noteconnection 1.8.0 → 1.9.0

package/dist/src/appimage.patchelf.test.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const { sha256File } = require('../scripts/sidecar-build-fingerprint');
+const describeLinux = process.platform === 'linux' ? describe : describe.skip;
+describeLinux('AppImage pkg sidecar patchelf boundary', () => {
+    let directory;
+    let server;
+    let transcript;
+    let buildEnvironment;
+    const adapter = path.resolve(__dirname, '../scripts/appimage-patchelf.js');
+    beforeEach(() => {
+        directory = fs.mkdtempSync(path.join(os.tmpdir(), 'appimage patchelf '));
+        server = path.join(directory, 'NoteConnection.AppDir/usr/bin/server');
+        transcript = path.join(directory, 'patchelf-calls.jsonl');
+        fs.mkdirSync(path.dirname(server), { recursive: true });
+        fs.writeFileSync(server, Buffer.from('\x7fELF embedded offsets\0appended pkg payload'));
+        const originalPatchelf = path.join(directory, 'actual-patchelf');
+        fs.writeFileSync(originalPatchelf, `#!${process.execPath}\n
+const fs = require('fs');
+const args = process.argv.slice(2);
+fs.appendFileSync(process.env.APPIMAGE_PATCHELF_TEST_LOG, JSON.stringify(args) + '\\n');
+if (args[0] === '--set-rpath') fs.appendFileSync(args[2], ' ELF rewrite');
+process.stdout.write('original stdout\\n');
+process.stderr.write('original stderr\\n');
+process.exit(args[0] === '--fail' ? 23 : 0);
+`, { mode: 0o755 });
+        buildEnvironment = {
+            ...process.env,
+            NOTE_CONNECTION_APPIMAGE_PATCHELF: originalPatchelf,
+            NOTE_CONNECTION_APPIMAGE_SERVER_SUFFIX: 'NoteConnection.AppDir/usr/bin/server',
+            NOTE_CONNECTION_APPIMAGE_SERVER_SHA256: sha256File(server),
+            APPIMAGE_PATCHELF_TEST_LOG: transcript,
+        };
+    });
+    afterEach(() => fs.rmSync(directory, { recursive: true, force: true }));
+    test('preserves the complete pkg sidecar through repeated RPATH writes', () => {
+        for (let scan = 0; scan < 2; scan += 1) {
+            const command = (0, child_process_1.spawnSync)(adapter, ['--set-rpath', '$ORIGIN/../lib', server], { env: buildEnvironment, encoding: 'utf8' });
+            expect(command.status).toBe(0);
+            expect(command.stderr).toBe('');
+        }
+        expect(sha256File(server)).toBe(buildEnvironment.NOTE_CONNECTION_APPIMAGE_SERVER_SHA256);
+        expect(fs.existsSync(transcript)).toBe(false);
+    });
+    test('forwards read queries and preserves stdout, stderr, and argument boundaries', () => {
+        const args = ['--print-rpath', server];
+        const command = (0, child_process_1.spawnSync)(adapter, args, { env: buildEnvironment, encoding: 'utf8' });
+        expect(command.status).toBe(0);
+        expect(command.stdout).toBe('original stdout\n');
+        expect(command.stderr).toBe('original stderr\n');
+        expect(JSON.parse(fs.readFileSync(transcript, 'utf8'))).toEqual(args);
+        expect(sha256File(server)).toBe(buildEnvironment.NOTE_CONNECTION_APPIMAGE_SERVER_SHA256);
+    });
+    test.each(['other.AppDir/usr/bin/server', 'usr/bin/server', 'NoteConnection.AppDir/usr/bin/npm', 'NoteConnection.AppDir/usr/lib/libexample.so'])('forwards RPATH writes for %s', (relative) => {
+        const executable = path.join(directory, relative);
+        fs.mkdirSync(path.dirname(executable), { recursive: true });
+        fs.writeFileSync(executable, 'other ELF');
+        const args = ['--set-rpath', '$ORIGIN/path with spaces', executable];
+        const command = (0, child_process_1.spawnSync)(adapter, args, { env: buildEnvironment, encoding: 'utf8' });
+        expect(command.status).toBe(0);
+        expect(JSON.parse(fs.readFileSync(transcript, 'utf8'))).toEqual(args);
+        expect(fs.readFileSync(executable, 'utf8')).toBe('other ELF ELF rewrite');
+    });
+    test('rejects an already changed packaged server without rewriting it again', () => {
+        fs.appendFileSync(server, 'changed');
