collabmd 0.1.49 → 0.1.52

package/src/server/application/agent-content-service.js

@@ -10,18 +10,25 @@ import { listRenderableDiagrams, resolveRenderableDiagram } from '../../domain/d
 import { createEditableContentRevision } from '../../domain/editable-content-revision.js';
 import { normalizeEditableText } from '../../domain/editable-text.js';
 import { applyExactTextChanges, resolveExactTextChanges } from '../../domain/exact-text-edits.js';
-import { applyAgentExcalidrawEdits, createAgentExcalidrawScene } from '../../domain/excalidraw-agent-scene.js';
+import {
+  applyAgentExcalidrawEditsWithSummary,
+  createAgentExcalidrawScene,
+} from '../../domain/excalidraw-agent-scene.js';
 import { inspectAgentExcalidrawScene, renderAgentExcalidrawSvg } from '../../domain/excalidraw-agent-verification.js';
-import { getVaultFileKind } from '../../domain/file-kind.js';
+import { getVaultFileKind, isBaseFilePath } from '../../domain/file-kind.js';
+import { collectMarkdownOutline } from '../../domain/markdown-outline.js';
+import { isWholeWordMatch } from '../../domain/literal-text-search.js';
 import { createWikiTargetIndex } from '../../domain/wiki-link-resolver.js';
 import {
   classifyPublicVideoEmbed,
   isPublicVideoEmbedCandidate,
 } from '../../domain/video-embed.js';
+import { isPlainObject, parseBaseSource } from '../domain/bases/base-definition.js';
 import {
   collectMarkdownImageSources,
   collectMarkdownReferences,
 } from '../domain/markdown-reference-extractor.js';
+import { searchExcalidrawSceneText } from '../domain/ripgrep-search-service.js';
 import { compareWorkspacePaths, normalizeWorkspacePath } from '../domain/workspace-state.js';
 
 const MAX_DOCUMENT_CHARACTERS = 200_000;
@@ -32,6 +39,35 @@ const MAX_REPLACEMENTS = 20;
 const MAX_REPLACEMENT_CHARACTERS = 50_000;
 const EMBEDDABLE_KINDS = new Set(['base', 'drawio', 'excalidraw', 'image', 'mermaid', 'plantuml']);
 
+function assertValidAgentBaseContent(path, content) {
+  if (!isBaseFilePath(path)) return;
+  try {
+    const raw = parseBaseSource(content);
+    if (raw != null && !isPlainObject(raw)) {
+      throw new Error('Base source must be a YAML object');
+    }
+  } catch (error) {
+    throw createAgentContentError('AGENT_INVALID_BASE', error.message || 'Base source is invalid', 400);
+  }
+}
+
+function toAgentBaseQueryResult(path, { columns, rows, view }, limit) {
+  return {
+    columns: columns.map(({ id, label }) => ({ id, label })),
+    path,
+    rows: rows.slice(0, limit).map((row) => ({
+      cells: Object.fromEntries(columns.map(({ id }) => [id, String(row.cells[id]?.text ?? '')])),
+      path: row.path,
+    })),
+    totalRows: rows.length,
+    truncated: rows.length > limit,
+    view: {
+      name: view.name,
+      type: view.type,
+    },
+  };
+}
+
 function createAgentContentError(code, message, statusCode = 400) {
   const error = new Error(message);
   error.code = code;
@@ -101,7 +137,7 @@ function createInlineExcalidrawVerification(scene, options, { deferRender = fals
   return verification;
 }
 
