collabmd 0.1.51 → 0.1.52

package/src/server/infrastructure/persistence/pull-backup-store.js

@@ -1,5 +1,5 @@
 import { copyFile, mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, resolve } from 'node:path';
 
 import { ensureCollabMetadataGitExclude } from '../git/local-exclude.js';
 import { sanitizeVaultPath } from './path-utils.js';
@@ -104,12 +104,18 @@ export class PullBackupStore {
     this.vaultDir = resolve(vaultDir);
   }
 
+  resolveStoragePath(path) {
+    const absolute = sanitizeVaultPath(this.vaultDir, path, { allowIgnored: true });
+    if (!absolute) throw new Error('Unsafe pull backup path');
+    return absolute;
+  }
+
   getStorageRoot() {
-    return resolve(this.vaultDir, PULL_BACKUP_STORAGE_ROOT);
+    return this.resolveStoragePath(PULL_BACKUP_STORAGE_ROOT);
   }
 
   getBackupPath(backupId) {
-    return resolve(this.getStorageRoot(), backupId);
+    return this.resolveStoragePath(`${PULL_BACKUP_STORAGE_ROOT}/${backupId}`);
   }
 
   getSummaryPath(backupId) {
@@ -123,12 +129,12 @@ export class PullBackupStore {
     headRef = null,
     targetRef = null,
   } = {}) {
-    await ensureCollabMetadataGitExclude(this.vaultDir);
-
     const backupId = createBackupId(headRef, createdAt);
-    const backupDir = this.getBackupPath(backupId);
-    const filesRoot = join(backupDir, 'files');
-    const patchesRoot = join(backupDir, 'patches');
+    const filesRoot = this.resolveStoragePath(`${PULL_BACKUP_STORAGE_ROOT}/${backupId}/files`);
+    const patchesRoot = this.resolveStoragePath(`${PULL_BACKUP_STORAGE_ROOT}/${backupId}/patches`);
+    this.resolveStoragePath(this.getSummaryPath(backupId));
+    this.resolveStoragePath('.git/info/exclude');
+    await ensureCollabMetadataGitExclude(this.vaultDir);
     const backupEntries = [];
 
     await mkdir(filesRoot, { recursive: true });
@@ -140,7 +146,8 @@ export class PullBackupStore {
         continue;
       }
 
-      const absoluteSourcePath = sanitizeVaultPath(this.vaultDir, normalizedPath);
+      const absoluteSourcePath = sanitizeVaultPath(this.vaultDir, normalizedPath, { allowIgnored: true });
+      if (!absoluteSourcePath) continue;
       const relativeBackupPath = `${PULL_BACKUP_STORAGE_ROOT}/${backupId}/files/${normalizedPath}`;
       const relativeStagedPatchPath = entry?.stagedPatchContent
         ? `${PULL_BACKUP_STORAGE_ROOT}/${backupId}/patches/${normalizedPath}.staged.patch`
@@ -150,28 +157,26 @@ export class PullBackupStore {
         : null;
       let backupPath = null;
 
-      if (absoluteSourcePath) {
-        try {
-          await stat(absoluteSourcePath);
-          const absoluteBackupPath = resolve(this.vaultDir, relativeBackupPath);
-          await mkdir(dirname(absoluteBackupPath), { recursive: true });
-          await copyFile(absoluteSourcePath, absoluteBackupPath);
-          backupPath = normalizeRelativePath(relativeBackupPath);
-        } catch (error) {
-          if (error?.code !== 'ENOENT') {
-            throw error;
-          }
+      try {
+        await stat(absoluteSourcePath);
+        const absoluteBackupPath = this.resolveStoragePath(relativeBackupPath);
+        await mkdir(dirname(absoluteBackupPath), { recursive: true });
+        await copyFile(absoluteSourcePath, absoluteBackupPath);
+        backupPath = normalizeRelativePath(relativeBackupPath);
+      } catch (error) {
+        if (error?.code !== 'ENOENT') {
+          throw error;
         }
       }
 
