virlow-mcp 3.80.0 → 3.81.0

package/dist/cli.js

@@ -202,6 +202,32 @@ var VirlowApi = class {
   updateFolder(id, body) {
     return this.request("PUT", `/api/folders/${id}`, body);
   }
+  listFiles(noteId, opts = {}) {
+    const qs = opts.trashed ? "?trashed=true" : "";
+    return this.request("GET", `/api/notes/${encodeURIComponent(noteId)}/files${qs}`);
+  }
+  /** The full row, ciphertext included. Trashed files are served too. */
+  getFile(id) {
+    return this.request("GET", `/api/files/${encodeURIComponent(id)}`);
+  }
+  /** Metadata only: what an exposure check needs, without up to 50 MB of ciphertext. */
+  getFileMeta(id) {
+    return this.request("GET", `/api/files/${encodeURIComponent(id)}?metadata=true`);
+  }
+  uploadFile(noteId, body) {
+    return this.request("POST", `/api/notes/${encodeURIComponent(noteId)}/files`, body);
+  }
+  patchFile(id, body) {
+    return this.request("PATCH", `/api/files/${encodeURIComponent(id)}`, body);
+  }
+  /** Moves the file to the note's Recently deleted. There is deliberately no
+   * way to hard-delete from here: Claude's deletes can always be undone. */
+  deleteFile(id) {
+    return this.request("DELETE", `/api/files/${encodeURIComponent(id)}`);
+  }
+  restoreFile(id) {
+    return this.request("POST", `/api/files/${encodeURIComponent(id)}/restore`);
+  }
 };
 
 // ../../packages/mcp-core/dist/vault.js
@@ -443,6 +469,44 @@ async function decryptTitleField(key, encryptedTitle, ivBase64) {
   return new TextDecoder().decode(decrypted);
 }
 
+// ../../packages/crypto/dist/attachments.js
+var LEGACY_ATTACHMENT_MESSAGE = "This file uses an older format. Open it in the Virlow app.";
+var LegacyAttachmentError = class extends Error {
+  constructor() {
+    super(LEGACY_ATTACHMENT_MESSAGE);
+    this.name = "LegacyAttachmentError";
+  }
+};
+function isV2Attachment(encryptedData) {
+  return encryptedData.startsWith("v2:");
+}
+async function encryptAttachment(key, filename, bytes) {
+  const fields = await encryptNoteFields(key, filename, bytesToBase64(bytes));
+  return { encryptedTitle: fields.encryptedTitle, encryptedData: fields.encryptedContent, iv: fields.iv };
+}
+async function encryptAttachmentName(key, filename) {
+  const iv = crypto.getRandomValues(new Uint8Array(ENCRYPTION_CONFIG.IV_LENGTH));
+  const ciphertext = await crypto.subtle.encrypt({ name: ENCRYPTION_CONFIG.ALGORITHM, iv }, key, new TextEncoder().encode(filename));
+  return { encryptedTitle: bytesToBase64(ciphertext), iv: bytesToBase64(iv) };
+}
+async function decryptAttachmentData(key, encryptedData) {
+  if (!isV2Attachment(encryptedData))
+    throw new LegacyAttachmentError();
+  const rest = encryptedData.slice(3);
+  const sep = rest.indexOf(":");
+  if (sep === -1) {
+    throw new Error("Malformed attachment ciphertext: missing the IV separator");
+  }
+  const iv = base64ToBytes(rest.slice(0, sep));
+  const plain = await crypto.subtle.decrypt({ name: ENCRYPTION_CONFIG.ALGORITHM, iv }, key, base64ToArrayBuffer(rest.slice(sep + 1)));
+  return base64ToBytes(new TextDecoder().decode(plain));
+}
+async function decryptAttachment(key, enc) {
+  const bytes = await decryptAttachmentData(key, enc.encryptedData);
+  const filename = await decryptTitleField(key, enc.encryptedTitle, enc.iv);
+  return { filename, bytes };
+}
+
 // ../../packages/crypto/dist/verifier.js
 async function verifyVerifierBlob(key, blob) {
   try {
@@ -1752,6 +1816,342 @@ var NotesService = class {
   }
 };
 
+// ../../packages/mcp-core/dist/attachment-format.js
+var FILENAME_MAX = 255;
+var INLINE_MAX_BYTES = 2 * 1024 * 1024;
+var PATH_MAX_BYTES = 35 * 1024 * 1024;
+var BINARY_INLINE_MAX_BYTES = 2 * 1024 * 1024;
+var TEXT_MAX_CHARS = 2e5;
+var FALLBACK_NAME = "attachment";
+var FORMAT_CONTROL = new RegExp("\\p{Cf}", "u");
+function sanitizeFilename(name) {
+  const base = name.split(/[\\/]/).pop() ?? "";
+  const cleaned = Array.from(base).filter((ch) => {
+    const c = ch.codePointAt(0) ?? 0;
+    if (c < 32 || c === 127 || c >= 128 && c <= 159)
+      return false;
+    return c !== 8232 && c !== 8233 && !FORMAT_CONTROL.test(ch);
+  }).join("").trim();
+  if (!cleaned || cleaned === "." || cleaned === "..")