-function searchLiveText(content, query, maxSnippets = 5) {
+function searchLiveText(content, query, maxSnippets = 5, wholeWord = false) {
   const normalizedQuery = query.toLocaleLowerCase();
   const snippets = [];
   let matchCount = 0;
@@ -109,17 +145,19 @@ function searchLiveText(content, query, maxSnippets = 5) {
     const normalizedLine = lineText.toLocaleLowerCase();
     let start = normalizedLine.indexOf(normalizedQuery);
     while (start >= 0) {
-      matchCount += 1;
-      if (snippets.length < maxSnippets) {
-        const snippetStart = Math.max(0, start - 90);
-        const snippetEnd = Math.min(lineText.length, start + query.length + 90);
-        snippets.push({
-          column: start + 1,
-          line: lineIndex + 1,
-          matchEnd: start - snippetStart + query.length + (snippetStart > 0 ? 3 : 0),
-          matchStart: start - snippetStart + (snippetStart > 0 ? 3 : 0),
-          text: `${snippetStart > 0 ? '...' : ''}${lineText.slice(snippetStart, snippetEnd)}${snippetEnd < lineText.length ? '...' : ''}`,
-        });
+      if (!wholeWord || isWholeWordMatch(normalizedLine, start, start + normalizedQuery.length)) {
+        matchCount += 1;
+        if (snippets.length < maxSnippets) {
+          const snippetStart = Math.max(0, start - 90);
+          const snippetEnd = Math.min(lineText.length, start + query.length + 90);
+          snippets.push({
+            column: start + 1,
+            line: lineIndex + 1,
+            matchEnd: start - snippetStart + query.length + (snippetStart > 0 ? 3 : 0),
+            matchStart: start - snippetStart + (snippetStart > 0 ? 3 : 0),
+            text: `${snippetStart > 0 ? '...' : ''}${lineText.slice(snippetStart, snippetEnd)}${snippetEnd < lineText.length ? '...' : ''}`,
+          });
+        }
       }
       start = normalizedLine.indexOf(normalizedQuery, start + Math.max(query.length, 1));
     }
@@ -130,6 +168,7 @@ function searchLiveText(content, query, maxSnippets = 5) {
 export class AgentContentService {
   constructor({
     backlinkIndex = null,
+    baseQueryService = null,
     plantUmlRenderer = null,
     roomRegistry,
     searchService,
@@ -137,6 +176,7 @@ export class AgentContentService {
     workspaceMutationCoordinator,
   }) {
     this.backlinkIndex = backlinkIndex;
+    this.baseQueryService = baseQueryService;
     this.plantUmlRenderer = plantUmlRenderer;
     this.roomRegistry = roomRegistry;
     this.searchService = searchService;
@@ -214,31 +254,13 @@ export class AgentContentService {
     };
   }
 
-  async renderExcalidraw(actor, {
-    format = 'png',
-    padding = 32,
-    path,
-    scale = 1,
-  } = {}) {
-    const current = await this.readExcalidrawScene(actor, path);
-    const result = {
-      elementCount: current.scene.elements.filter((element) => !element.isDeleted).length,
-      format,
-      path: current.path,
-      revision: current.revision,
-      scene: current.scene,
-    };
-    if (actor.origin !== 'webmcp') {
-      Object.assign(result, renderAgentExcalidrawSvg(current.scene, { padding, scale }));
-    }
-    return result;
-  }
 
   async verifyExcalidraw(actor, {
     format = 'png',
     inspectOcclusion = true,
     padding = 32,
     path,
+    render = true,
     scale = 1,
   } = {}) {
     const current = await this.readExcalidrawScene(actor, path);
@@ -250,52 +272,45 @@ export class AgentContentService {
       elementCount: inspection.elementCount,
       format,
       inspection,
+      layout: inspection.layout,
       path: current.path,
       revision: current.revision,
-      scene: current.scene,
+      valid: inspection.valid,
     };
+    if (!render) return result;
+
+    result.scene = current.scene;
     if (actor.origin !== 'webmcp') {
       Object.assign(result, renderAgentExcalidrawSvg(current.scene, { padding, scale }));
     }
     return result;
   }
 
