collabmd 0.1.48 → 0.1.49

package/README.md

@@ -26,7 +26,7 @@ Throughout this guide, **vault** simply means a regular folder on your computer
 
 Requirements for the fastest first run:
 
-- Node.js 24 for `npx` and source installs
+- Node.js 26 for `npx` and source installs
 - ripgrep for global text search (`rg`; included in the Docker image)
 - Homebrew only if you want the `brew install` path
 
@@ -66,6 +66,8 @@ Prefer video? [Open the WebM demo](https://raw.githubusercontent.com/andes90/col
 - **Realtime collaboration** — multiple people can edit the same file at the same time via Yjs
 - **External edit sync** — changes made from tools like Obsidian or direct file writes are reflected back into open documents and the file explorer
 - **Git review** — review an open file's changes, include them in the next commit, and commit with a message from the browser
+- **Experimental WebMCP workspace access** — supported browser agents can use the same Vault search, read, exact-edit, document-creation, syntax, and Excalidraw tools as remote MCP while acting as the logged-in collaborator
+- **Remote AI agent access** — connect any Streamable HTTP MCP client to search, cite, edit, and create supported Vault Content; protected workspaces use scoped, revocable Agent Connections
 - **File upload** — import multiple supported Markdown, HTML, Base, diagram, image, and PDF files into the vault from the file explorer
 - **Markdown with context** — live preview, wiki-links, backlinks, outline, quick switcher, and scroll sync
 - **Global text search** — search text across supported vault files with ripgrep-backed results grouped by file
@@ -88,7 +90,7 @@ Prefer video? [Open the WebM demo](https://raw.githubusercontent.com/andes90/col
 ### Requirements
 
 - macOS, Linux, or Windows (via WSL2)
-- Node.js 24 for `npx` and source installs
+- Node.js 26 for `npx` and source installs
 - ripgrep for global text search. Install with `brew install ripgrep` on macOS, `apk add ripgrep` on Alpine, or `apt install ripgrep` on Debian/Ubuntu. Docker images already include it.
 
 ### Run via npx (Node.js)
@@ -165,12 +167,61 @@ Then share the printed URL and password with your collaborator. If `cloudflared`
 - If `cloudflared` is installed, CollabMD may expose the app through a Cloudflare Quick Tunnel unless you pass `--no-tunnel`
 - `--auth oidc` requires a stable `PUBLIC_BASE_URL`; Quick Tunnel URLs are not supported for OIDC
 
+## Connect an AI agent
+
+Enable MCP Streamable HTTP access:
+
+```bash
+COLLABMD_AGENT_ACCESS_ENABLED=true collabmd --no-tunnel
+```
+
+CollabMD exposes `/mcp`, or `<BASE_PATH>/mcp` when a base path is configured, with these tools:
+
+- `list_documents`, `list_workspace_entries`, `search_vault`, and `read_document`
+- `inspect_document_references` for resolved and missing wiki-links, embeds, public video embeds, and backlinks
+- `validate_document` for missing Markdown references and unsupported public video embeds
+- `render_diagram` for standalone or fenced PlantUML through remote MCP and Mermaid or PlantUML through WebMCP
+- `apply_text_edits` with exact replacements and revision conflict protection
+- `create_document`
+- `create_excalidraw` and `edit_excalidraw` for canonical element creation, updates, relationship-aware translation, standalone text auto-resizing, same-ID replacement, explicit paint-order changes, deletion, and optional same-revision verification
+- `inspect_excalidraw` for paint order, bounds, bindings, text layout properties, distant bound endpoints, connector/component intersections, unintended overlaps, occlusion, clipping, and validity warnings
+- `render_excalidraw` for PNG or SVG verification previews with renderer and parity metadata
+- `verify_excalidraw` to inspect and render one exact revision with compact inspection; use `inspect_excalidraw` for per-element summaries
+- `get_collabmd_syntax`
+
+`search_vault` uses the server's ripgrep installation. Install `rg` on source or npm deployments; the Docker image already includes it.
+
+Agent text writes support Markdown, HTML, Mermaid, PlantUML, and Structurizr. Excalidraw writes use the dedicated element tools. Base, draw.io, PDF, images, delete, rename, Git, and publish are not writable through Agent Access.
+
+Remote MCP renders PlantUML through the configured PlantUML service; Mermaid rendering requires WebMCP because Mermaid needs a browser layout engine. Remote MCP Excalidraw rendering uses the basic element types supported by the agent tools. The `collabmd-basic-svg` renderer is intended for layout verification rather than pixel-identical Excalidraw reproduction and returns `preview-not-pixel-identical`. WebMCP replaces these previews with Excalidraw's official browser renderer.
+
+With password or OIDC auth, open **More actions → Connect AI Agent** after signing in. Create a named connection, choose read/edit scope, and copy the token shown once. Tokens expire after 30 days by default and can be revoked from the same dialog. OIDC connections retain Collaborator attribution; shared-password connections are workspace-level because password sessions have no individual identity.
+
+Use these connection details with any Streamable HTTP MCP client:
+
+```text
+URL: https://notes.example.com/mcp
+Transport: Streamable HTTP
+Authorization: Bearer <token>
+```
+
+For protected workspaces, configure the generated token as a bearer credential in the MCP client. For `AUTH_STRATEGY=none`, omit the bearer token; MCP uses the same anonymous access policy as the web app, so anyone who can reach `/mcp` can read, edit, and create supported Vault Content.
+
+CollabMD uses preconfigured bearer credentials rather than MCP OAuth enrollment.
+
+The `Authorization` header is required for password and OIDC workspaces. Omit it for `AUTH_STRATEGY=none`.
+
+Remote endpoints should use HTTPS. `COLLABMD_AGENT_ALLOWED_HOSTS` adds comma-separated MCP hostnames accepted for password/OIDC requests and browser-origin requests. OIDC automatically allows the hostname from `PUBLIC_BASE_URL`; localhost is always allowed. Native no-auth MCP clients normally omit `Origin` and remain anonymous; browser-origin MCP requests must use an allowed hostname to prevent DNS rebinding.
+
+Vault text returned to an agent is untrusted input. Never paste managed Agent Access tokens into agent prompts or chat history. Treat every no-auth workspace URL as anonymous automated write access to the Vault.
+
 ## Current limitations
 