       if (relativeStagedPatchPath) {
-        const absolutePatchPath = resolve(this.vaultDir, relativeStagedPatchPath);
+        const absolutePatchPath = this.resolveStoragePath(relativeStagedPatchPath);
         await mkdir(dirname(absolutePatchPath), { recursive: true });
         await writeFile(absolutePatchPath, entry.stagedPatchContent, 'utf8');
       }
 
       if (relativeWorktreePatchPath) {
-        const absolutePatchPath = resolve(this.vaultDir, relativeWorktreePatchPath);
+        const absolutePatchPath = this.resolveStoragePath(relativeWorktreePatchPath);
         await mkdir(dirname(absolutePatchPath), { recursive: true });
         await writeFile(absolutePatchPath, entry.worktreePatchContent, 'utf8');
       }
@@ -192,7 +197,7 @@ export class PullBackupStore {
     )).length;
     const summaryPath = this.getSummaryPath(backupId);
     await writeFile(
-      resolve(this.vaultDir, summaryPath),
+      this.resolveStoragePath(summaryPath),
       formatSummary({
         backupEntries,
         backupId,
@@ -214,6 +219,18 @@ export class PullBackupStore {
     };
   }
 
+  async readSummary(backupId) {
+    if (typeof backupId !== 'string' || !/^[a-z0-9-]{1,128}$/iu.test(backupId)) return null;
+    const path = sanitizeVaultPath(this.vaultDir, this.getSummaryPath(backupId), { allowIgnored: true });
+    if (!path) return null;
+    try {
+      return await readFile(path, 'utf8');
+    } catch (error) {
+      if (error.code === 'ENOENT' || error.code === 'EISDIR') return null;
+      throw error;
+    }
+  }
+
   async listBackups() {
     let entries;
     try {
@@ -229,26 +246,19 @@ export class PullBackupStore {
       .filter((entry) => entry.isDirectory())
       .map(async (entry) => {
         const summaryPath = this.getSummaryPath(entry.name);
-        try {
-          const content = await readFile(resolve(this.vaultDir, summaryPath), 'utf8');
-          const metadata = parseBackupMetadata(content);
-          if (!metadata) {
-            return null;
-          }
-
-          return {
-            branch: metadata.branch ?? null,
-            createdAt: metadata.createdAt ?? null,
-            fileCount: Number(metadata.fileCount ?? 0) || 0,
-            id: entry.name,
-            summaryPath,
-          };
-        } catch (error) {
-          if (error?.code === 'ENOENT') {
-            return null;
-          }
-          throw error;
+        const content = await this.readSummary(entry.name);
+        const metadata = parseBackupMetadata(content);
+        if (!metadata) {
+          return null;
         }
+
+        return {
+          branch: metadata.branch ?? null,
+          createdAt: metadata.createdAt ?? null,
+          fileCount: Number(metadata.fileCount ?? 0) || 0,
+          id: entry.name,
+          summaryPath,
+        };
       }));
 
     return backups

package/src/server/infrastructure/persistence/sidecar-store.js

@@ -1,7 +1,7 @@
-import { dirname, join, resolve } from 'path';
+import { dirname, join } from 'path';
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'fs/promises';
 
-import { resolveVaultFilePath, toVaultRelativePath } from './path-utils.js';
+import { resolveVaultFilePath, sanitizeVaultPath, toVaultRelativePath } from './path-utils.js';
 import { mapWithConcurrency } from '../../shared/async-utils.js';
 
 const COMMENT_STORAGE_ROOT = '.collabmd/comments';
@@ -15,7 +15,7 @@ function resolveSidecarPath(vaultDir, filePath, storageRoot, extension) {
   }
 