-  listDocuments(actor, { cursor = '', kinds = [], limit = 100, prefix = '' } = {}) {
+  listWorkspaceEntries(actor, {
+    cursor = '',
+    kinds = [],
+    limit = 100,
+    prefix = '',
+    pathQuery = '',
+  } = {}) {
     requireScope(actor, 'vault:read');
     const normalizedPrefix = normalizeWorkspacePath(prefix);
+    const normalizedPathQuery = String(pathQuery).trim().toLocaleLowerCase();
     const kindFilter = new Set(Array.isArray(kinds) ? kinds : []);
     const state = this.workspaceMutationCoordinator?.workspaceState;
-    const documents = Array.from(state?.entries?.values?.() ?? [])
-      .filter((entry) => entry.nodeType !== 'directory' && isAgentReadablePath(entry.path))
-      .filter((entry) => !normalizedPrefix || entry.path === normalizedPrefix || entry.path.startsWith(`${normalizedPrefix}/`))
-      .filter((entry) => kindFilter.size === 0 || kindFilter.has(getVaultFileKind(entry.path)))
-      .sort((left, right) => compareWorkspacePaths(left.path, right.path));
-    const start = cursor ? Math.max(0, documents.findIndex((entry) => entry.path === cursor) + 1) : 0;
-    const pageSize = clampInteger(limit, 100, 1, 200);
-    const page = documents.slice(start, start + pageSize).map((entry) => {
-      const metadata = state?.metadata?.get?.(entry.path);
-      return {
-        kind: getVaultFileKind(entry.path),
-        mtimeMs: Number(metadata?.mtimeMs ?? entry.mtimeMs ?? 0),
-        path: entry.path,
-        size: Number(metadata?.size ?? 0),
-      };
-    });
-    const truncated = start + page.length < documents.length;
-    return {
-      documents: page,
-      nextCursor: truncated ? page.at(-1)?.path ?? null : null,
-      truncated,
-    };
-  }
-  listWorkspaceEntries(actor, { cursor = '', limit = 100, prefix = '' } = {}) {
-    requireScope(actor, 'vault:read');
-    const normalizedPrefix = normalizeWorkspacePath(prefix);
-    const state = this.workspaceMutationCoordinator?.workspaceState;
     const entries = Array.from(state?.entries?.values?.() ?? [])
       .filter((entry) => !normalizedPrefix || entry.path === normalizedPrefix || entry.path.startsWith(`${normalizedPrefix}/`))
+      .filter((entry) => kindFilter.size === 0 || kindFilter.has(getVaultFileKind(entry.path)))
+      .filter((entry) => !normalizedPathQuery || entry.path.toLocaleLowerCase().includes(normalizedPathQuery))
       .sort((left, right) => compareWorkspacePaths(left.path, right.path));
-    const start = cursor ? Math.max(0, entries.findIndex((entry) => entry.path === cursor) + 1) : 0;
+    let start = 0;
+    if (cursor) {
+      const cursorIndex = entries.findIndex((entry) => entry.path === cursor);
+      if (cursorIndex < 0) {
+        throw createAgentContentError('AGENT_CURSOR_INVALID', 'Pagination cursor is no longer valid', 400);
+      }
+      start = cursorIndex + 1;
+    }
     const pageSize = clampInteger(limit, 100, 1, 200);
     const page = entries.slice(start, start + pageSize).map((entry) => {
       const isDirectory = entry.nodeType === 'directory';
@@ -322,73 +337,137 @@ export class AgentContentService {
   }
 