+        const changedSha256 = sha256File(server);
+        const command = (0, child_process_1.spawnSync)(adapter, ['--set-rpath', '$ORIGIN/../lib', server], { env: buildEnvironment, encoding: 'utf8' });
+        expect(command.status).toBe(1);
+        expect(command.stderr).toMatch(/differs from the original pkg sidecar/);
+        expect(sha256File(server)).toBe(changedSha256);
+        expect(fs.existsSync(transcript)).toBe(false);
+    });
+    test('preserves a delegated failure exit status', () => {
+        expect((0, child_process_1.spawnSync)(adapter, ['--fail'], { env: buildEnvironment }).status).toBe(23);
+    });
+});

package/dist/src/appimage.portability.test.js

@@ -0,0 +1,156 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const { verifyAppDir, verifySquashfsPermissions } = require('../scripts/verify-appimage');
+const { sha256File } = require('../scripts/sidecar-build-fingerprint');
+describe('stored AppImage permissions', () => {
+    test('accepts portable files, directories, and symlinks regardless of stored owner', () => {
+        expect(() => verifySquashfsPermissions([
+            'drwxr-xr-x 0/0 64 2026-10-03 00:00 squashfs-root',
+            '-rwxr-xr-x 0/0 64 2026-10-03 00:00 squashfs-root/AppRun.wrapped',
+            '-rw-r--r-- 1001/1001 64 2026-10-03 00:00 squashfs-root/NoteConnection.png',
+            'lrwxrwxrwx 0/0 18 2026-10-03 00:00 squashfs-root/.DirIcon -> NoteConnection.png',
+        ].join('\n'))).not.toThrow();
+    });
+    test.each(['-rwxrwx---', '-rwxr--r--', '-rw-rw----', 'drwx------', 'drwxr--r--'])('rejects stored mode %s even when the build owner could use it', (mode) => {
+        expect(() => verifySquashfsPermissions(`${mode} 0/0 64 2026-10-03 00:00 squashfs-root/entry`))
+            .toThrow(/inaccessible to other users/);
+    });
+    test('rejects missing manifest output', () => {
+        expect(() => verifySquashfsPermissions('')).toThrow(/contains no file modes/);
+    });
+});
+const describeLinux = process.platform === 'linux' ? describe : describe.skip;
+describeLinux('AppImage desktop integration portability', () => {
+    let directory;
+    let appDir;
+    let sourceServer;
+    const desktop = '[Desktop Entry]\nName=NoteConnection\nType=Application\nExec=npm %U\nIcon=npm\nTerminal=false\n';
+    beforeEach(() => {
+        directory = fs.mkdtempSync(path.join(os.tmpdir(), 'appimage portability '));
+        appDir = path.join(directory, 'NoteConnection.AppDir');
+        fs.mkdirSync(path.join(appDir, 'usr/bin'), { recursive: true });
+        fs.mkdirSync(path.join(appDir, 'usr/share/applications'), { recursive: true });
+        fs.mkdirSync(path.join(appDir, 'usr/share/icons/hicolor/128x128/apps'), { recursive: true });
+        fs.writeFileSync(path.join(appDir, 'AppRun'), '#!/bin/sh\nexec "$APPDIR/AppRun.wrapped" "$@"\n', { mode: 0o755 });
+        fs.writeFileSync(path.join(appDir, 'AppRun.wrapped'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+        fs.writeFileSync(path.join(appDir, 'usr/bin/npm'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+        sourceServer = path.join(directory, 'original-server');
+        fs.writeFileSync(sourceServer, Buffer.from('\x7fELF embedded offsets\0pkg payload'), { mode: 0o755 });
+        fs.copyFileSync(sourceServer, path.join(appDir, 'usr/bin/server'));
+        fs.writeFileSync(path.join(appDir, 'usr/share/applications/NoteConnection.desktop'), desktop);
+        fs.writeFileSync(path.join(appDir, 'NoteConnection.png'), 'icon fixture');
+        fs.symlinkSync('usr/share/applications/NoteConnection.desktop', path.join(appDir, 'NoteConnection.desktop'));
+        fs.symlinkSync('NoteConnection.png', path.join(appDir, '.DirIcon'));
+        fs.symlinkSync('../../../../../../NoteConnection.png', path.join(appDir, 'usr/share/icons/hicolor/128x128/apps/npm.png'));
+    });
+    afterEach(() => fs.rmSync(directory, { recursive: true, force: true }));