+    return FALLBACK_NAME;
+  if (cleaned.length <= FILENAME_MAX)
+    return cleaned;
+  const dot = cleaned.lastIndexOf(".");
+  const ext = dot > 0 && cleaned.length - dot <= 16 ? cleaned.slice(dot) : "";
+  return cleaned.slice(0, FILENAME_MAX - ext.length) + ext;
+}
+var MIME_BY_EXT = {
+  txt: "text/plain",
+  log: "text/plain",
+  md: "text/markdown",
+  markdown: "text/markdown",
+  csv: "text/csv",
+  json: "application/json",
+  xml: "application/xml",
+  html: "text/html",
+  htm: "text/html",
+  rtf: "application/rtf",
+  pdf: "application/pdf",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  bmp: "image/bmp",
+  tif: "image/tiff",
+  tiff: "image/tiff",
+  avif: "image/avif",
+  heic: "image/heic",
+  heif: "image/heif",
+  ico: "image/x-icon",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  pages: "application/vnd.apple.pages",
+  numbers: "application/vnd.apple.numbers",
+  zip: "application/zip",
+  gz: "application/gzip",
+  tar: "application/x-tar",
+  "7z": "application/x-7z-compressed",
+  rar: "application/vnd.rar",
+  mp3: "audio/mpeg",
+  m4a: "audio/x-m4a",
+  wav: "audio/wav",
+  ogg: "audio/ogg",
+  aac: "audio/aac",
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mov: "video/quicktime",
+  avi: "video/x-msvideo",
+  woff: "font/woff",
+  woff2: "font/woff2",
+  ttf: "font/ttf",
+  otf: "font/otf",
+  wasm: "application/wasm"
+};
+var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
+  "js",
+  "mjs",
+  "cjs",
+  "jsx",
+  "ts",
+  "tsx",
+  "py",
+  "rb",
+  "go",
+  "rs",
+  "java",
+  "kt",
+  "swift",
+  "c",
+  "h",
+  "cpp",
+  "hpp",
+  "cs",
+  "php",
+  "sh",
+  "bash",
+  "zsh",
+  "ps1",
+  "sql",
+  "yaml",
+  "yml",
+  "toml",
+  "ini",
+  "conf",
+  "env",
+  "css",
+  "scss",
+  "less",
+  "vue",
+  "svelte",
+  "lua",
+  "r",
+  "dart",
+  "scala",
+  "gradle",
+  "dockerfile",
+  "makefile"
+]);
+var TEXT_MIME = /* @__PURE__ */ new Set([
+  "application/json",
+  "application/xml",
+  "application/javascript",
+  "application/x-javascript",
+  "application/x-ndjson",
+  "application/yaml",
+  "application/x-yaml"
+]);
+function extOf(filename) {
+  const lower = filename.toLowerCase();
+  const dot = lower.lastIndexOf(".");
+  return dot === -1 ? lower : lower.slice(dot + 1);
+}
+function inferMimeType(filename) {
+  const ext = extOf(filename);
+  if (MIME_BY_EXT[ext])
+    return MIME_BY_EXT[ext];
+  if (CODE_EXTENSIONS.has(ext))
+    return "text/plain";
+  return "application/octet-stream";
+}
+function isTextLike(mimeType, filename) {
+  const mime = mimeType.split(";")[0].trim().toLowerCase();
+  if (mime.startsWith("text/") || TEXT_MIME.has(mime))
+    return true;
+  if (mime.endsWith("+json") || mime.endsWith("+xml"))
+    return true;
+  const ext = extOf(filename);
+  if (CODE_EXTENSIONS.has(ext))
+    return true;
+  const byExt = MIME_BY_EXT[ext];
+  return byExt !== void 0 && (byExt.startsWith("text/") || TEXT_MIME.has(byExt));
+}
+function formatSize(bytes) {
+  if (bytes < 1024)
+    return `${bytes} B`;
+  if (bytes < 1024 * 1024)
+    return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function decodeBase64Strict(input, max = INLINE_MAX_BYTES) {
+  const compact = input.replace(/\s+/g, "");
+  if (compact.length > Math.ceil(max * 4 / 3) + 4) {
+    throw new Error(`content_base64 is about ${formatSize(Math.floor(compact.length * 3 / 4))}; the limit for inline content is ${formatSize(max)}.`);
+  }
+  if (compact.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(compact)) {
+    throw new Error("content_base64 is not valid base64.");
+  }
+  return base64ToBytes(compact);
+}
+function checkSize(bytes, max, label) {
+  if (bytes.byteLength === 0) {
+    throw new Error(`${label} is empty. There is nothing to attach.`);
+  }
+  if (bytes.byteLength > max) {
+    const where = max === INLINE_MAX_BYTES ? "the limit for inline content is" : "the limit for attaching from disk is";
+    const hint = max === INLINE_MAX_BYTES ? " Attach larger files from disk with path, using a local Virlow MCP server." : "";
+    throw new Error(`${label} is ${formatSize(bytes.byteLength)}; ${where} ${formatSize(max)}.${hint}`);
+  }
+  return bytes;
+}
+function renderAttachment(info, bytes, opts) {
+  const filename = sanitizeFilename(info.filename);
+  if (isTextLike(info.mimeType, filename)) {
+    const text = new TextDecoder("utf-8").decode(bytes);
+    if (text.length <= TEXT_MAX_CHARS)
+      return text;
+    return `${text.slice(0, TEXT_MAX_CHARS)}
+
+[truncated: showing the first ${TEXT_MAX_CHARS} of ${text.length} characters]`;
+  }
+  if (bytes.byteLength <= BINARY_INLINE_MAX_BYTES) {
+    return `${filename} \xB7 ${info.mimeType} \xB7 ${formatSize(bytes.byteLength)} \xB7 base64