 
-  async searchVault(actor, { limit = 50, query = '', signal = null } = {}) {
+  async searchVault(actor, {
+    kinds = [],
+    limit = 10,
+    maxSnippetsPerFile = 2,
+    prefix = '',
+    query = '',
+    wholeWord = false,
+    signal = null,
+  } = {}) {
     requireScope(actor, 'vault:read');
     const normalizedQuery = String(query ?? '').trim().slice(0, 500);
-    const result = await this.searchService.search({ limit, query: normalizedQuery, signal });
-    if (normalizedQuery.length < 2) return result;
-
+    const normalizedPrefix = normalizeWorkspacePath(prefix);
+    const kindFilter = new Set(Array.isArray(kinds) ? kinds : []);
+    const snippetLimit = clampInteger(maxSnippetsPerFile, 2, 1, 10);
+    const pageSize = clampInteger(limit, 10, 1, 50);
+    const livePaths = new Set();
+    let liveIncomplete = false;
     const liveFiles = [];
-    for (const [path, room] of this.roomRegistry?.getRooms?.() ?? []) {
-      if (!isAgentReadablePath(path) || !room.isHydrated?.()) continue;
-      const content = room.readEditableContent?.();
-      if (content === null || content === undefined) continue;
-      if (content.length > MAX_AGENT_READ_SOURCE_CHARACTERS) continue;
-      const live = searchLiveText(content, normalizedQuery);
+    for (const [path, room] of normalizedQuery.length >= 2 ? this.roomRegistry?.getRooms?.() ?? [] : []) {
+      const kind = getVaultFileKind(path);
+      if (
+        !isAgentReadablePath(path)
+        || (normalizedPrefix && path !== normalizedPrefix && !path.startsWith(`${normalizedPrefix}/`))
+        || (kindFilter.size > 0 && !kindFilter.has(kind))
+      ) continue;
+      livePaths.add(path);
+      const content = room.isHydrated?.()
+        ? room.readEditableContent?.() ?? room.getPersistedContent?.()
+        : null;
+      if (content == null || content.length > MAX_AGENT_READ_SOURCE_CHARACTERS) {
+        liveIncomplete = true;
+        continue;
+      }
+      signal?.throwIfAborted();
+      let live;
+      if (kind === 'excalidraw') {
+        let scene;
+        try {
+          scene = JSON.parse(content);
+        } catch {
+          liveIncomplete = true;
+          continue;
+        }
+        live = searchExcalidrawSceneText(scene, {
+          query: normalizedQuery, maxSnippetsPerFile: snippetLimit, wholeWord,
+        });
+      } else {
+        live = searchLiveText(content, normalizedQuery, snippetLimit, wholeWord);
+      }
       if (live.matchCount > 0) {
-        liveFiles.push({ file: path, kind: getVaultFileKind(path), ...live });
+        liveFiles.push({ file: path, kind, ...live });
       }
     }
-    if (liveFiles.length === 0) return result;
-
-    const livePaths = new Set(liveFiles.map(({ file }) => file));
-    const files = [...result.files.filter(({ file }) => !livePaths.has(file)), ...liveFiles]
-      .sort((left, right) => compareWorkspacePaths(left.file, right.file))
-      .slice(0, clampInteger(limit, 50, 1, 50));
+    const result = await this.searchService.search({
+      excludedPaths: [...livePaths],
+      kinds: [...kindFilter],
+      limit: pageSize,
+      maxSnippetsPerFile: snippetLimit,
+      prefix: normalizedPrefix,
+      query: normalizedQuery,
+      wholeWord,
+      signal,
+    });
+    const candidates = [...result.files.filter(({ file }) => !livePaths.has(file)), ...liveFiles]
+      .sort((left, right) => compareWorkspacePaths(left.file, right.file));
+    const files = candidates.slice(0, pageSize);
     return {
       ...result,
       files,
       matchCount: files.reduce((sum, file) => sum + file.matchCount, 0),
-      truncated: result.truncated || files.length < result.files.length + liveFiles.length,
+      truncated: result.truncated || liveIncomplete || candidates.length > files.length
+        || files.some((file) => file.truncated),
     };
   }
 