+    test('accepts relative integration links after moving the complete image', () => {
+        const relocated = path.join(directory, 'relocated image');
+        fs.renameSync(appDir, relocated);
+        expect(verifyAppDir(relocated, sourceServer)).toEqual({
+            desktopPath: path.join(relocated, 'usr/share/applications/NoteConnection.desktop'),
+            iconPath: path.join(relocated, 'NoteConnection.png'),
+            executablePath: path.join(relocated, 'usr/bin/npm'),
+            serverSha256: sha256File(sourceServer),
+            name: 'NoteConnection',
+        });
+    });
+    test('rejects the original absolute .DirIcon link even while its build-host target exists', () => {
+        fs.unlinkSync(path.join(appDir, '.DirIcon'));
+        fs.symlinkSync(path.join(appDir, 'NoteConnection.png'), path.join(appDir, '.DirIcon'));
+        expect(fs.readFileSync(path.join(appDir, '.DirIcon'), 'utf8')).toBe('icon fixture');
+        expect(() => verifyAppDir(appDir, sourceServer)).toThrow(/\.DirIcon: absolute symlink/);
+    });
+    test.each(['.DirIcon', 'NoteConnection.desktop', 'AppRun', 'AppRun.wrapped', 'usr/bin/npm', 'usr/bin/server'])('rejects dangling integration entry %s', (entry) => {
+        fs.unlinkSync(path.join(appDir, entry));
+        fs.symlinkSync('missing-file', path.join(appDir, entry));
+        expect(() => verifyAppDir(appDir, sourceServer)).toThrow(/ENOENT/);
+    });
+    test('rejects a relative link outside the image even when the target exists', () => {
+        fs.writeFileSync(path.join(directory, 'outside.png'), 'external icon');
+        fs.unlinkSync(path.join(appDir, '.DirIcon'));
+        fs.symlinkSync('../outside.png', path.join(appDir, '.DirIcon'));
+        expect(() => verifyAppDir(appDir, sourceServer)).toThrow(/path leaves the AppImage/);
+    });
+    test('rejects an absolute link hidden in a relative icon chain', () => {
+        fs.unlinkSync(path.join(appDir, 'NoteConnection.png'));
+        fs.writeFileSync(path.join(directory, 'outside.png'), 'external icon');
+        fs.symlinkSync(path.join(directory, 'outside.png'), path.join(appDir, 'NoteConnection.png'));
+        expect(() => verifyAppDir(appDir, sourceServer)).toThrow(/absolute symlink/);
+    });
+    test('rejects a symlinked ancestor directory leading outside the image', () => {
+        fs.renameSync(path.join(appDir, 'usr'), path.join(directory, 'usr'));
+        fs.symlinkSync('../usr', path.join(appDir, 'usr'));
+        expect(() => verifyAppDir(appDir, sourceServer)).toThrow(/path leaves the AppImage/);
+    });
+    test('rejects a symlink cycle', () => {
+        fs.unlinkSync(path.join(appDir, '.DirIcon'));
+        fs.symlinkSync('.DirIcon', path.join(appDir, '.DirIcon'));
+        expect(() => verifyAppDir(appDir, sourceServer)).toThrow(/symlink loop/);
+    });
+    test.each(['AppRun', 'AppRun.wrapped', 'usr/bin/npm'])('rejects %s when only the build owner and group can execute it', (entry) => {
+        fs.chmodSync(path.join(appDir, entry), 0o770);
+        expect(() => verifyAppDir(appDir, sourceServer)).toThrow(/readable by other users|executable by other users/);
+    });
+    test('rejects an unreadable icon', () => {
+        fs.chmodSync(path.join(appDir, 'NoteConnection.png'), 0o600);
+        expect(() => verifyAppDir(appDir, sourceServer)).toThrow(/readable by other users/);
+    });
+    test('rejects a sidecar whose appended payload moved during packaging', () => {
+        const bytes = fs.readFileSync(sourceServer);
+        fs.writeFileSync(path.join(appDir, 'usr/bin/server'), Buffer.concat([bytes.subarray(0, 21), Buffer.alloc(4096), bytes.subarray(21)]));
+        expect(() => verifyAppDir(appDir, sourceServer)).toThrow(/Packaged server differs/);
+    });
+    test('rejects same-size sidecar corruption', () => {
+        const bytes = fs.readFileSync(sourceServer);
+        bytes[bytes.length - 1] ^= 1;
+        fs.writeFileSync(path.join(appDir, 'usr/bin/server'), bytes);