+${bytesToBase64(bytes)}`;
+  }
+  const size = `${filename} is ${formatSize(bytes.byteLength)}, larger than the ${formatSize(BINARY_INLINE_MAX_BYTES)} that can be returned inline.`;
+  throw new Error(opts.canSave ? `${size} Pass save_to with an absolute path to write it to disk.` : `${size} Open it in the Virlow app, or read it through a local Virlow MCP server, which can save it to disk.`);
+}
+
+// ../../packages/mcp-core/dist/attachments.js
+var WRONG_KEY_MESSAGE = "Could not decrypt this file with your vault key. Open it in the Virlow app.";
+var API_LEGACY_RENAME_PREFIX = "This file uses an older format.";
+function renameFailure(err) {
+  if (err instanceof ApiError && err.status === 409 && err.message.startsWith(API_LEGACY_RENAME_PREFIX)) {
+    return new LegacyAttachmentError();
+  }
+  return err;
+}
+function decryptFailure(err) {
+  if (err instanceof LegacyAttachmentError)
+    return err;
+  if (err instanceof Error && err.name === "OperationError")
+    return new Error(WRONG_KEY_MESSAGE);
+  return err instanceof Error ? err : new Error(String(err));
+}
+function inferredMimeType(filename, fromText) {
+  const inferred = inferMimeType(filename);
+  return fromText && inferred === "application/octet-stream" ? "text/plain" : inferred;
+}
+var AttachmentsService = class {
+  api;
+  vault;
+  constructor(api, vault) {
+    this.api = api;
+    this.vault = vault;
+  }
+  async list(noteId, includeTrashed) {
+    const key = this.requireSession();
+    await this.requireExposed(noteId);
+    const live = await this.api.listFiles(noteId);
+    const trashed = includeTrashed ? await this.api.listFiles(noteId, { trashed: true }) : [];
+    return Promise.all([...live, ...trashed].map((file) => this.describe(key, file)));
+  }
+  async add(input) {
+    if (input.bytes.byteLength === 0)
+      throw new Error("The file is empty. There is nothing to attach.");
+    if (input.bytes.byteLength > PATH_MAX_BYTES) {
+      throw new Error(`The file is ${formatSize(input.bytes.byteLength)}; the most that can be attached is ${formatSize(PATH_MAX_BYTES)}.`);
+    }
+    const key = this.requireSession();
+    await this.requireExposed(input.noteId);
+    const filename = sanitizeFilename(input.filename);
+    const encrypted = await encryptAttachment(key, filename, input.bytes);
+    const row = await this.api.uploadFile(input.noteId, {
+      ...encrypted,
+      // Stored for the web app's legacy per-salt key; unused under a master key.
+      salt: bytesToBase64(crypto.getRandomValues(new Uint8Array(32))),
+      mimeType: input.mimeType ?? inferredMimeType(filename, input.fromText === true),
+      size: input.bytes.byteLength
+    });
+    return { ...infoOf(row), filename };
+  }
+  async read(id) {
+    const key = this.requireSession();
+    const meta = await this.api.getFileMeta(id);
+    await this.requireExposed(meta.noteId);
+    const file = await this.api.getFile(id);
+    if (file.noteId !== meta.noteId)
+      await this.requireExposed(file.noteId);
+    try {
+      const { filename, bytes } = await decryptAttachment(key, file);
+      return { info: { ...infoOf(file), filename: sanitizeFilename(filename) }, bytes };
+    } catch (err) {
+      throw decryptFailure(err);
+    }
+  }
+  async rename(id, newFilename) {
+    const key = this.requireSession();
+    const file = await this.api.getFileMeta(id);
+    await this.requireExposed(file.noteId);
+    const filename = sanitizeFilename(newFilename);
+    const row = await this.api.patchFile(id, await encryptAttachmentName(key, filename)).catch((err) => {
+      throw renameFailure(err);
+    });
+    return { ...infoOf(row), filename };
+  }
+  async move(id, toNoteId) {
+    const key = this.requireSession();
+    const file = await this.api.getFileMeta(id);
+    await this.requireExposed(file.noteId, toNoteId);
+    return this.describe(key, await this.api.patchFile(id, { noteId: toNoteId }));
+  }
+  async trash(id) {
+    this.requireSession();
+    const file = await this.api.getFileMeta(id);
+    await this.requireExposed(file.noteId);
+    await this.api.deleteFile(id);
+  }
+  async restore(id) {
+    const key = this.requireSession();
+    const file = await this.api.getFileMeta(id);
+    await this.requireExposed(file.noteId);
+    return this.describe(key, await this.api.restoreFile(id));
+  }
+  /** Metadata with the filename decrypted. A legacy row's placeholder title
+   * does not decrypt; it falls back to its plaintext name, then a generic one. */
+  async describe(key, file) {
+    try {
+      const filename = await decryptTitleField(key, file.encryptedTitle, file.iv);
