collabmd 0.1.18 → 0.1.20

package/src/domain/comment-threads.js

@@ -3,6 +3,7 @@ import * as Y from 'yjs';
 export const COMMENT_BODY_MAX_LENGTH = 2000;
 export const COMMENT_EXCERPT_MAX_LENGTH = 160;
 export const COMMENT_ANCHOR_QUOTE_MAX_LENGTH = 280;
+export const COMMENT_REACTION_EMOJI_MAX_LENGTH = 16;
 
 const COMMENT_ANCHOR_KINDS = new Set(['line', 'text']);
 
@@ -22,6 +23,14 @@ function asString(value) {
   return typeof value === 'string' ? value : '';
 }
 
+function asArray(value) {
+  if (value instanceof Y.Array) {
+    return value.toArray();
+  }
+
+  return Array.isArray(value) ? value : [];
+}
+
 function readThreadValue(thread, key) {
   if (thread instanceof Y.Map) {
     return thread.get(key);
@@ -34,6 +43,14 @@ function isResolvedThread(thread) {
   return asFiniteNumber(readThreadValue(thread, 'resolvedAt')) !== null;
 }
 
+function readRecordValue(record, key) {
+  if (record instanceof Y.Map) {
+    return record.get(key);
+  }
+
+  return record?.[key];
+}
+
 function normalizeAnchorKind(value) {
   return COMMENT_ANCHOR_KINDS.has(value) ? value : null;
 }
@@ -76,30 +93,95 @@ export function summarizeCommentExcerpt(value, maxLength = COMMENT_EXCERPT_MAX_L
   return `${normalized.slice(0, Math.max(maxLength - 1, 1)).trimEnd()}…`;
 }
 
+function normalizeReactionEmoji(value) {
+  return Array.from(String(value ?? '').trim())
+    .slice(0, COMMENT_REACTION_EMOJI_MAX_LENGTH)
+    .join('');
+}
+
+function createReactionUserRecord(user) {
+  const userId = asString(readRecordValue(user, 'userId')).trim();
+  if (!userId) {
+    return null;
+  }
+
+  return {
+    reactedAt: asFiniteNumber(readRecordValue(user, 'reactedAt')) ?? Date.now(),
+    userColor: asString(readRecordValue(user, 'userColor')),
+    userId,
+    userName: asString(readRecordValue(user, 'userName')) || 'Anonymous',
+  };
+}
+
+function createReactionGroupRecord(group) {
+  const emoji = normalizeReactionEmoji(readRecordValue(group, 'emoji'));
+  if (!emoji) {
+    return null;
+  }
+
+  const usersById = new Map();
+  asArray(readRecordValue(group, 'users')).forEach((user) => {
+    const normalizedUser = createReactionUserRecord(user);
+    if (normalizedUser) {
+      usersById.set(normalizedUser.userId, normalizedUser);
+    }
+  });
+
+  if (usersById.size === 0) {
+    return null;
+  }
+
+  return {
+    emoji,
+    users: Array.from(usersById.values()),
+  };
+}
+
+function serializeCommentReactions(reactions) {
+  const groupsByEmoji = new Map();
+
+  asArray(reactions).forEach((group) => {
+    const normalizedGroup = createReactionGroupRecord(group);
+    if (!normalizedGroup) {
+      return;
+    }
+
+    const existing = groupsByEmoji.get(normalizedGroup.emoji);
+    if (!existing) {
+      groupsByEmoji.set(normalizedGroup.emoji, normalizedGroup);
+      return;
+    }
+
+    const mergedUsers = new Map(existing.users.map((user) => [user.userId, user]));
+    normalizedGroup.users.forEach((user) => mergedUsers.set(user.userId, user));
+    groupsByEmoji.set(normalizedGroup.emoji, {
+      emoji: normalizedGroup.emoji,
+      users: Array.from(mergedUsers.values()),
+    });
+  });
+
+  return Array.from(groupsByEmoji.values());
+}
+
 function createMessageRecord(message) {
-  const body = normalizeCommentBody(message?.body);
+  const body = normalizeCommentBody(readRecordValue(message, 'body'));
   if (!body) {
     return null;
   }
 
