feedkeeper 0.35.3 → 0.35.5

package/server/dist/feeds/inbox.js

@@ -119,18 +119,13 @@ export async function saveToInbox(userId, input) {
     return { itemId, item, hasNote };
 }
 export function deleteInboxItem(userId, itemId) {
-    const inbox = ensureUserInbox(userId);
+    const inbox = findFeedByUrl(`feedkeeper://inbox/${userId}`);
     const item = findItemById(itemId);
-    if (!item || item.feed_id !== inbox.id) {
+    if (!inbox || !item || item.feed_id !== inbox.id) {
         return false;
     }
-    db.transaction(() => {
-        db.prepare("DELETE FROM item_bookmarks WHERE item_id = ?").run(itemId);
-        db.prepare("DELETE FROM item_reads WHERE item_id = ?").run(itemId);
-        db.prepare("DELETE FROM item_progress WHERE item_id = ?").run(itemId);
-        db.prepare("DELETE FROM item_notes WHERE item_id = ?").run(itemId);
-        db.prepare("DELETE FROM items WHERE id = ?").run(itemId);
-    })();
+    // Cascades run after the parent disappears, so state/note triggers do not announce stale updates.
+    db.prepare("DELETE FROM items WHERE id = ?").run(itemId);
     pruneArchive();
     return true;
 }