+      return { ...infoOf(file), filename: sanitizeFilename(filename) };
+    } catch {
+      return infoOf(file);
+    }
+  }
+  async requireExposed(...noteIds) {
+    const [{ folders }, ...rows] = await Promise.all([
+      this.api.listFolders(),
+      ...noteIds.map((id) => this.api.getNote(id))
+    ]);
+    const exposure = computeExposure(folders);
+    for (const row of rows) {
+      if (!exposure.allows(row.folderId)) {
+        throw new Error(`Note ${row.id} is in a folder that is not exposed to MCP. Turn on "Expose to MCP" in that folder's settings in the Virlow app to access it here.`);
+      }
+    }
+  }
+  requireSession() {
+    const key = this.vault.session.key;
+    this.vault.touch();
+    return key;
+  }
+};
+function infoOf(file) {
+  return {
+    id: file.id,
+    noteId: file.noteId,
+    filename: sanitizeFilename(file.originalName ?? "attachment"),
+    mimeType: file.mimeType,
+    size: file.size,
+    uploadedAt: file.uploadedAt,
+    deletedAt: file.deletedAt ?? null
+  };
+}
+
 // ../../packages/memory-core/dist/constants.js
 var EMBEDDING_MODEL_ID = "Xenova/all-MiniLM-L6-v2";
 var EMBEDDING_MODEL_REVISION = "751bff37182d3f1213fa05d7196b954e230abad9";
@@ -3031,7 +3431,154 @@ function memoriesUnreadableMessage(err) {
   return `Could not check whether AI memories are on: ${reason}. Nothing was changed. Wait a minute and try again; this is not the AI memories switch.`;
 }
 
+// ../../packages/mcp-core/dist/http/server.js
+import { createServer } from "node:http";
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import path2 from "node:path";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+
+// ../../packages/mcp-core/dist/http/local-origin.js
+function isLoopbackBind(host) {
+  const h = host.trim().toLowerCase();
+  if (h === "localhost" || h === "::1" || h === "[::1]")
+    return true;
+  const m = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
+  if (m === null)
+    return false;
+  return m.slice(1).every((o) => Number(o) <= 255 && (o === "0" || !o.startsWith("0")));
+}
+function withoutPort(host) {
+  return host.replace(/:\d+$/, "").toLowerCase();
+}
+function isLoopbackHost(hostHeader) {
+  if (hostHeader === void 0 || hostHeader === "")
+    return false;
+  return isLoopbackBind(withoutPort(hostHeader.trim()));
+}
+function isAllowedOrigin(originHeader) {
+  if (originHeader === void 0 || originHeader === "")
+    return true;
+  try {
+    return isLoopbackBind(new URL(originHeader).hostname);
+  } catch {
+    return false;
+  }
+}
+function rejectReason(headers, enforce) {
+  if (!enforce)
+    return null;
+  if (!isLoopbackHost(headers.host))
+    return "non-loopback Host";
+  if (!isAllowedOrigin(headers.origin))
+    return "cross-site Origin";
+  return null;
+}
+var SECURITY_HEADERS = Object.freeze({
+  "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
+  "x-frame-options": "DENY",
+  "x-content-type-options": "nosniff",
+  "referrer-policy": "same-origin",
+  "cache-control": "no-store"
+});
+
+// ../../packages/mcp-core/dist/http/server.js
+function defaultTokenPath(homeDir) {
+  return path2.join(homeDir, ".virlow-mcp", "http-token");
+}
+async function loadOrCreateToken(tokenPath) {
+  try {
+    const existing = (await readFile2(tokenPath, "utf8")).trim();
+    if (existing.length > 0)
+      return existing;
+  } catch {
+  }
+  const token = randomBytes(32).toString("base64url");
+  await mkdir2(path2.dirname(tokenPath), { recursive: true, mode: 448 });
+  await writeFile2(tokenPath, `${token}
+`, { mode: 384 });
+  return token;
+}
+function tokenMatches(provided, expected) {
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) {
+    timingSafeEqual(b, b);
+    return false;
+  }
+  return timingSafeEqual(a, b);
+}
+function bearerFrom(header) {
+  if (!header)
+    return null;
+  const match = /^Bearer[ ]+(.+)$/i.exec(header.trim());
+  return match ? match[1].trim() : null;
+}
+async function handleWithFreshTransport(server, req, res) {
+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: void 0
+  });
+  res.on("close", () => {
+    void transport.close();
+    void server.close();
+  });
+  await server.connect(transport);
+  await transport.handleRequest(req, res);
+}
+async function startHttpServer(opts) {
+  const host = opts.host ?? "127.0.0.1";
+  const mcpPath = opts.path ?? "/mcp";
+  const enforceLocal = isLoopbackBind(host);
+  const httpServer = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", `http://${host}`);
+    if (rejectReason(req.headers, enforceLocal) !== null) {
+      res.writeHead(403, { ...SECURITY_HEADERS, "content-type": "application/json" });
+      res.end(JSON.stringify({ error: "forbidden" }));