-  async readDocument(actor, { lineCount = MAX_READ_LINES, path, startLine = 1 } = {}) {
+  async readDocument(actor, { lineCount = 80, mode = 'content', path, startLine = 1 } = {}) {
     requireScope(actor, 'vault:read');
     const normalizedPath = normalizeWorkspacePath(path);
+    const kind = getVaultFileKind(normalizedPath);
     if (!isAgentReadablePath(normalizedPath)) {
       throw createAgentContentError('AGENT_UNSUPPORTED_DOCUMENT', 'Document type is not readable by agents', 400);
     }
+    if (!['content', 'outline'].includes(mode) || (mode === 'outline' && kind !== 'markdown')) {
+      throw createAgentContentError('AGENT_INPUT_INVALID', 'Outline mode requires a Markdown document', 400);
+    }
     const content = await this.readCurrentContent(normalizedPath);
     if (content.length > MAX_AGENT_READ_SOURCE_CHARACTERS) {
       throw createAgentContentError('AGENT_DOCUMENT_TOO_LARGE', 'Document is too large for agent reading', 413);
     }
     const lines = content.split('\n');
     const start = clampInteger(startLine, 1, 1, Math.max(lines.length, 1));
-    const count = clampInteger(lineCount, MAX_READ_LINES, 1, MAX_READ_LINES);
-    let selected = lines.slice(start - 1, start - 1 + count).join('\n');
-    let characterTruncated = false;
-    let endLine = Math.min(start + count - 1, lines.length);
-    if (selected.length > MAX_READ_CHARACTERS) {
-      selected = selected.slice(0, MAX_READ_CHARACTERS);
-      characterTruncated = true;
-      let returnedLineCount = 1;
-      for (let index = 0; index < selected.length; index += 1) {
-        if (selected.charCodeAt(index) === 10) returnedLineCount += 1;
-      }
-      if (selected.endsWith('\n')) returnedLineCount -= 1;
-      endLine = Math.min(start + Math.max(returnedLineCount, 1) - 1, lines.length);
-    }
-    return {
-      content: selected,
-      endLine,
-      kind: getVaultFileKind(normalizedPath),
+    const count = clampInteger(lineCount, 80, 1, MAX_READ_LINES);
+    const result = {
+      content: '',
+      endLine: lines.length,
+      kind,
+      nextStartLine: null,
       path: normalizedPath,
       revision: await createEditableContentRevision(content),
       startLine: start,
       totalLines: lines.length,
-      truncated: characterTruncated || endLine < lines.length,
+      truncated: false,
     };
+    if (mode === 'outline') {
+      const headings = collectMarkdownOutline(content).filter(({ line }) => line >= start);
+      result.headings = headings.slice(0, count);
+      if (headings.length > count) {
+        result.endLine = result.headings.at(-1).line;
+        result.nextStartLine = headings[count].line;
+        result.truncated = true;
+      }
+      return result;
+    }
+    const selected = [];
+    let characters = 0;
+    for (const line of lines.slice(start - 1, start - 1 + count)) {
+      const size = line.length + (selected.length ? 1 : 0);
+      if (characters + size > MAX_READ_CHARACTERS) {
+        if (selected.length === 0) {
+          throw createAgentContentError('AGENT_DOCUMENT_LINE_TOO_LARGE', 'This line exceeds the 100000-character read limit; read a different line or use Markdown outline mode', 413);
+        }
+        break;
+      }
+      selected.push(line);
+      characters += size;
+    }
+    result.content = selected.join('\n');
+    result.endLine = start + selected.length - 1;
+    result.truncated = result.endLine < lines.length;
+    result.nextStartLine = result.truncated ? result.endLine + 1 : null;
+    return result;
   }
   async inspectDocumentReferences(actor, { path } = {}) {
     requireScope(actor, 'vault:read');
@@ -400,13 +479,22 @@ export class AgentContentService {
     if (content.length > MAX_AGENT_READ_SOURCE_CHARACTERS) {
       throw createAgentContentError('AGENT_DOCUMENT_TOO_LARGE', 'Document is too large for agent inspection', 413);
     }
+    return {
+      ...this.inspectMarkdownContent(normalizedPath, content),
+      backlinks: await this.backlinkIndex?.getBacklinks?.(normalizedPath) ?? [],
+      path: normalizedPath,
+      revision: await createEditableContentRevision(content),
+    };
+  }
+
+  inspectMarkdownContent(normalizedPath, content) {
     const entries = Array.from(this.workspaceMutationCoordinator?.workspaceState?.entries?.values?.() ?? []);
     const filePaths = entries
       .filter((entry) => entry.nodeType !== 'directory')
       .map((entry) => entry.path);
     const references = collectMarkdownReferences(content, {
       sourceFilePath: normalizedPath,
-      wikiTargetIndex: createWikiTargetIndex(filePaths),
+      wikiTargetIndex: createWikiTargetIndex([...filePaths, normalizedPath]),
     });
     const toPublicReference = (reference) => ({
       exists: Boolean(reference.resolvedPath),
@@ -430,10 +518,7 @@ export class AgentContentService {
         };
       });
     return {
-      backlinks: await this.backlinkIndex?.getBacklinks?.(normalizedPath) ?? [],
       embeds: references.filter(({ isEmbed }) => isEmbed).map(toPublicReference),
-      path: normalizedPath,
-      revision: await createEditableContentRevision(content),
       videos,
       wikiLinks: references.filter(({ isEmbed }) => !isEmbed).map(toPublicReference),
     };
@@ -441,6 +526,10 @@ export class AgentContentService {
 