 - Single-instance deployment only: collaboration room state is kept in-process and is not shared across replicas
 - `oidc` currently supports Google only
 - Hosted workspace mode currently provides the backend/API surface; Team Settings UI, invitation email delivery, GitHub callback redirect polish, and GitHub App checkout/publish wiring are still pending
 - Text-anchored comments support markdown, Mermaid, PlantUML, and Structurizr DSL files. Excalidraw supports element-anchored threads; draw.io comments are not supported
+- WebMCP requires experimental browser support and an active CollabMD tab; for local Chrome testing, enable `chrome://flags/#enable-webmcp-testing`. It uses the browser session rather than an Agent Connection and does not provide remote access, per-agent scopes, delete, rename, attachments, Git, commit, or publish tools
 - Windows use is supported via WSL2 rather than native Windows execution
 
 ## How it works
@@ -183,7 +234,7 @@ CollabMD starts a local server, scans the vault, and opens a browser-based edito
 
 - **File explorer sidebar** — upload, browse, create, rename, and delete `.md`, `.markdown`, `.mdx`, `.html`, `.htm`, `.base`, `.mmd`, `.mermaid`, `.puml`, `.plantuml`, `.dsl`, `.excalidraw`, `.drawio`, `.pdf`, and supported image files plus folders
 - **Live preview** — rendered as you type, with sandboxed static HTML, syntax-highlighted code blocks, public video embeds, plus Mermaid, PlantUML, and Structurizr diagrams
-- **Anchored comments** — add comments from the editor or selected Excalidraw elements, reopen threads in context, and review them from the comments drawer
+- **Anchored comments and diagram links** — add comments from the editor or selected Excalidraw elements, reopen threads in context, and link Excalidraw elements to other vault diagrams with focused navigation
 - **`[[wiki-links]]` + backlinks** — jump between notes and inspect linked mentions
 - **Room chat** — discuss changes without leaving the workspace
 - **Presence + follow mode** — see who is online and follow another collaborator's active cursor
@@ -452,7 +503,7 @@ For a full local and Docker test walkthrough, including key generation and deplo
 
 When `COLLABMD_GIT_REPO_URL` is set, CollabMD clones into `COLLABMD_VAULT_DIR` on first boot, then reuses that checkout on later starts. If the checkout already exists, startup validates that `origin` matches. Clean checkouts are fast-forwarded to the remote default branch; dirty checkouts are reused as-is and startup skips the sync.
 
-After bootstrap, CollabMD adds `.collabmd/` to the checkout's local git exclude file at `.git/info/exclude` so runtime metadata stays out of git status without modifying the repo's tracked `.gitignore`.
+On every startup, CollabMD adds `.collabmd/` to the vault's local git exclude file at `.git/info/exclude` so runtime metadata stays out of git status and bulk staging without modifying the repository's tracked `.gitignore`.
 