+      return;
+    }
+    if (url.pathname === "/health") {
+      res.writeHead(200, { ...SECURITY_HEADERS, "content-type": "application/json" });
+      res.end(JSON.stringify({ ok: true }));
+      return;
+    }
+    if (url.pathname !== mcpPath) {
+      res.writeHead(404, SECURITY_HEADERS).end();
+      return;
+    }
+    const provided = bearerFrom(req.headers.authorization);
+    if (provided === null || opts.authorize(provided) === null) {
+      res.writeHead(401, {
+        ...SECURITY_HEADERS,
+        "content-type": "application/json",
+        "www-authenticate": "Bearer"
+      });
+      res.end(JSON.stringify({ error: "unauthorized" }));
+      return;
+    }
+    void handleWithFreshTransport(opts.makeServer(), req, res);
+  });
+  await new Promise((resolve, reject) => {
+    httpServer.once("error", reject);
+    httpServer.listen(opts.port ?? 0, host, () => {
+      httpServer.removeListener("error", reject);
+      resolve();
+    });
+  });
+  const address = httpServer.address();
+  const port = typeof address === "object" && address !== null ? address.port : 0;
+  return {
+    port,
+    host,
+    close: () => new Promise((resolve) => {
+      httpServer.close(() => resolve());
+    })
+  };
+}
+
 // ../../packages/mcp-core/dist/tools.js
+import { constants as fsConstants } from "node:fs";
+import { lstat, open, realpath, writeFile as writeFile3 } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
@@ -3056,6 +3603,28 @@ function projectPausedMessage(namespace) {
   return `Not saved: saving memories is paused for the project "${namespace}" in the Virlow app. Recall still works; do not retry or ask the user to save this another way.`;
 }
 
+// ../../packages/mcp-core/dist/local-paths.js
+var currentPlatform = () => process.platform === "win32" ? "win32" : "posix";
+var WIN_RESERVED = /^(con|prn|aux|nul|com[0-9¹²³]|lpt[0-9¹²³]|conin\$|conout\$)(\..*)?$/i;
+function isLocalWindowsPath(p) {
+  if (!/^[A-Za-z]:[\\/]/.test(p))
+    return false;
+  if (p.indexOf(":", 2) !== -1)
+    return false;
+  return !p.slice(3).split(/[\\/]/).some((segment) => WIN_RESERVED.test(segment.replace(/[ .]+$/, "")));
+}
+function requireLocalAbsolutePath(p, label, platform = currentPlatform()) {
+  if (platform === "win32") {
+    const candidate = /^\\\\\?\\[A-Za-z]:\\/.test(p) ? p.slice(4) : p;
+    if (isLocalWindowsPath(candidate))
+      return candidate;
+    throw new Error(`${label} must be a full local path like C:\\Users\\you\\file.pdf, got "${p}". Network and device paths are not allowed.`);
+  }
+  if (p.startsWith("/") && !p.startsWith("//"))
+    return p;
+  throw new Error(`${label} must be an absolute path like /home/you/file.pdf, got "${p}".`);
+}
+
 // ../../packages/mcp-core/dist/tools.js
 function textResult(text) {
   return { content: [{ type: "text", text }] };
@@ -3145,6 +3714,118 @@ var relationSchema = z.object({
   to: z.string().max(40).optional()
 });
 var truncate = (text, max = 120) => text.length > max ? `${text.slice(0, max)}\u2026` : text;
+var errnoOf = (err) => err?.code;
+async function attachmentBytes(args, fileAccess) {
+  const given = [args.text, args.content_base64, fileAccess ? args.path : void 0].filter((v) => v !== void 0).length;
+  if (given !== 1) {
+    throw new Error(fileAccess ? "Pass exactly one of text, content_base64 or path." : "Pass exactly one of text or content_base64.");
+  }
+  if (args.text !== void 0) {
+    if (args.text.length > INLINE_MAX_BYTES) {
+      throw new Error(`text is over ${formatSize(INLINE_MAX_BYTES)}; the limit for inline content is ${formatSize(INLINE_MAX_BYTES)}.`);
+    }
+    return checkSize(new TextEncoder().encode(args.text), INLINE_MAX_BYTES, "text");
+  }
+  if (args.content_base64 !== void 0) {
+    return checkSize(decodeBase64Strict(args.content_base64, INLINE_MAX_BYTES), INLINE_MAX_BYTES, "content_base64");
+  }
+  return readLocalFile(requireLocalAbsolutePath(args.path, "path"));
+}
+async function readLocalFile(file) {
+  const handle = await open(file, fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0)).catch((err) => {
+    const code = errnoOf(err);
+    if (code === "ENOENT" || code === "ENOTDIR")
+      throw new Error(`${file} does not exist.`);
+    if (code === "EISDIR")
+      throw new Error(`${file} is not a regular file.`);
+    throw err;
+  });
+  try {
+    const info = await handle.stat();
+    if (!info.isFile())
+      throw new Error(`${file} is not a regular file.`);
+    const tooBig = (size) => new Error(`${file} is ${formatSize(size)}; the limit for attaching from disk is ${formatSize(PATH_MAX_BYTES)}.`);
+    if (info.size > PATH_MAX_BYTES)
+      throw tooBig(info.size);