   async validateDocument(actor, { path } = {}) {
     const inspected = await this.inspectDocumentReferences(actor, { path });
+    return { ...this.validateMarkdownReferences(inspected), path: inspected.path, revision: inspected.revision };
+  }
+
+  validateMarkdownReferences(inspected) {
     const issues = [];
     inspected.wikiLinks.filter(({ exists }) => !exists).forEach((reference) => {
       issues.push({
@@ -468,12 +557,36 @@ export class AgentContentService {
     });
     return {
       issues,
-      path: inspected.path,
-      revision: inspected.revision,
       valid: issues.length === 0,
     };
   }
 
+  async queryBase(actor, { limit = 50, path, search = '', view = '' } = {}) {
+    requireScope(actor, 'vault:read');
+    const normalizedPath = normalizeWorkspacePath(path);
+    if (!isBaseFilePath(normalizedPath)) {
+      throw createAgentContentError('AGENT_UNSUPPORTED_DOCUMENT', 'Base queries require a .base path', 400);
+    }
+    const content = await this.readCurrentContent(normalizedPath);
+    if (!this.baseQueryService?.query) {
+      throw createAgentContentError('AGENT_BASE_QUERY_UNAVAILABLE', 'Bases query service is unavailable', 503);
+    }
+    const pageSize = clampInteger(limit, 50, 1, 200);
+    try {
+      const result = await this.baseQueryService.query({
+        basePath: normalizedPath,
+        search,
+        source: content,
+        sourcePath: normalizedPath,
+        view,
+      });
+      return toAgentBaseQueryResult(normalizedPath, result, pageSize);
+    } catch (error) {
+      if (error?.code?.startsWith('AGENT_')) throw error;
+      throw createAgentContentError('AGENT_BASE_QUERY_FAILED', error.message || 'Failed to query base', 400);
+    }
+  }
+
   async renderDiagram(actor, { format = 'png', path, startLine } = {}) {
     requireScope(actor, 'vault:read');
     const normalizedPath = normalizeWorkspacePath(path);
@@ -523,12 +636,13 @@ export class AgentContentService {
   }
 