package/server/dist/feeds/opml.js

@@ -1,11 +1,13 @@
 import { XMLParser } from "fast-xml-parser";
 import { z } from "zod";
 import { config } from "../config.js";
-import { listSubscriptionsForUser, findFeedByUrl, createFeed, isUserSubscribed, subscribe, createFolder, } from "./repository.js";
-import { SsrfBlockedError } from "./ssrfGuard.js";
+import { listSubscriptionsForUser, findFeedByUrl, createFeed, seedFeedMetadata, isUserSubscribed, subscribe, createFolder, } from "./repository.js";
+import { SsrfBlockedError, normalizeUrlCandidate } from "./ssrfGuard.js";
 import { assertPublicFeedUrl } from "./blockedHosts.js";
 import { requestFeedPoll } from "./poller.js";
-import { decodeEntities } from "./text.js";
+import { decodeEntities, plainTitle } from "./text.js";
+const MAX_FOLDER_NAME_LENGTH = 100;
+const MAX_FEED_LABEL_LENGTH = 200;
 function escapeXml(unsafe) {
     return unsafe.replace(/[<>&'"]/g, (char) => {
         switch (char) {
@@ -26,9 +28,10 @@ function escapeXml(unsafe) {
 }
 function feedToOutlineXml(s, indent = "    ") {
     const text = escapeXml(s.label || s.title || s.url);
+    const title = escapeXml(s.title || s.label || s.url);
     const xmlUrl = escapeXml(s.url);
     const htmlUrl = s.site_url ? ` htmlUrl="${escapeXml(s.site_url)}"` : "";
-    return `${indent}<outline text="${text}" title="${text}" type="rss" xmlUrl="${xmlUrl}"${htmlUrl} />`;
+    return `${indent}<outline text="${text}" title="${title}" type="rss" xmlUrl="${xmlUrl}"${htmlUrl} />`;
 }
 /**
  * Generates standard OPML 2.0 XML representation of all subscribed feeds for a user.
@@ -74,7 +77,26 @@ ${outlines}
 `;
 }
 /**
- * Recursively extracts outline elements containing an xmlUrl attribute from parsed OPML.
+ * Reads an attribute from a parsed XML node case-insensitively in priority order.
+ */
+function getAttr(record, ...names) {
+    const entries = Object.entries(record);
+    for (const name of names) {
+        const target = `@_${name.toLowerCase()}`;
+        for (const [key, value] of entries) {
+            if (key.toLowerCase() === target) {
+                if (typeof value === "string")
+                    return value;
+                if (typeof value === "number" || typeof value === "boolean")
+                    return String(value);
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Recursively extracts outline elements containing a feed URL from parsed OPML.
+ * Nested subfolders are flattened to the top level so each subfolder becomes its own folder.
  */
 function extractOutlines(node, items = [], currentFolder) {
     if (!node || typeof node !== "object")
@@ -86,19 +108,30 @@ function extractOutlines(node, items = [], currentFolder) {
         return items;
     }
     const record = node;
-    const xmlUrl = (typeof record["@_xmlUrl"] === "string" ? record["@_xmlUrl"] : undefined) ??
-        (typeof record["@_xmlurl"] === "string" ? record["@_xmlurl"] : undefined);
-    const rawLabel = (typeof record["@_text"] === "string" ? record["@_text"] : undefined) ??
-        (typeof record["@_title"] === "string" ? record["@_title"] : undefined);
-    if (xmlUrl) {
-        const label = rawLabel?.trim() ? decodeEntities(rawLabel.trim()) : undefined;
-        items.push({ url: xmlUrl.trim(), label, folder: currentFolder });
+    const hasChildren = Boolean(record.outline);
+    // Leaf outlines without xmlUrl may use url="..." in older OPML 1.0 exports.
+    const rawXmlUrl = getAttr(record, "xmlUrl") ?? (!hasChildren ? getAttr(record, "url") : undefined);
+    const rawText = getAttr(record, "text");
+    const rawTitle = getAttr(record, "title");
+    const rawHtmlUrl = getAttr(record, "htmlUrl");
+    const label = plainTitle(rawText ?? rawTitle)?.slice(0, MAX_FEED_LABEL_LENGTH);
+    const title = plainTitle(rawTitle ?? rawText)?.slice(0, MAX_FEED_LABEL_LENGTH);
+    const siteUrl = rawHtmlUrl?.trim() ? decodeEntities(rawHtmlUrl.trim()) : undefined;
+    let childFolder = currentFolder;
+    if (rawXmlUrl && rawXmlUrl.trim()) {
+        const url = decodeEntities(rawXmlUrl.trim());
+        const item = { url, label, folder: currentFolder };
+        if (title && title !== label)
+            item.title = title;
+        if (siteUrl)
+            item.siteUrl = siteUrl;
+        items.push(item);
     }
-    else if (rawLabel && record.outline) {
-        currentFolder = decodeEntities(rawLabel.trim());
+    else if (label && hasChildren) {
+        childFolder = label.slice(0, MAX_FOLDER_NAME_LENGTH);
     }
-    if (record.outline) {
-        extractOutlines(record.outline, items, currentFolder);
+    if (hasChildren) {
+        extractOutlines(record.outline, items, childFolder);
     }
     return items;
 }
@@ -107,22 +140,77 @@ export const MAX_OPML_FEEDS = 2000;
  * Parses an OPML document string and returns a list of feed URLs and their labels.
  */
 export function parseOpml(xmlContent) {
+    const cleanedXml = xmlContent.replace(/^\uFEFF/, "").trim();
+    if (!cleanedXml) {