+    const cap = PATH_MAX_BYTES + 1;
+    let buf = Buffer.allocUnsafe(Math.min(info.size + 1, cap));
+    let total = 0;
+    for (; ; ) {
+      if (total === buf.length) {
+        if (buf.length === cap)
+          break;
+        const grown = Buffer.allocUnsafe(Math.min(buf.length * 2, cap));
+        buf.copy(grown, 0, 0, total);
+        buf = grown;
+      }
+      const { bytesRead } = await handle.read(buf, total, buf.length - total, null);
+      if (bytesRead === 0)
+        break;
+      total += bytesRead;
+    }
+    if (total > PATH_MAX_BYTES)
+      throw tooBig(total);
+    return checkSize(new Uint8Array(buf.subarray(0, total)), PATH_MAX_BYTES, file);
+  } finally {
+    await handle.close();
+  }
+}
+async function saveAttachment(saveTo, bytes, overwrite) {
+  const asked = requireLocalAbsolutePath(saveTo, "save_to");
+  const noFolder = `The folder for ${saveTo} does not exist. Create it first; read_attachment does not create folders.`;
+  const realParent = await realpath(dirname(asked)).catch((err) => {
+    const code = errnoOf(err);
+    if (code === "ENOENT" || code === "ENOTDIR")
+      throw new Error(noFolder);
+    throw err;
+  });
+  try {
+    requireLocalAbsolutePath(realParent, "save_to");
+  } catch {
+    throw new Error(`The folder for ${saveTo} resolves to ${realParent}, which is not on a local disk. read_attachment only writes to local folders.`);
+  }
+  const target = join(realParent, basename(asked));
+  const linkMessage = `${saveTo} is a symbolic link. read_attachment does not write through links.`;
+  const existing = await lstat(target).catch((err) => {
+    if (errnoOf(err) === "ENOENT")
+      return null;
+    throw err;
+  });
+  if (existing) {
+    if (existing.isSymbolicLink())
+      throw new Error(linkMessage);
+    if (existing.isDirectory())
+      throw new Error(`${saveTo} is a directory, not a file.`);
+    if (!overwrite)
+      throw new Error(`${saveTo} already exists. Pass overwrite: true to replace it.`);
+  }
+  const flag = overwrite ? fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_TRUNC | (fsConstants.O_NOFOLLOW ?? 0) : "wx";
+  try {
+    await writeFile3(target, bytes, { flag });
+  } catch (err) {
+    const code = errnoOf(err);
+    if (code === "EEXIST")
+      throw new Error(`${saveTo} already exists. Pass overwrite: true to replace it.`);
+    if (code === "ELOOP")
+      throw new Error(linkMessage);
+    if (code === "EISDIR")
+      throw new Error(`${saveTo} is a directory, not a file.`);
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      throw new Error(noFolder);
+    }
+    throw err;
+  }
+}
+function attachmentListing(files) {
+  return JSON.stringify(files.map((f) => ({
+    id: f.id,
+    filename: f.filename,
+    mime_type: f.mimeType,
+    size: f.size,
+    uploaded_at: f.uploadedAt,
+    ...f.deletedAt ? { deleted_at: f.deletedAt } : {}
+  })), null, 2);
+}
 function createServices(opts) {
   const api = opts.api ?? new VirlowApi(opts.apiUrl);
   const vault = new Vault(opts.autoLockMs);
@@ -3693,151 +4374,110 @@ ${lines.join("\n")}`);
     const folder = await notesService.createFolder(args.name, args.parentId);
     return textResult(`created folder ${folder.id}`);
   }));
-  return { server, vault };
-}
-
-// src/unlock.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { spawn } from "node:child_process";
-import * as http from "node:http";
-
-// ../../packages/mcp-core/dist/http/server.js
-import { createServer } from "node:http";
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { randomBytes, timingSafeEqual } from "node:crypto";
-import path2 from "node:path";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-
-// ../../packages/mcp-core/dist/http/local-origin.js
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]", "::1"]);
-function withoutPort(host) {
-  return host.replace(/:\d+$/, "").toLowerCase();
-}
-function isLoopbackHost(hostHeader) {
-  if (hostHeader === void 0 || hostHeader === "")
-    return false;
-  return LOOPBACK_HOSTS.has(withoutPort(hostHeader.trim()));
-}
-function isAllowedOrigin(originHeader) {
-  if (originHeader === void 0 || originHeader === "")
-    return true;
-  try {
-    return LOOPBACK_HOSTS.has(new URL(originHeader).hostname.toLowerCase());
-  } catch {
-    return false;
-  }
-}
-function rejectReason(headers, enforce) {
-  if (!enforce)
-    return null;
-  if (!isLoopbackHost(headers.host))
-    return "non-loopback Host";
-  if (!isAllowedOrigin(headers.origin))
-    return "cross-site Origin";
-  return null;
-}
-var SECURITY_HEADERS = Object.freeze({
-  "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
-  "x-frame-options": "DENY",
-  "x-content-type-options": "nosniff",