 File-based secrets are also supported and take precedence over base64 input:
 
@@ -557,7 +608,7 @@ Health check: `GET /health`
 
 ## Troubleshooting
 
-- `npx collabmd@latest` fails immediately: confirm you are running Node.js 24, which is the supported runtime for source and npm usage
+- `npx collabmd@latest` fails immediately: confirm you are running Node.js 26, which is the supported runtime for source and npm usage
 - The app is reachable only from localhost: pass `--host 0.0.0.0` or set `HOST=0.0.0.0` when you intend to expose it on your network
 - Port `1234` is already in use: pass `--port 3000` or set `PORT` to another free port
 - Tunnel did not start: install `cloudflared`, or pass `--no-tunnel` to stay local-only
@@ -682,6 +733,11 @@ vite.config.mjs            Vite multi-page build and dev-server proxy config
 | `AUTH_OIDC_CLIENT_SECRET` | Google OAuth client secret used for `AUTH_STRATEGY=oidc` | |
 | `AUTH_OIDC_ALLOWED_EMAILS` | Comma-separated exact email allowlist for `AUTH_STRATEGY=oidc` | |
 | `AUTH_OIDC_ALLOWED_DOMAINS` | Comma-separated email domain allowlist for `AUTH_STRATEGY=oidc` | |
+| `COLLABMD_AGENT_ACCESS_ENABLED` | Enable scoped MCP Agent Access | `false` |
+| `COLLABMD_AGENT_ALLOWED_HOSTS` | Extra comma-separated MCP hostnames accepted for password/OIDC and browser-origin requests | |
+| `COLLABMD_AGENT_REQUESTS_PER_MINUTE` | Maximum MCP tool calls per managed connection or anonymous client address each minute | `120` |
+| `COLLABMD_AGENT_CONNECTION_TTL_MS` | Managed Agent Connection lifetime in milliseconds | `2592000000` |
+| `COLLABMD_AGENT_METADATA_DB_PATH` | SQLite path for managed Agent Connections | `<vault>/.collabmd/agent-access.sqlite` |
 | `BASE_PATH` | URL path prefix for subpath deployments | |
 | `COLLABMD_HOSTED_ENABLED` | Enable single-tenant hosted workspace mode; requires `AUTH_STRATEGY=oidc` | `false` |
 | `COLLABMD_HOSTED_METADATA_DB_PATH` | SQLite database path for hosted workspace metadata | `<vault>/.collabmd/hosted.sqlite` |

package/bin/collabmd.js

@@ -225,6 +225,9 @@ try {
   } else {
     console.log('  Auth:   none');
   }
+  if (config.agentAccess?.enabled) {
+    console.log(`  Agent: http://${info.host}:${info.port}${config.agentAccess.endpoint}`);
+  }
 
   if (enableTunnel) {
     console.log('  Tunnel: starting...');

