oh-memos-mcp 3.1.6 → 3.1.7

package/CHANGELOG.md

@@ -6,6 +6,72 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [3.1.7] - 2026-08-27
+
+仅 MCP server（npm `oh-memos-mcp`）。Python 包与容器镜像无改动，仍为 3.1.5。
+
+### 🏷️ `open` 报出的画布名，`list` 找不到
+
+goal 足够长时，`actionOpen` 报出的名字比磁盘上真实存在的多一个字符：
+
+```
+open  reports: 000-verify-3-1-6-canvas-delete-and-ref-escaping-over-live-mcp  (61)
+list  shows  : 000-verify-3-1-6-canvas-delete-and-ref-escaping-over-live-mc   (60)
+on disk      : ...-live-mc.mmd
+```
+
+`actionOpen` 先 `slugify(goal)` 拿到最多 `SLUG_MAX`（60）字符，再拼 `${prefix}-`，
+总长可达 64。`saveCanvas` → `canvasPath` 在落盘路上又 slugify 一次，砍回 60。
+**前缀那 4 个字符的预算从来没被算进去。**
+
+`canvasPath` 里那处「slug 与原名不同就拒绝」的检查本该拦住它，但它只在名字
+「像路径」（含 `/`、`\` 或 `..`）时抛错 —— 截断不像路径，于是静默放过。
+
+影响是**报错的句柄，不是损坏的数据**：前缀仍让每个画布互不相同，
+两个前 60 字符相同的长 goal 得到 `000-`/`001-` 两个独立文件，各自节点都在；
+`update`/`delete` 传 `open` 报的长名字也照样能用，因为 `canvasPath` 的截断是幂等的。
+坏的只有一件事：调用方拿到的名字，`list` 永远不会显示，磁盘上也不存在。
+
+修法是把名字组装收进 `canvas-format.ts` 的新函数 `canvasName(prefix, goal)` ——
+让它紧挨着自己必须遵守的那个上限，而不是让 handler 去做预算算术：
+
+```ts
+export function canvasName(prefix: string, goal: string): string {
+  const head = `${prefix}-`;
+  const slug = slugify(goal, SLUG_MAX - head.length);
+  return slug ? `${head}${slug}` : `${head}task`;
+}
+```
+
+`slugify` 因此多一个可选的 `maxLength`，**向内钳制到 `SLUG_MAX`** ——
+调用方能收紧上限，不能放宽它，否则「每个画布文件名都装得进 `SLUG_MAX`」
+这个不变量就成了各调用点的自选项。截断后仍走一次尾部连字符清理，
+所以 `000-abc-.mmd` 这种名字不会出现。
+
+### 🧪 测试
+
+canvas-format 单测 41 → 50，canvas e2e 31 → 36 项。
+
+核心断言是**不动点**而不是长度：`slugify(canvasName(p, g)) === canvasName(p, g)`，
+跨 3 个前缀 × 6 种 goal（超长、纯 CJK、尾部连字符诱饵、前 60 字符相同的两个变体）。
+长度只是症状 —— `canvasPath` 会再 slugify 一次，任何不是不动点的名字都是
+「告诉了调用方、但文件系统从没见过」的名字。
+
+e2e 补的 5 项跨 open/list/show/delete 与磁盘：`open` 报的名字必须等于
+`list` 显示的名字、等于磁盘上存在的文件。反向验证还原实现后 3 项变红
+（长度 64、磁盘上无此名、`list` 显示另一个名字）。
+
+另两项（`reported name still routes to its canvas` / `... to delete`）
+在修复前后都通过 —— `canvasPath` 截断幂等使然。**保留但改名如实**：
+它们守的是「如果有人改用『让 `canvasPath` 对有损名字抛错』来修这个缺陷，
+这条回归会被抓到」，不是这次的不变量。
+
+门禁：vitest 520 passed、tsc、canvas e2e 36 项、pack 契约 104 文件、
+schema budget +0.8%、semantic 快照 17 工具、protocol legacy + v2、
+lite smoke、host-env smoke、spread smoke。
+
+---
+
 ## [3.1.6] - 2026-08-26
 