+        expect(() => verifyAppDir(appDir, sourceServer)).toThrow(/Packaged server differs/);
+    });
+    test.each([
+        ['Name=NoteConnection\n', '', /missing Name/],
+        ['Type=Application', 'Type=Link', /Type must be Application/],
+        ['Exec=npm %U', 'Exec=missing', /ENOENT/],
+        ['Exec=npm %U', 'Exec=/usr/bin/npm', /must name a bundled executable/],
+        ['Icon=npm', 'Icon=missing', /no bundled theme image/],
+    ])('rejects invalid desktop metadata (%s)', (before, after, message) => {
+        fs.writeFileSync(path.join(appDir, 'usr/share/applications/NoteConnection.desktop'), desktop.replace(before, after));
+        expect(() => verifyAppDir(appDir, sourceServer)).toThrow(message);
+    });
+});

package/dist/src/backend/FileLoader.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FileLoader = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const ResourceIdentity_1 = require("./ResourceIdentity");
 /**
  * Service to load files from a directory.
  * 从目录加载文件的服务。
@@ -47,13 +48,19 @@ class FileLoader {
      * @param dirPath Directory path | 目录路径
      * @param extensions File extensions to include (e.g., ['.md']) | 要包含的文件扩展名
      */
-    static async loadFiles(dirPath, extensions = ['.md']) {
+    static async loadFiles(dirPath, extensions = ['.md'], workspaceRoot = dirPath) {
         const filePaths = [];
-        // Check if directory exists
         if (!fs.existsSync(dirPath)) {
             console.warn(`Directory not found: ${dirPath}`);
             return [];
         }
+        // Compare canonical directories before scanning: an alias must neither
+        // escape the workspace nor give the same source a second relative identity.
+        const identityRoot = fs.realpathSync.native(workspaceRoot);
+        const scanRoot = fs.realpathSync.native(dirPath);
+        if (scanRoot !== identityRoot) {
+            (0, ResourceIdentity_1.normalizeResourceRelativePath)(identityRoot, scanRoot);
+        }
         // 1. Gather all file paths first (Sequential directory scan is safer for handles)
         async function scanDir(currentPath) {
             // Use withFileTypes to avoid extra stat calls
@@ -76,7 +83,7 @@ class FileLoader {
                 console.warn(`Failed to read directory: ${currentPath}`, e);
             }
         }
-        await scanDir(dirPath);
+        await scanDir(scanRoot);
         // 2. Read files with concurrency limit
         const results = [];
         const CONCURRENCY_LIMIT = 100; // Conservative limit
@@ -87,10 +94,17 @@ class FileLoader {
                 try {
                     const content = await fs.promises.readFile(fullPath, 'utf-8');
                     const filename = path.basename(fullPath, path.extname(fullPath));
+                    const relativePath = (0, ResourceIdentity_1.normalizeResourceRelativePath)(identityRoot, fullPath);
+                    const identity = (0, ResourceIdentity_1.createResourceIdentity)(relativePath, filename, content);
                     return {
                         filepath: fullPath,
                         filename: filename,
-                        content: content
+                        content: content,
+                        relativePath,
+                        sourceUri: identity.sourceUri,
+                        canonicalId: identity.canonicalId,
+                        revision: identity.revision,
+                        identityAliases: identity.identityAliases,
                     };
                 }
                 catch (e) {

package/dist/src/backend/FileLoader.test.js

@@ -0,0 +1,125 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const FileLoader_1 = require("./FileLoader");
+describe('FileLoader resource paths', () => {
+    test('records a normalized path relative to the loaded workspace', async () => {
+        const root = fs.mkdtempSync(path.join(os.tmpdir(), 'noteconnection-file-loader-'));
+        const nested = path.join(root, 'algebra');