   return {
     body,
-    createdAt: asFiniteNumber(message?.createdAt) ?? Date.now(),
-    id: asString(message?.id) || createCommentId('comment'),
-    peerId: asString(message?.peerId),
-    userColor: asString(message?.userColor),
-    userName: asString(message?.userName) || 'Anonymous',
+    createdAt: asFiniteNumber(readRecordValue(message, 'createdAt')) ?? Date.now(),
+    id: asString(readRecordValue(message, 'id')) || createCommentId('comment'),
+    peerId: asString(readRecordValue(message, 'peerId')),
+    reactions: serializeCommentReactions(readRecordValue(message, 'reactions')),
+    userColor: asString(readRecordValue(message, 'userColor')),
+    userName: asString(readRecordValue(message, 'userName')) || 'Anonymous',
   };
 }
 
 function serializeMessages(messages) {
-  const source = messages instanceof Y.Array
-    ? messages.toArray()
-    : Array.isArray(messages)
-      ? messages
-      : [];
-
-  return source
+  return asArray(messages)
     .map((message) => createMessageRecord(message))
     .filter(Boolean);
 }

package/src/domain/file-kind.js

@@ -2,6 +2,7 @@ const MARKDOWN_FILE_EXTENSIONS = Object.freeze(['.md', '.markdown', '.mdx']);
 const EXCALIDRAW_FILE_EXTENSION = '.excalidraw';
 const MERMAID_FILE_EXTENSIONS = Object.freeze(['.mmd', '.mermaid']);
 const PLANTUML_FILE_EXTENSIONS = Object.freeze(['.puml', '.plantuml']);
+const IMAGE_ATTACHMENT_EXTENSIONS = Object.freeze(['.png', '.jpg', '.jpeg', '.webp', '.gif', '.svg']);
 const DIAGRAM_FILE_EXTENSIONS = Object.freeze([
   EXCALIDRAW_FILE_EXTENSION,
   ...MERMAID_FILE_EXTENSIONS,
@@ -10,8 +11,9 @@ const DIAGRAM_FILE_EXTENSIONS = Object.freeze([
 const VAULT_FILE_EXTENSIONS = Object.freeze([
   ...MARKDOWN_FILE_EXTENSIONS,
   ...DIAGRAM_FILE_EXTENSIONS,
+  ...IMAGE_ATTACHMENT_EXTENSIONS,
 ]);
-const STRIP_VAULT_EXTENSION_PATTERN = /\.(?:md|markdown|mdx|excalidraw|mmd|mermaid|puml|plantuml)$/i;
+const STRIP_VAULT_EXTENSION_PATTERN = /\.(?:md|markdown|mdx|excalidraw|mmd|mermaid|puml|plantuml|png|jpe?g|webp|gif|svg)$/i;
 
 function normalizeFilePath(filePath) {
   return String(filePath ?? '').trim().toLowerCase();
@@ -25,6 +27,7 @@ function hasFileExtension(filePath, extensions) {
 export {
   DIAGRAM_FILE_EXTENSIONS,
   EXCALIDRAW_FILE_EXTENSION,
+  IMAGE_ATTACHMENT_EXTENSIONS,
   MARKDOWN_FILE_EXTENSIONS,
   MERMAID_FILE_EXTENSIONS,
   PLANTUML_FILE_EXTENSIONS,
@@ -48,6 +51,10 @@ export function getVaultFileKind(filePath) {
     return 'plantuml';
   }
 
+  if (hasFileExtension(filePath, IMAGE_ATTACHMENT_EXTENSIONS)) {
+    return 'image';
+  }
+
   return null;
 }
 
@@ -57,6 +64,10 @@ export function getVaultTreeNodeType(filePath) {
     return null;
   }
 
+  if (kind === 'image') {
+    return 'image';
+  }
+
   return kind === 'markdown' ? 'file' : kind;
 }
 
@@ -81,6 +92,10 @@ export function isPlantUmlFilePath(filePath) {
   return getVaultFileKind(filePath) === 'plantuml';
 }
 