package/dist/client/assets/CodeMirrorEditor-UCMRAMCV-C-nmgL5g.js

@@ -0,0 +1 @@
+import{i as e}from"./rolldown-runtime-Dd_uD5pT.js";import{n as t,t as n}from"./jsx-runtime-BpzPEenQ.js";import"./chunk-SRAX5OIU-KFQikY-4.js";import{B as r,L as i,N as a,Q as o,R as s,W as c,Z as l,c as u,dt as d,et as f,pt as p,t as m}from"./dist-RKBTaQMb.js";import{a as h,o as g,p as _,s as v}from"./dist-ByrG2qBA.js";var y=e(t(),1),b=n(),x=u.define({token(e){return e.match(/^%%.*$/)?`comment`:e.match(/^"(?:[^"\\]|\\.)*"/)?`string`:e.match(/^(flowchart|graph|sequenceDiagram|classDiagram|stateDiagram|erDiagram|gantt|pie|mindmap|journey|gitGraph|timeline|quadrantChart|sankey|xychart)\b/i)||e.match(/^(TB|TD|BT|RL|LR)\b/)||e.match(/^(subgraph|end|participant|actor|loop|alt|else|opt|par|critical|break|rect|note|over|activate|deactivate|title|section|class|style|linkStyle|classDef|click)\b/i)?`keyword`:e.match(/^[-.=<>|ox]+>/)||e.match(/^<[-.=<>|ox]+/)||e.match(/^--+|\.\.+|==+/)?`operator`:e.match(/^[[\](){}|<>]/)?`bracket`:e.match(/^[A-Za-z_][A-Za-z0-9_]*/)?`variableName`:e.match(/^\d+(\.\d+)?/)?`number`:e.match(/^[,:;]/)?`punctuation`:(e.eatSpace()||e.next(),null)}});function S(){return x}var C=r.theme({"&":{backgroundColor:`#1e1e1e`,color:`#d4d4d4`},".cm-content":{caretColor:`#fff`},".cm-cursor":{borderLeftColor:`#fff`},".cm-gutters":{backgroundColor:`#1e1e1e`,color:`#858585`,border:`none`},".cm-activeLineGutter":{backgroundColor:`#2a2a2a`},".cm-activeLine":{backgroundColor:`#2a2a2a`},".cm-errorLine":{backgroundColor:`rgba(255, 0, 0, 0.15)`}},{dark:!0}),w=m.define([{tag:i.keyword,color:`#569cd6`},{tag:i.string,color:`#ce9178`},{tag:i.comment,color:`#6a9955`},{tag:i.number,color:`#b5cea8`},{tag:i.operator,color:`#d4d4d4`},{tag:i.punctuation,color:`#d4d4d4`},{tag:i.variableName,color:`#9cdcfe`},{tag:i.bracket,color:`#ffd700`}]),T=r.theme({"&":{backgroundColor:`#ffffff`,color:`#1e1e1e`},".cm-content":{caretColor:`#000`},".cm-cursor":{borderLeftColor:`#000`},".cm-gutters":{backgroundColor:`#fff`,color:`#999`,border:`none`},".cm-activeLineGutter":{backgroundColor:`#e8e8e8`},".cm-activeLine":{backgroundColor:`#e8e8e8`},".cm-errorLine":{backgroundColor:`rgba(255, 0, 0, 0.1)`}}),E=m.define([{tag:i.keyword,color:`#0000ff`},{tag:i.string,color:`#a31515`},{tag:i.comment,color:`#008000`},{tag:i.number,color:`#098658`},{tag:i.operator,color:`#1e1e1e`},{tag:i.punctuation,color:`#1e1e1e`},{tag:i.variableName,color:`#001080`},{tag:i.bracket,color:`#af00db`}]),D=s.line({class:`cm-errorLine`}),O=(e,t)=>{if(!e||e<1||e>t.lines)return r.decorations.of(s.none);let n=t.line(e);return r.decorations.of(s.set([D.range(n.from)]))},k=e=>e===`dark`?[C,a(w)]:[T,a(E)],A=({value:e,onChange:t,onKeyboardSubmit:n,placeholder:i,theme:a,errorLine:s})=>{let u=(0,y.useRef)(null),m=(0,y.useRef)(null),x=(0,y.useRef)(t),C=(0,y.useRef)(n),w=(0,y.useRef)(new d),T=(0,y.useRef)(new d);return x.current=t,C.current=n,(0,y.useEffect)(()=>{if(!u.current)return;let t=w.current,n=new r({state:p.create({doc:e,extensions:[l.of([{key:`Mod-Enter`,run:()=>(C.current?.(),!0)},{key:`Mod-Shift-z`,run:_,preventDefault:!0}]),r.updateListener.of(e=>{e.docChanged&&x.current(e.state.doc.toString())}),g(),l.of([...h,...v]),o(),r.lineWrapping,t.of(k(a)),T.current.of([]),S(),c({drawRangeCursor:!0}),...i?[f(i)]:[]]}),parent:u.current});return m.current=n,n.focus(),()=>{n.destroy(),m.current=null}},[]),(0,y.useEffect)(()=>{let e=m.current;e&&e.dispatch({effects:w.current.reconfigure(k(a))})},[a]),(0,y.useEffect)(()=>{let e=m.current;e&&e.dispatch({effects:T.current.reconfigure(O(s,e.state.doc))})},[s]),(0,y.useEffect)(()=>{let t=m.current;if(!t)return;let n=t.state.doc.toString();e!==n&&t.dispatch({changes:{from:0,to:n.length,insert:e}})},[e]),(0,b.jsx)(`div`,{ref:u,className:`ttd-dialog-input ttd-dialog-input--codemirror`})};export{A as default};

package/dist/client/assets/abnfDiagram-VCTEODGH-CdVZqicp.js

@@ -0,0 +1 @@
+import{n as e}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{m as t}from"./src-oBChb5qS.js";import"./chunk-DU6HZSFF-Zkp69c6c.js";import"./chunk-CLGD4ZFX-BMeArk03.js";import{n}from"./chunk-XHIXRSVI-BFQ6B8BE.js";import{n as r,r as i,t as a}from"./chunk-SVP7TREG-DB485R5x.js";import{t as o}from"./chunk-JWPE2WC7-DVXcaiue.js";import{t as s}from"./mermaid-parser.core-Bl0efOMt.js";var c=n().RailroadAbnf.parser.LangiumParser,l=e(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=e(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=e(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=e(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=e(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=e(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=e(e=>{o(e,a),e.title&&a.setTitle(e.title),e.rules.map(e=>a.addRule(m(e)))},`populateDb`),g={parser:{parse:e(e=>{a.clear(),t.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new s(n);let r=n.value;t.debug(`[ABNF Parser] Parsed rules:`,r.rules.length),h(r),t.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:a}},db:a,renderer:i,styles:r};export{g as diagram};