 
-  async applyTextEdits(actor, { path, replacements, revision } = {}) {
+  async applyTextEdits(actor, { path, replacements, revision, validate = false } = {}) {
     requireScope(actor, 'vault:edit');
     const normalizedPath = normalizeWorkspacePath(path);
     if (!isAgentEditablePath(normalizedPath)) {
       throw createAgentContentError('AGENT_UNSUPPORTED_DOCUMENT', 'Document type is not editable by agents', 400);
     }
+    this.requireMarkdownValidation(normalizedPath, validate);
     return this.runForPath(normalizedPath, async () => {
       const content = await this.readCurrentContent(normalizedPath);
       if (content.length > MAX_DOCUMENT_CHARACTERS) {
@@ -552,15 +666,20 @@ export class AgentContentService {
         error.code = error.code?.startsWith('EXACT_EDIT_') ? 'AGENT_REPLACEMENT_MISMATCH' : error.code;
         throw error;
       }
+      const nextContent = applyExactTextChanges(content, changes);
+      assertValidAgentBaseContent(normalizedPath, nextContent);
       const room = this.roomRegistry?.get?.(normalizedPath);
-      let nextContent;
+      const validation = validate
+        ? this.validateMarkdownReferences(this.inspectMarkdownContent(normalizedPath, nextContent))
+        : null;
       if (room) {
+        if (room.readEditableContent() !== content) {
+          throw createAgentContentError('AGENT_REVISION_CONFLICT', 'Document changed; read it again before editing', 409);
+        }
         room.applyExactTextChanges(changes, {
           origin: createCollaborationOrigin(actor),
         });
-        nextContent = room.readEditableContent();
       } else {
-        nextContent = applyExactTextChanges(content, changes);
         const result = await this.workspaceMutationCoordinator.writeEditableContent({
           content: nextContent,
           origin: getMutationOrigin(actor),
@@ -574,6 +693,7 @@ export class AgentContentService {
         path: normalizedPath,
         replacementCount: changes.length,
         revision: await createEditableContentRevision(nextContent),
+        ...(validation ? { validation } : {}),
       };
     });
   }
@@ -644,6 +764,7 @@ export class AgentContentService {
   async editExcalidraw(actor, {
     create = [],
     delete: remove = [],
+    normalizeTextPlacement,
     path,
     reorder = [],
     replace = [],
@@ -666,11 +787,12 @@ export class AgentContentService {
       if (revision !== await createEditableContentRevision(content)) {
         throw createAgentContentError('AGENT_REVISION_CONFLICT', 'Document changed; read it again before editing', 409);
       }
-      let scene;
+      let edit;
       try {
-        scene = applyAgentExcalidrawEdits(JSON.parse(content), {
+        edit = applyAgentExcalidrawEditsWithSummary(JSON.parse(content), {
           create,
           delete: remove,
+          normalizeTextPlacement,
           reorder,
           replace,
           update,
@@ -685,6 +807,7 @@ export class AgentContentService {
         }
         throw error;
       }
+      const { reflowed, scene } = edit;
       const room = this.roomRegistry?.get?.(normalizedPath);
       let nextContent;
       if (room) {
@@ -714,6 +837,7 @@ export class AgentContentService {
         elementCount: storedScene.elements.filter((element) => !element.isDeleted).length,
         path: normalizedPath,
         reordered: reorder.length,
+        reflowed,
         replaced: replace.length,
         revision: await createEditableContentRevision(nextContent),
         translated: translate?.ids?.length ?? 0,
@@ -728,17 +852,22 @@ export class AgentContentService {
     });
   }
 
-  async createDocument(actor, { content = '', path } = {}) {
+  async createDocument(actor, { content = '', path, validate = false } = {}) {
     requireScope(actor, 'vault:edit');
     const normalizedPath = normalizeWorkspacePath(path);
     if (!isAgentCreatablePath(normalizedPath)) {
       throw createAgentContentError('AGENT_UNSUPPORTED_DOCUMENT', 'Document type cannot be created by agents', 400);
     }
+    this.requireMarkdownValidation(normalizedPath, validate);
     const normalizedContent = normalizeEditableText(content);
     if (normalizedContent.length > MAX_DOCUMENT_CHARACTERS) {
       throw createAgentContentError('AGENT_DOCUMENT_TOO_LARGE', 'Document is too large for agent creation', 413);
     }
+    assertValidAgentBaseContent(normalizedPath, normalizedContent);
     return this.runForPath(normalizedPath, async () => {
+      const validation = validate
+        ? this.validateMarkdownReferences(this.inspectMarkdownContent(normalizedPath, normalizedContent))
+        : null;
       const result = await this.workspaceMutationCoordinator.createFile({
         content: normalizedContent,
         origin: getMutationOrigin(actor),
@@ -759,10 +888,17 @@ export class AgentContentService {
         kind: getVaultFileKind(normalizedPath),
         path: normalizedPath,
         revision: await createEditableContentRevision(normalizedContent),
+        ...(validation ? { validation } : {}),
       };
     });
   }
 