   const relativeVaultPath = toVaultRelativePath(vaultDir, absoluteVaultPath);
-  return resolve(vaultDir, storageRoot, `${relativeVaultPath}${extension}`);
+  return sanitizeVaultPath(vaultDir, `${storageRoot}/${relativeVaultPath}${extension}`, { allowIgnored: true });
 }
 
 async function renameIfPresent(sourcePath, targetPath) {
@@ -44,7 +44,7 @@ export class SidecarStore {
   }
 
   getCommentStorageRootPath() {
-    return resolve(this.vaultDir, COMMENT_STORAGE_ROOT);
+    return sanitizeVaultPath(this.vaultDir, COMMENT_STORAGE_ROOT, { allowIgnored: true });
   }
 
   getSnapshotPath(filePath) {
@@ -77,6 +77,9 @@ export class SidecarStore {
   async listCommentThreadEntries({ filePaths = null } = {}) {
     const allowedPaths = filePaths ? new Set(filePaths) : null;
     const rootPath = this.getCommentStorageRootPath();
+    if (!rootPath) {
+      return [];
+    }
     const commentFilePaths = [];
 
     const visitDirectory = async (absoluteDirectoryPath, relativeDirectoryPath = '') => {

package/src/server/infrastructure/persistence/vault-file-store.js

@@ -1,5 +1,6 @@
 import { createReadStream } from 'fs';
 import { copyFile, mkdir, readFile, readdir, rename, rm, rmdir, stat, writeFile } from 'fs/promises';
+import { randomUUID } from 'node:crypto';
 import { basename, dirname, extname, join, relative, resolve } from 'path';
 import sharp from 'sharp';
 
@@ -76,7 +77,7 @@ const TEXT_FILE_MIME_TYPES = Object.freeze({
 });
 
 function createTransactionalPath(targetPath, label) {
-  return `${targetPath}.collabmd-${label}-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2, 10)}`;
+  return `${targetPath}.collabmd-${label}-${process.pid}-${Date.now()}-${randomUUID()}`;
 }
 
 function createCommentThreadsPayload(threads = []) {
@@ -345,7 +346,7 @@ export class VaultFileStore {
     });
 
     for (const entry of sorted) {
-      if (isIgnoredVaultEntry(entry.name)) {
+      if (isIgnoredVaultEntry(entry.name) || entry.isSymbolicLink()) {
         continue;
       }
 
@@ -417,7 +418,15 @@ export class VaultFileStore {
     return this.readContentFile(filePath);
   }
 
-  async writeResolvedContentFile(resolved, filePath, content, { invalidateCollaborationSnapshot = true } = {}) {
+  async writeEditableVaultContent(filePath, content, { invalidateCollaborationSnapshot = true } = {}) {
+    const resolved = this.resolveAdapter(filePath);
+    if (!resolved) {
+      return {
+        ok: false,
+        error: getEditableVaultContentKind(filePath)?.invalidPathError ?? INVALID_VAULT_FILE_PATH_ERROR,
+      };
+    }
+
     try {
       await this.runManagedWrite([filePath], async () => {
         await mkdir(dirname(resolved.absolute), { recursive: true });
@@ -432,22 +441,6 @@ export class VaultFileStore {
     }
   }
 
-  async writeContentFile(filePath, content, expectedKind = null, { invalidateCollaborationSnapshot = true } = {}) {
-    const resolved = this.resolveAdapter(filePath);
-    if (!resolved || (expectedKind && resolved.adapter.kind !== expectedKind)) {
-      return {
-        ok: false,
-        error: resolved?.adapter?.invalidPathError ?? getEditableVaultContentKind(filePath)?.invalidPathError ?? INVALID_VAULT_FILE_PATH_ERROR,
-      };
-    }
-
-    return this.writeResolvedContentFile(resolved, filePath, content, { invalidateCollaborationSnapshot });
-  }
-
-  async writeEditableVaultContent(filePath, content, { invalidateCollaborationSnapshot = true } = {}) {
-    return this.writeContentFile(filePath, content, null, { invalidateCollaborationSnapshot });
-  }
-
   async readMarkdownFile(filePath) {
     return this.readContentFile(filePath, 'markdown');
   }
@@ -508,14 +501,6 @@ export class VaultFileStore {
     }
   }
 