+        throw new Error("invalid_opml_format");
+    }
     const parser = new XMLParser({
         ignoreAttributes: false,
         attributeNamePrefix: "@_",
         trimValues: true,
     });
-    const parsed = parser.parse(xmlContent);
-    if (!parsed || !parsed.opml || !parsed.opml.body) {
+    const parsed = parser.parse(cleanedXml);
+    if (!parsed || typeof parsed.opml !== "object" || parsed.opml === null || !("body" in parsed.opml)) {
         throw new Error("invalid_opml_format");
     }
-    const feeds = extractOutlines(parsed.opml.body.outline);
+    const body = parsed.opml.body;
+    const outlineRoot = body && typeof body === "object" ? body.outline : undefined;
+    const feeds = extractOutlines(outlineRoot);
     if (feeds.length > MAX_OPML_FEEDS) {
         throw new Error("too_many_opml_feeds");
     }
     return feeds;
 }
 const urlSchema = z.string().url();
+function normalizeOpmlUrl(rawUrl) {
+    const trimmed = rawUrl.trim();
+    if (/^feeds?:https?:\/\//i.test(trimmed)) {
+        return trimmed.replace(/^feeds?:/i, "");
+    }
+    if (/^feeds?:\/\//i.test(trimmed)) {
+        const rest = trimmed.replace(/^feeds?:\/\//i, "");
+        return /^https?:\/\//i.test(rest) ? rest : `https://${rest}`;
+    }
+    if (trimmed.startsWith("//"))
+        return `https:${trimmed}`;
+    return trimmed;
+}
+function sanitizeHttpUrl(raw) {
+    if (!raw)
+        return null;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    try {
+        const parsed = new URL(trimmed.startsWith("//") ? `https:${trimmed}` : trimmed);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+            return null;
+        return parsed.toString();
+    }
+    catch {
+        return null;
+    }
+}
+function isUrlFallbackLabel(label, rawUrl, normalizedUrl) {
+    if (!label)
+        return true;
+    const trimmed = label.trim();
+    if (!trimmed)
+        return true;
+    if (trimmed === rawUrl || trimmed === normalizedUrl)
+        return true;
+    try {
+        return new URL(normalizeOpmlUrl(trimmed)).toString() === normalizedUrl;
+    }
+    catch {
+        try {
+            return new URL(normalizeUrlCandidate(trimmed)).toString() === normalizedUrl;
+        }
+        catch {
+            return false;
+        }
+    }
+}
 /**
  * Imports feeds from an OPML document string for the given user.
  */
@@ -139,7 +227,8 @@ export async function importOpmlFeeds(userId, xmlContent) {
     for (const item of feedItems) {
         if (!item.url)
             continue;
-        const urlCheck = urlSchema.safeParse(item.url);
+        const candidateUrl = normalizeOpmlUrl(item.url);
+        const urlCheck = urlSchema.safeParse(candidateUrl);
         if (!urlCheck.success) {
             result.failed++;
             result.errors.push({ url: item.url, reason: "invalid_url_format" });
@@ -147,7 +236,7 @@ export async function importOpmlFeeds(userId, xmlContent) {
         }
         let normalizedUrl;
         try {
-            const validated = await assertPublicFeedUrl(item.url);
+            const validated = await assertPublicFeedUrl(candidateUrl);
             normalizedUrl = validated.toString();
         }
         catch (error) {
@@ -161,22 +250,28 @@ export async function importOpmlFeeds(userId, xmlContent) {
             if (!feed) {
                 feed = createFeed(normalizedUrl, Math.max(config.minPollIntervalMinutes, 15));
             }
+            const rawTitle = item.title ?? item.label;
+            const seedTitle = isUrlFallbackLabel(rawTitle, item.url, normalizedUrl) ? null : (rawTitle ?? null);
+            const seedSiteUrl = sanitizeHttpUrl(item.siteUrl);
+            seedFeedMetadata(feed.id, { title: seedTitle, siteUrl: seedSiteUrl });
             if (isUserSubscribed(userId, feed.id)) {
                 result.skipped++;
                 continue;
             }
             let folderId = null;
-            if (item.folder) {
-                if (folderCache.has(item.folder)) {
-                    folderId = folderCache.get(item.folder);
+            const folderName = item.folder?.trim().slice(0, MAX_FOLDER_NAME_LENGTH);
+            if (folderName) {
+                if (folderCache.has(folderName)) {
+                    folderId = folderCache.get(folderName);
                 }
                 else {
-                    const folder = createFolder(userId, item.folder);
+                    const folder = createFolder(userId, folderName);
                     folderId = folder.id;
-                    folderCache.set(item.folder, folder.id);
+                    folderCache.set(folderName, folder.id);
                 }
             }
-            subscribe(userId, feed.id, item.label ?? null, folderId);
+            const customLabel = isUrlFallbackLabel(item.label, item.url, normalizedUrl) ? null : (item.label ?? null);
+            subscribe(userId, feed.id, customLabel, folderId);
             result.imported++;
             feedsToPoll.push(feed);
         }