-  "referrer-policy": "same-origin",
-  "cache-control": "no-store"
-});
-
-// ../../packages/mcp-core/dist/http/server.js
-function defaultTokenPath(homeDir) {
-  return path2.join(homeDir, ".virlow-mcp", "http-token");
-}
-async function loadOrCreateToken(tokenPath) {
-  try {
-    const existing = (await readFile2(tokenPath, "utf8")).trim();
-    if (existing.length > 0)
-      return existing;
-  } catch {
-  }
-  const token = randomBytes(32).toString("base64url");
-  await mkdir2(path2.dirname(tokenPath), { recursive: true, mode: 448 });
-  await writeFile2(tokenPath, `${token}
-`, { mode: 384 });
-  return token;
-}
-function tokenMatches(provided, expected) {
-  const a = Buffer.from(provided);
-  const b = Buffer.from(expected);
-  if (a.length !== b.length) {
-    timingSafeEqual(b, b);
-    return false;
-  }
-  return timingSafeEqual(a, b);
-}
-function bearerFrom(header) {
-  if (!header)
-    return null;
-  const match = /^Bearer[ ]+(.+)$/i.exec(header.trim());
-  return match ? match[1].trim() : null;
-}
-async function handleWithFreshTransport(server, req, res) {
-  const transport = new StreamableHTTPServerTransport({
-    sessionIdGenerator: void 0
-  });
-  res.on("close", () => {
-    void transport.close();
-    void server.close();
-  });
-  await server.connect(transport);
-  await transport.handleRequest(req, res);
-}
-async function startHttpServer(opts) {
-  const host = opts.host ?? "127.0.0.1";
-  const mcpPath = opts.path ?? "/mcp";
-  const enforceLocal = host === "127.0.0.1" || host === "::1" || host === "localhost";
-  const httpServer = createServer((req, res) => {
-    const url = new URL(req.url ?? "/", `http://${host}`);
-    if (rejectReason(req.headers, enforceLocal) !== null) {
-      res.writeHead(403, { ...SECURITY_HEADERS, "content-type": "application/json" });
-      res.end(JSON.stringify({ error: "forbidden" }));
-      return;
+  const attachments = new AttachmentsService(api, vault);
+  const fileAccess = opts.fileAccess === true;
+  server.registerTool("list_attachments", {
+    description: "List a note's attachments as JSON: id, filename, mime_type, size (bytes) and uploaded_at. Pass include_trashed to also list files in the note's Recently deleted, which carry deleted_at. Requires the vault to be unlocked and the note to be in a folder exposed to AI.",
+    inputSchema: {
+      note_id: z.string().min(1),
+      include_trashed: z.boolean().optional()
     }
-    if (url.pathname === "/health") {
-      res.writeHead(200, { ...SECURITY_HEADERS, "content-type": "application/json" });
-      res.end(JSON.stringify({ ok: true }));
-      return;
+  }, wrap(async (args) => {
+    const files = await attachments.list(args.note_id, args.include_trashed === true);
+    return textResult(attachmentListing(files));
+  }));
+  const addBase = {
+    note_id: z.string().min(1),
+    filename: z.string().min(1).max(1e3).describe("Shown in the app. Only the basename is kept."),
+    mime_type: z.string().min(1).max(100).optional().describe("Inferred from the filename when omitted; must be a type Virlow accepts."),
+    text: z.string().optional().describe("UTF-8 content, up to 2 MB."),
+    content_base64: z.string().optional().describe("Binary content as base64, up to 2 MB decoded.")
+  };
+  const addDescription = "Attach a file to a note. Give exactly one source: " + (fileAccess ? "text, content_base64, or path. text and content_base64 take up to 2 MB; path is an absolute path to a regular file on this machine's own disk, up to 35 MB. Symbolic links in path are followed; network and device paths are refused" : "text or content_base64, each up to 2 MB. Larger files can be attached from disk only through a local Virlow MCP server") + ". The file is encrypted on this side before upload, the same way the Virlow app does it. Requires the vault to be unlocked and the note to be in a folder exposed to AI.";
+  const addHandler = wrap(async (args) => {
+    const bytes = await attachmentBytes(args, fileAccess);
+    const info = await attachments.add({
+      noteId: args.note_id,
+      filename: args.filename,
+      mimeType: args.mime_type,
+      fromText: args.text !== void 0,
+      bytes
+    });
+    return textResult(`attached ${info.filename} (${formatSize(info.size)}) to note ${args.note_id} as ${info.id}`);
+  });
+  if (fileAccess) {
+    server.registerTool("add_attachment", {
+      description: addDescription,
+      inputSchema: {
+        ...addBase,
+        path: z.string().min(1).optional().describe("Absolute local path of a regular file, up to 35 MB (a drive path on Windows). Symbolic links are followed. Network and device paths are refused.")