-  async writeMarkdownFile(filePath, content, options = {}) {
-    return this.writeContentFile(filePath, content, 'markdown', options);
-  }
-
-  async writeBaseFile(filePath, content, options = {}) {
-    return this.writeContentFile(filePath, content, 'base', options);
-  }
-
   async writeImageAttachmentForDocument(sourceDocumentPath, {
     content,
     mimeType,
@@ -581,36 +566,6 @@ export class VaultFileStore {
     };
   }
 
-  async readDownloadFile(filePath) {
-    const normalizedPath = String(filePath ?? '').replace(/\\/g, '/').trim();
-    if (!normalizedPath || !isVaultFilePath(normalizedPath)) {
-      return null;
-    }
-
-    if (isImageAttachmentFilePath(normalizedPath)) {
-      return this.readImageAttachmentFile(normalizedPath);
-    }
-
-    const absolute = this.resolveContentPath(normalizedPath, { requireVaultFile: false });
-    if (!absolute) {
-      return null;
-    }
-
-    try {
-      return {
-        content: await readFile(absolute),
-        mimeType: getDownloadMimeType(normalizedPath),
-        path: normalizedPath,
-      };
-    } catch (error) {
-      if (error.code === 'ENOENT') {
-        return null;
-      }
-
-      throw error;
-    }
-  }
-
   async openDownloadFileStream(filePath, { maxBytes = Infinity } = {}) {
     const normalizedPath = String(filePath ?? '').replace(/\\/g, '/').trim();
     if (!normalizedPath || !isVaultFilePath(normalizedPath)) {
@@ -664,16 +619,22 @@ export class VaultFileStore {
       };
     }
 
+    const commentPath = this.sidecarStore.getCommentThreadPath(filePath);
+    const snapshotPath = this.sidecarStore.getSnapshotPath(filePath);
+    if (!commentPath || !snapshotPath) {
+      return { ok: false, error: 'Invalid collaboration state path' };
+    }
+
     const operations = [
       {
         kind: Array.isArray(commentThreads) && commentThreads.length > 0 ? 'write' : 'delete',
-        targetPath: this.sidecarStore.getCommentThreadPath(filePath),
+        targetPath: commentPath,
         value: createCommentThreadsPayload(commentThreads),
         writeOptions: 'utf-8',
       },
       {
         kind: snapshot ? 'write' : 'delete',
-        targetPath: this.sidecarStore.getSnapshotPath(filePath),
+        targetPath: snapshotPath,
         value: snapshot ? Buffer.from(snapshot) : null,
       },
       includeContent ? {
@@ -843,7 +804,7 @@ export class VaultFileStore {
       const sortedEntries = dirEntries.sort((left, right) => left.name.localeCompare(right.name, undefined, { sensitivity: 'base' }));
 
       for (const entry of sortedEntries) {
-        if (isIgnoredVaultEntry(entry.name)) {
+        if (isIgnoredVaultEntry(entry.name) || entry.isSymbolicLink()) {
           continue;
         }
 
@@ -865,68 +826,6 @@ export class VaultFileStore {
     return sortWorkspacePaths(paths);
   }
 