+        fs.mkdirSync(nested, { recursive: true });
+        fs.writeFileSync(path.join(nested, 'index.md'), '# Algebra', 'utf8');
+        try {
+            const files = await FileLoader_1.FileLoader.loadFiles(root);
+            expect(files).toHaveLength(1);
+            expect(files[0].relativePath).toBe('algebra/index.md');
+            expect(files[0].sourceUri).toBe('note://workspace/v1/algebra/index.md');
+            expect(files[0].canonicalId).toBe('algebra/index');
+            expect(files[0].revision).toMatch(/^sha256:[0-9a-f]{64}$/);
+            expect(files[0].identityAliases).toEqual(expect.arrayContaining([
+                'index',
+                'algebra/index.md',
+            ]));
+        }
+        finally {
+            fs.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    test('keeps identity stable when loading a workspace subdirectory', async () => {
+        const root = fs.mkdtempSync(path.join(os.tmpdir(), 'noteconnection-file-loader-root-'));
+        const nested = path.join(root, 'algebra');
+        fs.mkdirSync(nested, { recursive: true });
+        fs.writeFileSync(path.join(nested, 'index.md'), '# Algebra', 'utf8');
+        try {
+            const files = await FileLoader_1.FileLoader.loadFiles(nested, ['.md'], root);
+            expect(files).toHaveLength(1);
+            expect(files[0].relativePath).toBe('algebra/index.md');
+            expect(files[0].sourceUri).toBe('note://workspace/v1/algebra/index.md');
+            expect(files[0].canonicalId).toBe('algebra/index');
+        }
+        finally {
+            fs.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    test('rejects an outside scan directory instead of returning an empty successful load', async () => {
+        const fixtureRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'noteconnection-file-loader-boundary-'));
+        const workspaceRoot = path.join(fixtureRoot, 'workspace');
+        const outside = path.join(fixtureRoot, 'outside');
+        fs.mkdirSync(workspaceRoot);
+        fs.mkdirSync(outside);
+        fs.writeFileSync(path.join(outside, 'private.md'), '# Outside');
+        try {
+            await expect(FileLoader_1.FileLoader.loadFiles(outside, ['.md'], workspaceRoot)).rejects.toThrow(/outside workspace root/i);
+        }
+        finally {
+            fs.rmSync(fixtureRoot, { recursive: true, force: true });
+        }
+    });
+    test('rejects a scan directory that escapes the workspace through a symlink', async () => {
+        const fixtureRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'noteconnection-file-loader-symlink-'));
+        const workspaceRoot = path.join(fixtureRoot, 'workspace');
+        const outside = path.join(fixtureRoot, 'outside');
+        fs.mkdirSync(workspaceRoot);
+        fs.mkdirSync(outside);
+        fs.writeFileSync(path.join(outside, 'private.md'), '# Outside');
+        const link = path.join(workspaceRoot, 'linked');
+        fs.symlinkSync(outside, link, process.platform === 'win32' ? 'junction' : 'dir');
+        try {
+            await expect(FileLoader_1.FileLoader.loadFiles(link, ['.md'], workspaceRoot)).rejects.toThrow(/outside workspace root/i);
+        }
+        finally {
+            fs.rmSync(fixtureRoot, { recursive: true, force: true });
+        }
+    });
+    test('keeps canonical identities stable through an in-workspace directory alias', async () => {
+        const root = fs.mkdtempSync(path.join(os.tmpdir(), 'noteconnection-file-loader-alias-'));
+        const nested = path.join(root, 'algebra');
+        fs.mkdirSync(nested);
+        fs.writeFileSync(path.join(nested, 'index.md'), '# Algebra');
+        const link = path.join(root, 'alias');
+        fs.symlinkSync(nested, link, process.platform === 'win32' ? 'junction' : 'dir');
+        try {
+            const files = await FileLoader_1.FileLoader.loadFiles(link, ['.md'], root);
+            expect(files).toHaveLength(1);