+export function isImageAttachmentFilePath(filePath) {
+  return getVaultFileKind(filePath) === 'image';
+}
+
 export function isDiagramFilePath(filePath) {
   const kind = getVaultFileKind(filePath);
   return kind === 'excalidraw' || kind === 'mermaid' || kind === 'plantuml';

package/src/server/infrastructure/git/errors.js

@@ -1,5 +1,8 @@
-export function createGitRequestError(statusCode, message) {
+export function createGitRequestError(statusCode, message, requestCode = null) {
   const error = new Error(message);
   error.statusCode = statusCode;
+  if (requestCode) {
+    error.requestCode = requestCode;
+  }
   return error;
 }

package/src/server/infrastructure/git/git-service.js

@@ -6,6 +6,7 @@ import { parseNameStatusOutput } from './parsers.js';
 import { createEmptyWorkspaceChange, createWorkspaceChange } from './responses.js';
 import { GitStatusService } from './status-service.js';
 import { GitUntrackedFileService } from './untracked-files.js';
+import { PullBackupStore } from '../persistence/pull-backup-store.js';
 
 export class GitService {
   constructor({
@@ -36,6 +37,7 @@ export class GitService {
       statusService: this.statusService,
       untrackedFileService: this.untrackedFileService,
     });
+    this.pullBackupStore = new PullBackupStore({ vaultDir });
   }
 
   async isGitRepo() {
@@ -55,6 +57,14 @@ export class GitService {
     return this.statusService.getStatus(options);
   }
 
+  async listPullBackups() {
+    if (!(await this.isGitRepo())) {
+      return [];
+    }
+
+    return this.pullBackupStore.listBackups();
+  }
+
   async stageFile(path) {
     const normalizedPath = normalizeRelativeGitPath(path);
     await this.commandRunner.execGit(['add', '-A', '--', normalizedPath]);
@@ -131,7 +141,45 @@ export class GitService {
     }
 
     const beforeRef = await this.getHeadRef();
-    const output = await this.commandRunner.execGit(['pull', '--ff-only']);
+    await this.fetchUpstream(status.branch.upstream);
+
+    const targetRef = await this.resolveRef(status.branch.upstream);
+    if (!targetRef) {
+      throw createGitRequestError(409, 'Unable to resolve upstream branch for pull');
+    }
+
+    if (!(await this.canFastForwardTo(targetRef))) {
+      throw createGitRequestError(
+        409,
+        'Cannot pull because local and remote commits have diverged; fast-forward only pull is not possible.',
+        'pull_diverged_ff_only',
+      );
+    }
+
+    const dirtyEntries = this.collectDirtyEntries(status);
+    const upstreamWorkspaceChange = await this.createWorkspaceChangeFromRefs(beforeRef, targetRef);
+    const overlappingEntries = this.findOverlappingDirtyEntries({
+      dirtyEntries,
+      workspaceChange: upstreamWorkspaceChange,
+    });
+
+    let pullBackup = null;
+    if (overlappingEntries.length > 0) {
+      pullBackup = await this.backupAndClearOverlappingEntries({
+        beforeRef,
+        branchName: status.branch?.name ?? null,
+        entries: overlappingEntries,
+        targetRef,
+      });
+    }
+
+    let output;
+    try {
+      output = await this.commandRunner.execGit(['pull', '--ff-only', '--autostash']);
+    } catch (error) {
+      throw await this.classifyPullError(error);
+    }
+
     const afterRef = await this.getHeadRef();
     this.invalidateStatusCache();
     return {
@@ -139,6 +187,7 @@ export class GitService {
       beforeRef,
       ok: true,
       output: output.trim(),
+      pullBackup,
       workspaceChange: await this.createWorkspaceChangeFromRefs(beforeRef, afterRef),
     };
   }
@@ -202,6 +251,171 @@ export class GitService {
     }
   }
 