 仅 MCP server（npm `oh-memos-mcp`）。Python 包与容器镜像无改动，仍为 3.1.5。

package/dist/canvas-format.d.ts

@@ -45,8 +45,31 @@ export declare const SUMMARY_MAX = 120;
  *
  * Returns "" when nothing usable remains (a purely CJK title, for instance);
  * callers must have a fallback and must not write a file named "".
+ *
+ * `maxLength` narrows the cap for a caller that must leave room for a prefix.
+ * It is clamped to `SLUG_MAX`, so no caller can widen the invariant that every
+ * canvas filename fits in `SLUG_MAX` characters.
+ */
+export declare function slugify(input: string, maxLength?: number): string;
+/**
+ * Compose a canvas filename from its prefix and the task goal.
+ *
+ * The prefix has to be part of the length budget, and it was not: `actionOpen`
+ * used to slug the goal to `SLUG_MAX` and then prepend `${prefix}-`, producing a
+ * name up to `SLUG_MAX + 4` characters. `canvasPath` slugs again on the way to
+ * disk and cut it back to `SLUG_MAX`, so the name reported by `open` was not the
+ * name `list` would show, and not the file that existed. Nothing was overwritten
+ * — the numeric prefix still made every canvas distinct — but the handle handed
+ * back to the caller was wrong.
+ *
+ * So the composition lives here, next to the cap it has to respect: slug the
+ * goal into what is left after the prefix, and the result is already a fixed
+ * point of `slugify`.
+ *
+ * A goal with no ASCII (a purely CJK title) slugs to "", so fall back to
+ * `<prefix>-task` rather than writing a file named after the prefix alone.
  */
-export declare function slugify(input: string): string;
+export declare function canvasName(prefix: string, goal: string): string;
 /**
  * Make text safe to sit inside a Mermaid `["..."]` label.
  *

package/dist/canvas-format.js

@@ -36,12 +36,40 @@ const SLUG_MAX = 60;
  *
  * Returns "" when nothing usable remains (a purely CJK title, for instance);
  * callers must have a fallback and must not write a file named "".
+ *
+ * `maxLength` narrows the cap for a caller that must leave room for a prefix.
+ * It is clamped to `SLUG_MAX`, so no caller can widen the invariant that every
+ * canvas filename fits in `SLUG_MAX` characters.
  */
-export function slugify(input) {
+export function slugify(input, maxLength = SLUG_MAX) {
+    const cap = Math.max(0, Math.min(maxLength, SLUG_MAX));
     const lowered = String(input ?? "").toLowerCase();
     const kept = lowered.replace(/[^a-z0-9]+/g, "-");
     const collapsed = kept.replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
-    return collapsed.slice(0, SLUG_MAX).replace(/-+$/g, "");
+    return collapsed.slice(0, cap).replace(/-+$/g, "");
+}
+/**
+ * Compose a canvas filename from its prefix and the task goal.
+ *
+ * The prefix has to be part of the length budget, and it was not: `actionOpen`
+ * used to slug the goal to `SLUG_MAX` and then prepend `${prefix}-`, producing a
+ * name up to `SLUG_MAX + 4` characters. `canvasPath` slugs again on the way to
+ * disk and cut it back to `SLUG_MAX`, so the name reported by `open` was not the
+ * name `list` would show, and not the file that existed. Nothing was overwritten
+ * — the numeric prefix still made every canvas distinct — but the handle handed
+ * back to the caller was wrong.
+ *
+ * So the composition lives here, next to the cap it has to respect: slug the
+ * goal into what is left after the prefix, and the result is already a fixed
+ * point of `slugify`.
+ *
+ * A goal with no ASCII (a purely CJK title) slugs to "", so fall back to
+ * `<prefix>-task` rather than writing a file named after the prefix alone.
+ */
+export function canvasName(prefix, goal) {
+    const head = `${prefix}-`;
+    const slug = slugify(goal, SLUG_MAX - head.length);
+    return slug ? `${head}${slug}` : `${head}task`;
 }
 // ============================================================================
 // escapeLabel

package/dist/handlers/canvas.js

@@ -27,7 +27,7 @@
  * compaction, and anchors that make a summary checkable.
  */
 import { MEMOS_CUBES_DIR } from "../config.js";
-import { NODE_STATUSES, allocateNodeId, countByStatus, formatCanvasHeadline, slugify, truncateSummary, } from "../canvas-format.js";
+import { NODE_STATUSES, allocateNodeId, canvasName, countByStatus, formatCanvasHeadline, truncateSummary, } from "../canvas-format.js";
 import { CanvasPathError, deleteCanvas, listCanvases, loadCanvas, nextPrefix, saveCanvas, } from "../canvas-store.js";
 import { ERR_PARAM_INVALID, ERR_PARAM_MISSING, ERR_OPERATION_FAILED, errorResponse, getCubeIdFromArgs, } from "./utils.js";
 const STATUS_LIST = NODE_STATUSES.join(", ");
@@ -118,10 +118,9 @@ function actionOpen(cubeId, args) {
     if (prefix === null) {
         return errorResponse(`Cube '${cubeId}' already holds 1000 canvases (000-999)`, ERR_OPERATION_FAILED, ["Remove finished canvas files from the cube's canvas/ directory"]);
     }
-    // The goal supplies the slug; a goal with no ASCII (a Chinese title, say)
-    // yields none, so fall back to the prefix rather than writing a nameless file.
-    const goalSlug = slugify(goal);
-    const name = goalSlug ? `${prefix}-${goalSlug}` : `${prefix}-task`;
+    // The prefix is part of the filename budget, so composing the name is
+    // `canvasName`'s job — see the note there on why doing it inline was wrong.
+    const name = canvasName(prefix, goal);
     const now = new Date().toISOString();
     const canvas = {
         prefix,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-memos-mcp",
-  "version": "3.1.6",
+  "version": "3.1.7",
   "description": "MCP Server for oh-memos — Intelligent Memory Management (Node.js, no Python required)",
   "type": "module",
   "main": "dist/index.js",