package/server/dist/feeds/repository.js

@@ -16,6 +16,14 @@ export function createFeed(url, pollIntervalMinutes) {
         .run(url, pollIntervalMinutes);
     return findFeedById(Number(result.lastInsertRowid));
 }
+export function seedFeedMetadata(feedId, data) {
+    if (!data.title && !data.siteUrl)
+        return;
+    db.prepare(`UPDATE feeds SET
+       title = COALESCE(NULLIF(TRIM(title), ''), ?),
+       site_url = COALESCE(NULLIF(TRIM(site_url), ''), ?)
+     WHERE id = ?`).run(data.title?.trim() || null, data.siteUrl?.trim() || null, feedId);
+}
 export function subscribe(userId, feedId, label, folderId) {
     const maxPosRow = db
         .prepare("SELECT MAX(position) AS max_pos FROM subscriptions WHERE user_id = ?")
@@ -170,7 +178,7 @@ export function upsertItems(feedId, items) {
                 refreshLead(Number(result.lastInsertRowid));
             }
             else {
-                const previous = db.prepare("SELECT id, title, link, image_url, content_snippet, content_html, full_content_html, lead_version FROM items WHERE feed_id = ? AND guid = ?").get(feedId, row.guid);
+                const previous = db.prepare("SELECT id, title, link, image_url, content_snippet, content_html, full_content_html, published_at, author, lead_version FROM items WHERE feed_id = ? AND guid = ?").get(feedId, row.guid);
                 const next = row.contentHtml;
                 // Some publishers replace complete feed bodies with short teasers on a later poll.
                 const retained = previous?.content_html && next && next.length < previous.content_html.length * 0.9 &&
@@ -185,9 +193,9 @@ export function upsertItems(feedId, items) {
                         (row.link !== undefined && row.link !== previous.link) ||
                         (!keptPrevious && row.contentSnippet !== undefined && row.contentSnippet !== previous.content_snippet) ||
                         (retained !== null && retained !== previous.content_html) ||
-                        (row.publishedAt !== undefined && row.publishedAt !== null) ||
+                        (row.publishedAt !== undefined && row.publishedAt !== null && row.publishedAt !== previous.published_at) ||
                         (nextImage !== previous.image_url) ||
-                        (row.author !== undefined);
+                        (row.author !== undefined && row.author !== null && row.author !== previous.author);
                     if (changed) {
                         update.run(row.title ?? null, row.link ?? null, nextSnippet, retained, row.publishedAt ?? null, nextImage, row.author ?? null, feedId, row.guid);
                         const leadChanged = (retained !== null && retained !== previous.content_html) ||
@@ -210,15 +218,17 @@ export function upsertItems(feedId, items) {
     return insertMany(items);
 }
 export function listItemsForUser(userId, opts = {}) {
-    // Saved articles stay visible without a subscription (e.g. after unsubscribing).
+    // Saved and annotated articles stay visible after unsubscribing.
     const conditions = [];
+    const params = [];
     if (opts.bookmarkedOnly) {
         conditions.push("b.item_id IS NOT NULL");
     }
     else {
-        conditions.push("(s.id IS NOT NULL OR b.item_id IS NOT NULL)");
+        conditions.push(`(s.id IS NOT NULL OR b.item_id IS NOT NULL OR
+      EXISTS (SELECT 1 FROM item_notes access_note WHERE access_note.item_id = i.id AND access_note.user_id = ?))`);
+        params.push(userId);
     }
-    const params = [];
     // Keep the stored item available to direct reads and sync; deliberate saves/notes override stream filtering.
     conditions.push(`(i.is_empty_gallery = 0 OR b.item_id IS NOT NULL OR
     EXISTS (SELECT 1 FROM item_notes gallery_note WHERE gallery_note.item_id = i.id AND gallery_note.user_id = ?))`);
@@ -410,7 +420,9 @@ export function findFolderById(userId, id) {
 }
 export function createFolder(userId, name, iconSymbol) {
     const trimmed = name.trim();
-    db.prepare("INSERT INTO folders (user_id, name, icon_symbol) VALUES (?, ?, ?) ON CONFLICT (user_id, name) DO NOTHING").run(userId, trimmed, iconSymbol ?? null);
+    db.prepare(`INSERT INTO folders (user_id, name, icon_symbol) VALUES (?, ?, ?)
+    ON CONFLICT (user_id, name) DO UPDATE SET icon_symbol = excluded.icon_symbol
+    WHERE ? AND folders.icon_symbol IS NOT excluded.icon_symbol`).run(userId, trimmed, iconSymbol ?? null, Number(iconSymbol !== undefined));
     return findFolderByName(userId, trimmed);
 }
 export function updateFolder(userId, id, updates) {

package/server/dist/mcp/items.js

@@ -51,7 +51,7 @@ export function getItemForMcp(userId, itemId, maxChars = MAX_CONTENT_LENGTH, off
         return null;
     if (revision !== undefined && revision !== item.content_revision)
         throw new Error("content_revision_conflict");
-    const content = readerHtml(item.full_content_html ?? item.content_html, item.title, item.author);
+    const content = readerHtml(item.full_content_html ?? item.content_html, item.title, item.author, item.link);
     const body = format === "text" ? sourceText(item) : content ?? "";
     let end = Math.min(offset + Math.min(maxChars, MAX_CONTENT_LENGTH), body.length);
     if (end < body.length && /[\uD800-\uDBFF]/.test(body[end - 1]))