+  async resolveRef(ref) {
+    try {
+      const output = await this.commandRunner.execGit(['rev-parse', ref]);
+      return output.trim() || null;
+    } catch {
+      return null;
+    }
+  }
+
+  async fetchUpstream(upstreamRef) {
+    const remoteName = String(upstreamRef ?? '').split('/')[0] || null;
+    await this.commandRunner.execGit(remoteName
+      ? ['fetch', '--prune', remoteName]
+      : ['fetch', '--prune']);
+  }
+
+  async canFastForwardTo(targetRef) {
+    const headRef = await this.getHeadRef();
+    if (!headRef || !targetRef || headRef === targetRef) {
+      return true;
+    }
+
+    try {
+      await this.commandRunner.execGit(['merge-base', '--is-ancestor', headRef, targetRef]);
+      return true;
+    } catch (error) {
+      if (error?.code === 1) {
+        return false;
+      }
+      throw error;
+    }
+  }
+
+  collectDirtyEntries(status = {}) {
+    const entries = new Map();
+    for (const section of status.sections ?? []) {
+      for (const file of section.files ?? []) {
+        if (!file?.path) {
+          continue;
+        }
+
+        const existing = entries.get(file.path) ?? {
+          hasStagedChanges: false,
+          hasWorkingTreeChanges: false,
+          hasTrackedChanges: false,
+          isUntracked: false,
+          oldPath: null,
+          path: file.path,
+          touchPaths: new Set(),
+        };
+
+        existing.isUntracked = existing.isUntracked || file.scope === 'untracked';
+        existing.hasStagedChanges = existing.hasStagedChanges || file.scope === 'staged';
+        existing.hasWorkingTreeChanges = existing.hasWorkingTreeChanges || file.scope === 'working-tree';
+        existing.hasTrackedChanges = existing.hasTrackedChanges || file.scope === 'staged' || file.scope === 'working-tree';
+        if (!existing.oldPath && file.oldPath) {
+          existing.oldPath = file.oldPath;
+        }
+        existing.touchPaths.add(file.path);
+        if (file.oldPath) {
+          existing.touchPaths.add(file.oldPath);
+        }
+        entries.set(file.path, existing);
+      }
+    }
+
+    return Array.from(entries.values());
+  }
+
+  findOverlappingDirtyEntries({ dirtyEntries = [], workspaceChange = createEmptyWorkspaceChange() } = {}) {
+    const upstreamTouchedPaths = new Set([
+      ...(workspaceChange.changedPaths ?? []),
+      ...(workspaceChange.deletedPaths ?? []),
+      ...((workspaceChange.renamedPaths ?? []).flatMap((entry) => [entry.oldPath, entry.newPath])),
+    ].filter(Boolean));
+
+    return dirtyEntries.filter((entry) => Array.from(entry.touchPaths).some((path) => upstreamTouchedPaths.has(path)));
+  }
+
+  async createPatchForEntry(entry, { cached = false } = {}) {
+    const pathspecs = Array.from(entry?.touchPaths ?? []).filter(Boolean);
+    if (pathspecs.length === 0) {
+      return null;
+    }
+
+    const output = await this.commandRunner.execGit([
+      'diff',
+      '--binary',
+      '--find-renames',
+      ...(cached ? ['--cached'] : []),
+      '--',
+      ...pathspecs,
+    ]);
+
+    return output || null;
+  }
+
+  async backupAndClearOverlappingEntries({
+    beforeRef,
+    branchName = null,
+    entries = [],
+    targetRef = null,
+  } = {}) {
+    const backupEntries = await Promise.all(entries.map(async (entry) => ({
+      ...entry,
+      stagedPatchContent: entry.hasStagedChanges
+        ? await this.createPatchForEntry(entry, { cached: true })
+        : null,
+      worktreePatchContent: entry.hasWorkingTreeChanges
+        ? await this.createPatchForEntry(entry, { cached: false })
+        : null,
+    })));
+
+    const pullBackup = await this.pullBackupStore.createBackup({
+      branch: branchName,
+      entries: backupEntries,
+      headRef: beforeRef,
+      targetRef,
+    });
+
+    for (const entry of backupEntries) {
+      if (entry.isUntracked && !entry.hasTrackedChanges) {
+        await this.commandRunner.execGit(['clean', '-f', '--', entry.path]);
+        continue;
+      }
+
+      await this.restorePathToHead(entry.path);
+    }
+
+    return pullBackup;
+  }
+
+  async restorePathToHead(path) {
+    const normalizedPath = normalizeRelativeGitPath(path);
+    const sourceRef = 'HEAD';
+    const existsOnSource = await this.pathExistsAtRef(sourceRef, normalizedPath);
+
+    if (existsOnSource) {
+      await this.commandRunner.execGit(['restore', '--source', sourceRef, '--staged', '--worktree', '--', normalizedPath]);
+      return;
+    }
+
+    await this.commandRunner.execGit(['rm', '-f', '--ignore-unmatch', '--', normalizedPath]);
+    await this.commandRunner.execGit(['clean', '-f', '--', normalizedPath]);
+  }
+
+  async hasConflictedStatus() {
+    const status = await this.getStatus({ force: true });
+    return (status.sections ?? [])
+      .flatMap((section) => section.files ?? [])
+      .some((file) => file?.status === 'conflicted');
+  }
+
+  async classifyPullError(error) {
+    if (await this.hasConflictedStatus()) {
+      return createGitRequestError(
+        409,
+        'Pull applied remote updates, but reapplying local changes caused conflicts. Review the conflicted files and the pull backup summary.',
+        'pull_conflicted_after_autostash',
+      );
+    }
+
+    return error;
+  }
+
   async createWorkspaceChangeFromRefs(beforeRef, afterRef) {
     if (!afterRef || beforeRef === afterRef) {
       return createEmptyWorkspaceChange();