-  async listDirectoryEntriesForDownload(dirPath) {
-    const normalizedPath = String(dirPath ?? '').replace(/\\/g, '/').trim();
-    const { absolute, error } = resolveVaultDirectoryPath(this.vaultDir, normalizedPath);
-    if (!absolute) {
-      return { ok: false, error };
-    }
-
-    try {
-      const info = await stat(absolute);
-      if (!info.isDirectory()) {
-        return { ok: false, error: 'Directory not found' };
-      }
-    } catch (statError) {
-      if (statError.code === 'ENOENT') {
-        return { ok: false, error: 'Directory not found' };
-      }
-
-      throw statError;
-    }
-
-    const entries = [];
-    const visitDirectory = async (directoryAbsolutePath, relativeDirectoryPath = '') => {
-      const dirEntries = sortDirectoryEntries(await readdir(directoryAbsolutePath, { withFileTypes: true }))
-        .filter((entry) => !isIgnoredVaultEntry(entry.name));
-
-      if (dirEntries.length === 0) {
-        entries.push({
-          path: relativeDirectoryPath,
-          type: 'directory',
-        });
-        return;
-      }
-
-      for (const entry of dirEntries) {
-        const childAbsolutePath = join(directoryAbsolutePath, entry.name);
-        const childRelativePath = relativeDirectoryPath
-          ? `${relativeDirectoryPath}/${entry.name}`
-          : entry.name;
-
-        if (entry.isDirectory()) {
-          await visitDirectory(childAbsolutePath, childRelativePath);
-          continue;
-        }
-
-        if (isVaultFilePath(entry.name)) {
-          entries.push({
-            absolutePath: childAbsolutePath,
-            path: childRelativePath,
-            type: 'file',
-          });
-        }
-      }
-    };
-
-    await visitDirectory(absolute);
-    return {
-      entries,
-      ok: true,
-      rootName: basename(normalizedPath),
-    };
-  }
-
   async resolveDirectoryDownloadRoot(dirPath) {
     const normalizedPath = String(dirPath ?? '').replace(/\\/g, '/').trim();
     const { absolute, error } = resolveVaultDirectoryPath(this.vaultDir, normalizedPath);
@@ -954,21 +853,28 @@ export class VaultFileStore {
     };
   }
 
-  async countDirectoryDownloadEntries(directoryAbsolutePath, { maxEntries = Infinity } = {}) {
+  async collectDirectoryDownloadEntries(directoryAbsolutePath, { maxEntries = Infinity } = {}) {
+    const entries = [];
     let count = 0;
-    const visitDirectory = async (currentDirectoryPath) => {
+    const visitDirectory = async (currentDirectoryPath, relativeDirectoryPath = '') => {
       const dirEntries = sortDirectoryEntries(await readdir(currentDirectoryPath, { withFileTypes: true }))
         .filter((entry) => !isIgnoredVaultEntry(entry.name));
 
       if (dirEntries.length === 0) {
         count += 1;
-        return count <= maxEntries;
+        if (count > maxEntries) {
+          return false;
+        }
+
+        entries.push({ kind: 'directory', relativePath: relativeDirectoryPath });
+        return true;
       }
 
       for (const entry of dirEntries) {
         const childAbsolutePath = join(currentDirectoryPath, entry.name);
+        const childRelativePath = relativeDirectoryPath ? `${relativeDirectoryPath}/${entry.name}` : entry.name;
         if (entry.isDirectory()) {
-          const withinLimit = await visitDirectory(childAbsolutePath);
+          const withinLimit = await visitDirectory(childAbsolutePath, childRelativePath);
           if (!withinLimit) {
             return false;
           }
@@ -980,6 +886,12 @@ export class VaultFileStore {
           if (count > maxEntries) {
             return false;
           }
+
+          entries.push({
+            absolutePath: childAbsolutePath,
+            kind: 'file',
+            relativePath: childRelativePath,
+          });
         }
       }
 
@@ -988,7 +900,7 @@ export class VaultFileStore {
 
     const withinLimit = await visitDirectory(directoryAbsolutePath);
     return {
-      count,
+      entries,
       withinLimit,
     };
   }
@@ -1016,6 +928,14 @@ export class VaultFileStore {
       return { ok: false, error };
     }
 
+    try {
+      if (!(await stat(absoluteOld)).isFile()) {
+        return { ok: false, error: 'Path is not a file' };
+      }
+    } catch {
+      return { ok: false, error: 'File not found' };
+    }
+
     if (absoluteOld === absoluteNew) {
       return { ok: true };
     }
@@ -1056,6 +976,14 @@ export class VaultFileStore {
       return { ok: false, error };
     }
 