+            expect(files[0].relativePath).toBe('algebra/index.md');
+            expect(files[0].sourceUri).toBe('note://workspace/v1/algebra/index.md');
+        }
+        finally {
+            fs.rmSync(root, { recursive: true, force: true });
+        }
+    });
+});

package/dist/src/backend/GraphBuilder.identity.test.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const GraphBuilder_1 = require("./GraphBuilder");
+const config_1 = require("./config");
+describe('GraphBuilder identity compatibility', () => {
+    const originalConfig = {
+        ...config_1.config,
+        exclusionList: [...config_1.config.exclusionList],
+    };
+    beforeEach(() => {
+        config_1.config.enableTags = false;
+        config_1.config.enableStatisticalInference = false;
+        config_1.config.enableVectorSimilarity = false;
+        config_1.config.enableHybridInference = false;
+        config_1.config.enableGPU = false;
+        config_1.config.enableGPULayout = false;
+        config_1.config.clusteringStrategy = 'folder';
+        config_1.config.exclusionList = [];
+    });
+    afterEach(() => {
+        Object.assign(config_1.config, originalConfig);
+    });
+    test('preserves identity metadata, reads URI frontmatter, and accepts URI layouts', async () => {
+        const files = [
+            {
+                filepath: 'workspace/algebra/a.md',
+                filename: 'A',
+                content: '# A',
+                relativePath: 'algebra/a.md',
+                sourceUri: 'note://workspace/v1/algebra/a.md',
+                canonicalId: 'algebra/a',
+                revision: 'sha256:a',
+                identityAliases: ['A', 'algebra/a.md'],
+            },
+            {
+                filepath: 'workspace/algebra/b.md',
+                filename: 'B',
+                content: '---\nprerequisites:\n  - note://workspace/v1/algebra/a.md\n---\n# B',
+                relativePath: 'algebra/b.md',
+                sourceUri: 'note://workspace/v1/algebra/b.md',
+                revision: 'sha256:b',
+                identityAliases: ['B', 'algebra/b.md'],
+            },
+        ];
+        const graph = await GraphBuilder_1.GraphBuilder.build(files, new Map([
+            ['note://workspace/v1/algebra/a.md', { x: 12, y: 34 }],
+        ]));
+        expect(graph.getNode('A')).toEqual(expect.objectContaining({
+            sourceUri: 'note://workspace/v1/algebra/a.md',
+            canonicalId: 'algebra/a',
+            revision: 'sha256:a',
+            identityAliases: expect.arrayContaining(['algebra/a.md']),
+            x: 12,
+            y: 34,
+        }));
+        expect(graph.getIncomingEdges('B')).toEqual(expect.arrayContaining([
+            expect.objectContaining({ source: 'A', target: 'B', type: 'explicit-prerequisite' }),
+        ]));
+    });
+    test('uses indexed keyword candidates without changing exact-match semantics', async () => {
+        const files = [
+            {
+                filepath: 'workspace/alpha.md',
+                filename: 'Alpha',
+                content: 'Alpha is a prerequisite concept.',
+            },
+            {
+                filepath: 'workspace/context.md',
+                filename: 'Context',
+                content: 'This context mentions Alpha as an explicit phrase.',
+            },
+            {
+                filepath: 'workspace/beta.md',
+                filename: 'Beta',
+                content: 'This context mentions alphabet but not the standalone concept.',
+            },
+        ];
+        const graph = await GraphBuilder_1.GraphBuilder.build(files);
+        expect(graph.getOutgoingEdges('Alpha')).toEqual(expect.arrayContaining([
+            expect.objectContaining({ target: 'Context', type: 'keyword-match' }),
+        ]));
+        expect(graph.getOutgoingEdges('Alpha')).not.toEqual(expect.arrayContaining([
+            expect.objectContaining({ target: 'Beta', type: 'keyword-match' }),
+        ]));
+    });
+});