package/src/server/infrastructure/http/create-git-api-command-handler.js

@@ -16,7 +16,11 @@ async function parseRequiredBody(req, res, fieldName) {
 function handleGitError(req, res, error, logMessage, fallbackMessage) {
   const statusCode = getRequestErrorStatusCode(error);
   if (statusCode) {
-    jsonResponse(req, res, statusCode, { error: error.message });
+    const payload = { error: error.message };
+    if (typeof error?.requestCode === 'string') {
+      payload.code = error.requestCode;
+    }
+    jsonResponse(req, res, statusCode, payload);
     return true;
   }
 
@@ -47,6 +51,7 @@ async function applyWorkspaceMutationEffects({
   }
 
   await vaultFileStore?.reconcileSidecars?.(workspaceChange);
+  await vaultFileStore?.reconcileCollaborationSnapshots?.(workspaceChange);
   await backlinkIndex?.build?.();
   await roomRegistry?.reconcileWorkspaceChange?.(workspaceChange);
   return responsePayload;

package/src/server/infrastructure/http/create-git-api-query-handler.js

@@ -21,7 +21,11 @@ function isTruthyParam(value) {
 function handleGitError(req, res, error, message, fallback) {
   const statusCode = getRequestErrorStatusCode(error);
   if (statusCode) {
-    jsonResponse(req, res, statusCode, { error: error.message });
+    const payload = { error: error.message };
+    if (typeof error?.requestCode === 'string') {
+      payload.code = error.requestCode;
+    }
+    jsonResponse(req, res, statusCode, payload);
     return true;
   }
 
@@ -57,6 +61,17 @@ export function createGitApiQueryHandler({ gitService }) {
       return true;
     }
 
+    if (requestUrl.pathname === '/api/git/pull-backups' && req.method === 'GET') {
+      try {
+        jsonResponse(req, res, 200, {
+          backups: await gitService.listPullBackups(),
+        });
+      } catch (error) {
+        handleGitError(req, res, error, '[api] Failed to read pull backups:', 'Failed to read pull backups');
+      }
+      return true;
+    }
+
     return false;
   };
 }

package/src/server/infrastructure/http/create-vault-api-command-handler.js

@@ -3,9 +3,22 @@ import {
   isMermaidFilePath,
   isPlantUmlFilePath,
 } from '../../../domain/file-kind.js';
-import { getRequestErrorStatusCode } from './http-errors.js';
+import { createRequestError, getRequestErrorStatusCode } from './http-errors.js';
 import { jsonResponse } from './http-response.js';
-import { parseJsonBody } from './request-body.js';
+import { parseJsonBody, readBinaryRequestBody } from './request-body.js';
+
+function decodeHeaderMetadata(value) {
+  const normalized = String(value ?? '').trim();
+  if (!normalized) {
+    return '';
+  }
+
+  try {
+    return decodeURIComponent(normalized);
+  } catch {
+    throw createRequestError(400, 'Invalid attachment metadata header encoding');
+  }
+}
 
 function selectWriteOperation(vaultFileStore, filePath, content) {
   if (isExcalidrawFilePath(filePath)) {
@@ -62,6 +75,39 @@ export function createVaultApiCommandHandler({
       return true;
     }
 
