,7 @@ import "./chunk-4VQTUVH7.js";
 import "./chunk-J7ZWCI2C.js";
 import {
   registerCliCommands
-} from "./chunk-FG6RJMCN.js";
+} from "./chunk-JDLOL2PL.js";
 import {
   registerTailscaleCommands,
   registerTailscaleDiscoverCommand,
@@ -60,7 +60,7 @@ import {
   tailscaleServeCommand,
   tailscaleStatusCommand,
   tailscaleSyncCommand
-} from "./chunk-NZ4ZZNSR.js";
+} from "./chunk-THRJVD4L.js";
 import {
   CLAWVAULT_SERVE_PATH,
   DEFAULT_SERVE_PORT,
@@ -81,8 +81,8 @@ import {
   serveVault,
   stopTailscaleServe,
   syncWithPeer
-} from "./chunk-4GBPTBFJ.js";
-import "./chunk-CLE2HHNT.js";
+} from "./chunk-TIGW564L.js";
+import "./chunk-IVRIKYFE.js";
 import {
   SessionWatcher,
   observeCommand,
@@ -106,7 +106,7 @@ import {
   normalizeContextProfileInput,
   registerContextCommand,
   resolveContextProfile
-} from "./chunk-GFJ3LIIB.js";
+} from "./chunk-XAVB4GB4.js";
 import {
   getObserverStaleness,
   getScaledObservationThresholdBytes,
@@ -132,12 +132,12 @@ import {
   ClawVault,
   createVault,
   findVault
-} from "./chunk-AY4PGUVL.js";
+} from "./chunk-KL4NAOMO.js";
 import "./chunk-FHFUXL6G.js";
 import {
   embedCommand,
   registerEmbedCommand
-} from "./chunk-3FP5BJ42.js";
+} from "./chunk-4QYGFWRM.js";
 import {
   QMD_INSTALL_COMMAND,
   QMD_INSTALL_URL,
@@ -148,7 +148,7 @@ import {
   hasQmd,
   qmdEmbed,
   qmdUpdate
-} from "./chunk-O7XHXF7F.js";
+} from "./chunk-MAKNAHAW.js";
 import {
   buildInjectionResult,
   deterministicInjectMatches,

package/dist/lib/tailscale.js

@@ -21,8 +21,8 @@ import {
   serveVault,
   stopTailscaleServe,
   syncWithPeer
-} from "../chunk-4GBPTBFJ.js";
-import "../chunk-CLE2HHNT.js";
+} from "../chunk-TIGW564L.js";
+import "../chunk-IVRIKYFE.js";
 export {
   CLAWVAULT_SERVE_PATH,
   DEFAULT_SERVE_PORT,

package/dist/lib/webdav.js

@@ -14,7 +14,7 @@ import {
   handlePut,
   isPathSafe,
   resolveWebDAVPath
-} from "../chunk-CLE2HHNT.js";
+} from "../chunk-IVRIKYFE.js";
 export {
   WEBDAV_PREFIX,
   checkAuth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawvault",
-  "version": "2.5.3",
+  "version": "2.5.4",
   "description": "Structured memory system for AI agents — typed storage, knowledge graph, context profiles, canvas dashboards, neural graph themes, and Obsidian-native task views. An elephant never forgets. 🐘",
   "type": "module",
   "main": "dist/index.cjs",