+  requireMarkdownValidation(path, validate) {
+    if (validate && getVaultFileKind(path) !== 'markdown') {
+      throw createAgentContentError('AGENT_INPUT_INVALID', 'Reference validation requires a Markdown document', 400);
+    }
+  }
+
   getSyntax(actor, { kind = '' } = {}) {
     requireScope(actor, 'vault:read');
     if (!kind) return { capabilities: listCollabMdContentCapabilities() };

package/src/server/auth/create-auth-service.js

@@ -3,9 +3,6 @@ import {
   AUTH_STRATEGY_NONE,
   AUTH_STRATEGY_OIDC,
   AUTH_STRATEGY_PASSWORD,
-  SUPPORTED_AUTH_STRATEGIES,
-  createRandomAuthPassword,
-  createRandomSessionSecret,
 } from './auth-constants.js';
 import {
   buildClientConfig,
@@ -18,14 +15,27 @@ import {
   createPasswordStrategy,
 } from './auth-strategies.js';
 
-export {
-  AUTH_STRATEGY_NONE,
-  AUTH_STRATEGY_OIDC,
-  AUTH_STRATEGY_PASSWORD,
-  SUPPORTED_AUTH_STRATEGIES,
-  createRandomAuthPassword,
-  createRandomSessionSecret,
-};
+function resolveRequestProtocol(req) {
+  const forwarded = String(req.headers['x-forwarded-proto'] ?? '').split(',')[0].trim().toLowerCase();
+  if (forwarded === 'https' || forwarded === 'http') {
+    return `${forwarded}:`;
+  }
+
+  try {
+    const cfVisitor = JSON.parse(req.headers['cf-visitor'] ?? '');
+    if (String(cfVisitor?.scheme).toLowerCase() === 'https') {
+      return 'https:';
+    }
+  } catch {
+    // Non-Cloudflare requests carry no cf-visitor payload.
+  }
+
+  if (req.socket?.encrypted) {
+    return 'https:';
+  }
+
+  return 'http:';
+}
 
 export function createAuthService(config) {
   const authConfig = config.auth ?? { strategy: AUTH_STRATEGY_NONE };
@@ -72,8 +82,26 @@ export function createAuthService(config) {
     },
 
     authorizeWebSocketRequest(req) {
+      // Browsers always send Origin; clients without it still need authentication.
+      if (req.headers.origin !== undefined) {
+        let allowed = false;
+        try {
+          const protocol = resolveRequestProtocol(req);
+          const expectedOrigin = authConfig.oidc?.publicBaseUrl
+            ? new URL(authConfig.oidc.publicBaseUrl).origin
+            : new URL(`${protocol}//${req.headers.host}`).origin;
+          allowed = req.headers.origin === expectedOrigin;
+        } catch {
+          // Malformed or opaque origins are forbidden.
+        }
+        if (!allowed) {
+          return { ok: false, statusCode: 403, statusMessage: 'Forbidden', body: 'Origin not allowed' };
+        }
+      }
       if (strategy.isAuthenticated(req)) {
-        return { ok: true };
+        const expiresAt = authConfig.strategy === AUTH_STRATEGY_NONE
+          ? null : sessionCookieManager.readSession(req)?.expiresAt;
+        return { ok: true, expiresAt: Number.isFinite(expiresAt) ? expiresAt : null };
       }
 
       return {