+    try {
+      if (!(await stat(absoluteOld)).isDirectory()) {
+        return { ok: false, error: 'Path is not a directory' };
+      }
+    } catch {
+      return { ok: false, error: 'Directory not found' };
+    }
+
     if (absoluteOld === absoluteNew) {
       return { ok: true };
     }
@@ -1126,11 +1054,6 @@ export class VaultFileStore {
     }
   }
 
-  async countVaultFiles() {
-    const snapshot = await this.scanWorkspaceState();
-    return snapshot.vaultFileCount;
-  }
-
   async reconcileSidecars({
     deletedPaths = [],
     renamedPaths = [],
@@ -1162,42 +1085,6 @@ export class VaultFileStore {
     );
   }
 
-  async countFilesInDir(dirPath) {
-    let count = 0;
-
-    let entries;
-    try {
-      entries = await readdir(dirPath, { withFileTypes: true });
-    } catch {
-      return 0;
-    }
-
-    for (const entry of entries) {
-      if (isIgnoredVaultEntry(entry.name)) {
-        continue;
-      }
-
-      const fullPath = join(dirPath, entry.name);
-      if (entry.isDirectory()) {
-        count += await this.countFilesInDir(fullPath);
-      } else if (isVaultFilePath(entry.name)) {
-        count += 1;
-      }
-    }
-
-    return count;
-  }
-
-  resolveWikiLink(linkTarget) {
-    const normalized = linkTarget.endsWith('.md') ? linkTarget : `${linkTarget}.md`;
-    const absolute = this.resolveContentPath(normalized, { requireVaultFile: false });
-    if (!absolute) {
-      return null;
-    }
-
-    return toVaultRelativePath(this.vaultDir, absolute);
-  }
-
   async scanWorkspaceState() {
     return scanWorkspaceStateFromAdapter(createWorkspaceStateFileSystemAdapter({
       vaultDir: this.vaultDir,

package/src/server/infrastructure/plantuml/plantuml-renderer.js

@@ -18,13 +18,45 @@ function normalizeSvgPayload(body = '') {
   return normalized;
 }
 
+const SVG_CACHE_LIMIT = 50;
+
 export class PlantUmlRenderer {
   constructor({ fetchImpl = fetch, serverUrl } = {}) {
     this.fetchImpl = fetchImpl;
     this.serverUrl = normalizeServerUrl(serverUrl);
+    this.svgCache = new Map();
+    this.inflightRequests = new Map();
   }
 
   async renderSvg(source = '') {
+    const cacheKey = String(source);
+    const cached = this.svgCache.get(cacheKey);
+    if (cached !== undefined) {
+      return cached;
+    }
+
+    if (this.inflightRequests.has(cacheKey)) {
+      return this.inflightRequests.get(cacheKey);
+    }
+
+    const request = this.fetchSvg(cacheKey).finally(() => {
+      this.inflightRequests.delete(cacheKey);
+    });
+    this.inflightRequests.set(cacheKey, request);
+    return request;
+  }
+
+  storeSvg(source, svgMarkup) {
+    if (this.svgCache.has(source)) {
+      this.svgCache.delete(source);
+    }
+    while (this.svgCache.size >= SVG_CACHE_LIMIT) {
+      this.svgCache.delete(this.svgCache.keys().next().value);
+    }
+    this.svgCache.set(source, svgMarkup);
+  }
+
+  async fetchSvg(source = '') {
     const encoded = encodePlantUmlText(source);
     const requestUrl = `${this.serverUrl}/svg/${encoded}`;
 
@@ -51,6 +83,7 @@ export class PlantUmlRenderer {
       throw error;
     }
 
+    this.storeSvg(source, normalizedSvg);
     return normalizedSvg;
   }
 }