virlow-mcp 3.14.3 → 3.14.5

package/dist/cli.js

@@ -120,7 +120,7 @@ var VirlowApi = class {
 // ../../packages/mcp-core/dist/vault.js
 var LockedError = class extends Error {
 };
-var Vault = class {
+var Vault = class _Vault {
   autoLockMs;
   _session = null;
   _timerHandle = null;
@@ -177,10 +177,50 @@ var Vault = class {
     }
     return this._session;
   }
+  /**
+   * The largest delay `setTimeout` can actually hold: a 32-bit signed integer
+   * of milliseconds, about 24.9 days.
+   */
+  static MAX_TIMEOUT_MS = 2147483647;
+  /**
+   * Arm the auto-lock, unless the configured delay cannot be one.
+   *
+   * The guard is the whole point. `setTimeout` does not treat an out-of-range
+   * delay as "later" or as an error — it coerces it to **1 millisecond** and
+   * fires:
+   *
+   *   TimeoutOverflowWarning: Infinity does not fit into a 32-bit signed
+   *   integer. Timeout duration was set to 1.
+   *
+   * So `new Vault(Number.POSITIVE_INFINITY)`, which reads as "never auto-lock,
+   * something else owns the timeout", locked the vault a millisecond after
+   * every unlock and every touch. The hosted connector is built exactly that
+   * way — its session store owns the idle timeout — and the result was a vault
+   * that reported itself unlocked on the request that opened it and locked on
+   * every request after:
+   *
+   *   status        -> {"locked": false, "email": "..."}
+   *   list_folders  -> "Vault is locked."   (2 seconds later, same session)
+   *
+   * Nothing in the store was wrong, which is what made it so hard to see: the
+   * session was found on every request, and the vault built from it had already
+   * locked itself. touch() re-armed the same 1ms timer, so activity made it
+   * worse rather than better.
+   *
+   * A delay that cannot be scheduled therefore means no auto-lock at all, which
+   * is what every caller passing one intends. Zero and negatives are the same
+   * case — a vault that locks on the next tick is not a security posture, it is
+   * a broken one — and a caller wanting an immediate lock has `lock()`.
+   */
   _scheduleAutoLock() {
+    const ms = this.autoLockMs;
+    if (!Number.isFinite(ms) || ms <= 0 || ms > _Vault.MAX_TIMEOUT_MS) {
+      this._timerHandle = null;
+      return;
+    }
     this._timerHandle = setTimeout(() => {
       this.lock();
-    }, this.autoLockMs);
+    }, ms);
     this._timerHandle.unref?.();
   }
   _clearTimer() {
@@ -1286,6 +1326,8 @@ function mapError(err) {
     return err.message;
   return String(err);
 }
+var CONTENT_FORMAT = 'CONTENT FORMAT: content is HTML, not Markdown. Virlow renders it in a rich-text editor, so Markdown syntax is stored and displayed literally \u2014 "# Heading" appears as those characters, not as a heading. Use <h1>-<h4>, <p>, <strong>, <em>, <u>, <s>, <mark>, <ul>/<ol>/<li>, <blockquote>, <pre><code>, <a href>, <hr>, <img src>, and <table>/<tr>/<th>/<td>. Task lists are <ul data-type="taskList"> with <li data-checked="true|false">. Wrap every paragraph in <p>; a bare newline is not a paragraph break. STYLE: never use em-dashes (\u2014). Use a comma, a colon, or two sentences.';
+var HTML_FIELD_HINT = "Note body as HTML (not Markdown). Paragraphs in <p>, headings in <h1>-<h4>. See the tool description for the full tag list.";
 function wrap(fn) {
   return async (...args) => {
     try {
@@ -1495,7 +1537,7 @@ page ${pagination.page} of ${pagination.pages} (${pagination.total} total)` + fi
     return textResult(body + notice);
   }));
   server.registerTool("read_note", {
-    description: "Read the full title and content of a note by id. Requires the vault to be unlocked.",
+    description: "Read the full title and content of a note by id. Requires the vault to be unlocked. Content comes back as the HTML the editor stores \u2014 write it back in the same form.",
     inputSchema: {
       id: z.string().min(1)
     }
@@ -1506,10 +1548,10 @@ page ${pagination.page} of ${pagination.pages} (${pagination.total} total)` + fi
 ${note.content}`);
   }));
   server.registerTool("create_note", {
-    description: "Create a new note with a title and content, optionally placed in a folder. Requires the vault to be unlocked.",
+    description: "Create a new note with a title and content, optionally placed in a folder. Requires the vault to be unlocked.\n\n" + CONTENT_FORMAT,
     inputSchema: {
       title: z.string().min(1).max(200),
-      content: z.string().max(5e4).optional(),
+      content: z.string().max(5e4).optional().describe(HTML_FIELD_HINT),
       folderId: z.string().optional(),
       type: z.string().max(50).optional()
     }
@@ -1518,11 +1560,11 @@ ${note.content}`);
     return textResult(`created note ${note.id}`);
   }));
   server.registerTool("update_note", {
-    description: "Update the title and/or content of an existing note by id. Only the provided fields are changed. Requires the vault to be unlocked.",
+    description: "Update the title and/or content of an existing note by id. Only the provided fields are changed. Content replaces the note body entirely \u2014 read the note first if you mean to add to it. Requires the vault to be unlocked.\n\n" + CONTENT_FORMAT,
     inputSchema: {
       id: z.string().min(1),
       title: z.string().min(1).max(200).optional(),
-      content: z.string().max(5e4).optional()
+      content: z.string().max(5e4).optional().describe(HTML_FIELD_HINT)
     }
   }, wrap(async (args) => {
     await notesService.updateNote(args.id, { title: args.title, content: args.content });
@@ -1881,7 +1923,7 @@ function startUnlockServer(api, vault, opts = {}) {
 }
 
 // src/version.ts
-var VERSION = true ? "3.14.3" : "dev";
+var VERSION = true ? "3.14.5" : "dev";
 
 // src/server.ts
 function defaultEmbeddingCacheDir() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "virlow-mcp",
-  "version": "3.14.3",
+  "version": "3.14.5",
   "description": "Local MCP server for Virlow Secure Notes: end-to-end-encrypted AI memories and notes for Cursor, Claude, Codex, and any MCP client.",
   "license": "MIT",
   "type": "module",
@@ -34,9 +34,9 @@
     "esbuild": "^0.25.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0",
-    "@batalabs/virlow-crypto": "3.14.3",
-    "@batalabs/virlow-memory": "3.14.3",
-    "@batalabs/virlow-mcp-core": "3.14.3"
+    "@batalabs/virlow-crypto": "3.14.5",
+    "@batalabs/virlow-memory": "3.14.5",
+    "@batalabs/virlow-mcp-core": "3.14.5"
   },
   "scripts": {
     "build": "node build.mjs",