package/server/dist/mcp/server.js

@@ -42,7 +42,11 @@ function selectedItemIds({ itemId, itemIds }) {
 // instance is created per request (see mcp/http.ts) so tool handlers can
 // safely close over `userId` without leaking data between users.
 export function createMcpServerForUser(userId, scope) {
-    const server = new McpServer({ name: "feedkeeper", version: APP_VERSION });
+    const server = new McpServer({ name: "feedkeeper", version: APP_VERSION }, {
+        instructions: "FeedKeeper is a personal RSS reader, article archiver, and news curation service. " +
+            "Use it to read, search, and triage RSS/Atom feeds, fetch full article text, manage reading lists, " +
+            "and read or publish curated newspaper editions.",
+    });
     server.registerTool("list_feeds", {
         title: "List subscribed feeds",
         description: "Lists all RSS/Atom feeds the current user is subscribed to, including unread counts and polling health.",
@@ -64,6 +68,8 @@ export function createMcpServerForUser(userId, scope) {
                 folderId: z.number().int().positive().optional().describe("Optional folder/category ID"),
             },
         }, async ({ url, label, folderId }) => {
+            if (!hasUserCapability(userId, "sync"))
+                return { ...textResult(capabilityDenial(userId, "sync")), isError: true };
             try {
                 const subscription = await subscribeToFeed(userId, url, label ?? null, folderId ?? null);
                 return textResult(subscription);
@@ -90,6 +96,8 @@ export function createMcpServerForUser(userId, scope) {
             url: mcpUrlSchema.describe("The website URL to discover feeds from"),
         },
     }, async ({ url }) => {
+        if (!hasUserCapability(userId, "sync"))
+            return { ...textResult(capabilityDenial(userId, "sync")), isError: true };
         try {
             const feeds = await discoverFeeds(url);
             return textResult({ feeds });
@@ -116,8 +124,8 @@ export function createMcpServerForUser(userId, scope) {
         });
     if (scope === "write")
         server.registerTool("save_to_inbox", {
-            title: "Save article or note to Inbox",
-            description: "Saves a web article URL, raw HTML, text clipping, or markdown note directly into the user's Universal Inbox.",
+            title: "Save article or clipping to Inbox",
+            description: "Saves a web article URL, raw HTML, text clipping, or note directly into the user's Universal Inbox.",
             inputSchema: {
                 url: mcpUrlSchema.optional().describe("Web page URL to fetch, extract, and save"),
                 title: z.string().max(500).optional().describe("Optional custom title"),
@@ -189,6 +197,8 @@ export function createMcpServerForUser(userId, scope) {
                 badge: z.boolean().optional().describe("Count this feed's unread articles in the number on the app icon"),
             },
         }, async ({ feedId, url, label, pollIntervalMinutes, fullText, notify, badge }) => {
+            if (url && !hasUserCapability(userId, "sync"))
+                return { ...textResult(capabilityDenial(userId, "sync")), isError: true };
             try {
                 let targetFeedId = feedId;
                 let previousItemsKept;
@@ -425,6 +435,8 @@ export function createMcpServerForUser(userId, scope) {
                 opml: z.string().min(1).describe("The OPML XML content to import"),
             },
         }, async ({ opml }) => {
+            if (!hasUserCapability(userId, "sync"))
+                return { ...textResult(capabilityDenial(userId, "sync")), isError: true };
             try {
                 const result = await importOpmlFeeds(userId, opml);
                 return textResult(result);
@@ -441,6 +453,8 @@ export function createMcpServerForUser(userId, scope) {
                 feedId: z.number().int().positive().describe("The ID of the feed to refresh"),
             },
         }, async ({ feedId }) => {
+            if (!hasUserCapability(userId, "sync"))
+                return { ...textResult(capabilityDenial(userId, "sync")), isError: true };
             const feed = findFeedById(feedId);
             if (!feed || !isUserSubscribed(userId, feedId)) {
                 return errorResult("Feed not found or not subscribed");

package/server/dist/server.js

@@ -62,7 +62,7 @@ app.use(cors({
     credentials: true,
 }));
 app.use(express.json({ limit: "1mb" }));
-app.use(express.text({ type: ["application/xml", "text/xml", "text/plain"], limit: "5mb" }));
+app.use(express.text({ type: ["application/xml", "text/xml", "text/x-opml", "application/opml+xml", "text/plain"], limit: "5mb" }));
 app.use(cookieSession({
     name: "feedkeeper.sid",
     secret: config.sessionSecret,

package/server/dist/sync/changeLog.js

@@ -20,6 +20,7 @@ export function serializeSubscription(subscription) {
         notify: Boolean(subscription.notify),
         badge: Boolean(subscription.badge),
         isInbox: Boolean(subscription.is_system_inbox),
+        lastError: subscription.last_error,
         iconHash: subscription.icon_hash ?? null,
         iconUrl: subscription.icon_hash
             ? `/api/v1/subscriptions/${subscription.id}/icon?v=${subscription.icon_hash}`

package/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feedkeeper/server",
-  "version": "0.35.3",
+  "version": "0.35.5",
   "private": true,
   "type": "module"
 }