+    if (requestUrl.pathname === '/api/attachments' && req.method === 'POST') {
+      try {
+        const sourceDocumentPath = decodeHeaderMetadata(req.headers['x-collabmd-source-path']);
+        const originalFileName = decodeHeaderMetadata(req.headers['x-collabmd-file-name']);
+        const mimeType = String(req.headers['content-type'] || '').trim();
+
+        if (!sourceDocumentPath) {
+          jsonResponse(req, res, 400, { error: 'Missing source document path' });
+          return true;
+        }
+
+        const content = await readBinaryRequestBody(req);
+        const result = await vaultFileStore.writeImageAttachmentForDocument(sourceDocumentPath, {
+          content,
+          mimeType,
+          originalFileName,
+        });
+        if (!result.ok) {
+          jsonResponse(req, res, 400, { error: result.error });
+          return true;
+        }
+
+        jsonResponse(req, res, 201, {
+          markdown: result.markdownSnippet,
+          ok: true,
+          path: result.path,
+        });
+      } catch (error) {
+        handleVaultError(req, res, error, '[api] Failed to upload attachment:', 'Failed to upload attachment');
+      }
+      return true;
+    }
+
     if (requestUrl.pathname === '/api/file' && req.method === 'POST') {
       try {
         const body = await parseJsonBody(req);

package/src/server/infrastructure/http/create-vault-api-query-handler.js

@@ -1,9 +1,44 @@
+import { basename } from 'node:path';
+
 import {
   isExcalidrawFilePath,
+  isImageAttachmentFilePath,
   isMermaidFilePath,
   isPlantUmlFilePath,
 } from '../../../domain/file-kind.js';
-import { jsonResponse } from './http-response.js';
+import { jsonResponse, sendResponse } from './http-response.js';
+
+const SVG_MIME_TYPE = 'image/svg+xml';
+const SVG_ATTACHMENT_CSP = "default-src 'none'; img-src 'self' data: blob:; style-src 'unsafe-inline'; sandbox";
+
+function encodeContentDispositionFilename(fileName) {
+  return encodeURIComponent(String(fileName ?? ''))
+    .replace(/['()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+
+function createSafeAsciiFilename(fileName) {
+  const fallback = String(fileName ?? '')
+    .replace(/[^\x20-\x7E]+/g, '_')
+    .replace(/["\\]/g, '_')
+    .trim();
+  return fallback || 'attachment';
+}
+
+function createAttachmentHeaders(attachment) {
+  const fileName = basename(String(attachment?.path ?? 'attachment'));
+  const headers = {
+    'Cache-Control': 'private, max-age=300, stale-while-revalidate=3600',
+    'Content-Disposition': `inline; filename="${createSafeAsciiFilename(fileName)}"; filename*=UTF-8''${encodeContentDispositionFilename(fileName)}`,
+    'Content-Type': attachment.mimeType,
+    'X-Content-Type-Options': 'nosniff',
+  };
+
+  if (attachment?.mimeType === SVG_MIME_TYPE) {
+    headers['Content-Security-Policy'] = SVG_ATTACHMENT_CSP;
+  }
+
+  return headers;
+}
 
 function selectReadOperation(vaultFileStore, filePath) {
   if (isExcalidrawFilePath(filePath)) {
@@ -58,6 +93,37 @@ export function createVaultApiQueryHandler({
       return true;
     }
 
+    if (requestUrl.pathname === '/api/attachment' && req.method === 'GET') {
+      const filePath = requestUrl.searchParams.get('path');
+      if (!filePath) {
+        jsonResponse(req, res, 400, { error: 'Missing path parameter' });
+        return true;
+      }
+
+      if (!isImageAttachmentFilePath(filePath)) {
+        jsonResponse(req, res, 400, { error: 'Unsupported attachment path' });
+        return true;
+      }
+
+      try {
+        const attachment = await vaultFileStore.readImageAttachmentFile(filePath);
+        if (!attachment) {
+          jsonResponse(req, res, 404, { error: 'Attachment not found' });
+          return true;
+        }
+
+        sendResponse(req, res, {
+          body: attachment.content,
+          headers: createAttachmentHeaders(attachment),
+          statusCode: 200,
+        });
+      } catch (error) {
+        console.error('[api] Failed to read attachment:', error.message);
+        jsonResponse(req, res, 500, { error: 'Failed to read attachment' });
+      }
+      return true;
+    }
+
     if (requestUrl.pathname === '/api/backlinks' && req.method === 'GET') {
       const filePath = requestUrl.searchParams.get('file');
       if (!filePath) {