+      }
+    }, addHandler);
+  } else {
+    server.registerTool("add_attachment", { description: addDescription, inputSchema: addBase }, addHandler);
+  }
+  const readDescription = "Read an attachment. Text files (plain text, Markdown, CSV, JSON, XML, code) come back as text, cut at 200,000 characters. Other files up to 2 MB come back as base64 after a header line giving the filename, type and size" + (fileAccess ? "; larger ones need save_to, an absolute path on this machine's own disk to write the decrypted file to. save_to never replaces an existing file unless overwrite is true, never writes through a symbolic link, and never creates folders" : "; larger ones cannot be returned here") + ". Files in Recently deleted can be read too. Requires the vault to be unlocked and the note to be in a folder exposed to AI.";
+  const readHandler = wrap(async (args) => {
+    const { info, bytes } = await attachments.read(args.attachment_id);
+    if (fileAccess && args.save_to !== void 0) {
+      await saveAttachment(args.save_to, bytes, args.overwrite === true);
+      return textResult(`saved ${info.filename} (${formatSize(bytes.byteLength)}) to ${args.save_to}`);
     }
-    if (url.pathname !== mcpPath) {
-      res.writeHead(404, SECURITY_HEADERS).end();
-      return;
+    return textResult(renderAttachment(info, bytes, { canSave: fileAccess }));
+  });
+  if (fileAccess) {
+    server.registerTool("read_attachment", {
+      description: readDescription,
+      inputSchema: {
+        attachment_id: z.string().min(1),
+        save_to: z.string().min(1).optional().describe("Absolute local path to write the decrypted file to (a drive path on Windows). Network and device paths are refused."),
+        overwrite: z.boolean().optional().describe("Replace an existing regular file at save_to.")
+      }
+    }, readHandler);
+  } else {
+    server.registerTool("read_attachment", { description: readDescription, inputSchema: { attachment_id: z.string().min(1) } }, readHandler);
+  }
+  server.registerTool("rename_attachment", {
+    description: "Rename an attachment. Only the encrypted filename changes; the contents are untouched. Requires the vault to be unlocked and the note to be in a folder exposed to AI.",
+    inputSchema: {
+      attachment_id: z.string().min(1),
+      new_filename: z.string().min(1).max(1e3)
     }
-    const provided = bearerFrom(req.headers.authorization);
-    if (provided === null || opts.authorize(provided) === null) {
-      res.writeHead(401, {
-        ...SECURITY_HEADERS,
-        "content-type": "application/json",
-        "www-authenticate": "Bearer"
-      });
-      res.end(JSON.stringify({ error: "unauthorized" }));
-      return;
+  }, wrap(async (args) => {
+    const info = await attachments.rename(args.attachment_id, args.new_filename);
+    return textResult(`renamed attachment ${args.attachment_id} to ${info.filename}`);
+  }));
+  server.registerTool("move_attachment", {
+    description: "Move an attachment to another note. Both notes must be in folders exposed to AI, and the target must not be in the trash. Requires the vault to be unlocked.",
+    inputSchema: {
+      attachment_id: z.string().min(1),
+      to_note_id: z.string().min(1)
     }
-    void handleWithFreshTransport(opts.makeServer(), req, res);
-  });
-  await new Promise((resolve, reject) => {
-    httpServer.once("error", reject);
-    httpServer.listen(opts.port ?? 0, host, () => {
-      httpServer.removeListener("error", reject);
-      resolve();
-    });
-  });
-  const address = httpServer.address();
-  const port = typeof address === "object" && address !== null ? address.port : 0;
-  return {
-    port,
-    host,
-    close: () => new Promise((resolve) => {
-      httpServer.close(() => resolve());
-    })
-  };
+  }, wrap(async (args) => {
+    await attachments.move(args.attachment_id, args.to_note_id);
+    return textResult(`moved attachment ${args.attachment_id} to note ${args.to_note_id}`);
+  }));
+  server.registerTool("delete_attachment", {
+    description: "Move an attachment to its note's Recently deleted. It can be restored for 30 days with restore_attachment, then it is deleted for good. Requires the vault to be unlocked and the note to be in a folder exposed to AI.",
+    inputSchema: { attachment_id: z.string().min(1) }
+  }, wrap(async (args) => {
+    await attachments.trash(args.attachment_id);
+    return textResult(`moved attachment ${args.attachment_id} to Recently deleted. It can be restored for 30 days with restore_attachment.`);
+  }));
+  server.registerTool("restore_attachment", {
+    description: "Bring an attachment back from its note's Recently deleted. Fails if the note is at its attachment size limit. Requires the vault to be unlocked and the note to be in a folder exposed to AI.",
+    inputSchema: { attachment_id: z.string().min(1) }
+  }, wrap(async (args) => {
+    await attachments.restore(args.attachment_id);
+    return textResult(`restored attachment ${args.attachment_id}`);
+  }));
+  return { server, vault };
 }
 
 // src/unlock.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { spawn } from "node:child_process";
+import * as http from "node:http";
 var UNLOCK_TIMEOUT_MS = 5 * 60 * 1e3;
 var MAX_BAD_NONCE_ATTEMPTS = 3;
 async function performUnlock(api, vault, creds) {
@@ -4102,7 +4742,7 @@ function startUnlockServer(api, vault, opts = {}) {
 }
 
 // src/version.ts
-var VERSION = true ? "3.80.0" : "dev";
+var VERSION = true ? "3.81.0" : "dev";
 
 // src/server.ts
 function defaultEmbeddingCacheDir() {
@@ -4128,6 +4768,9 @@ function withLocalDefaults(opts) {
     })
   };
 }
+function localFileAccess(opts) {
+  return !opts.http || isLoopbackBind(opts.host ?? "127.0.0.1");
+}
 function createServices2(opts) {
   return createServices(withLocalDefaults(opts));
 }
@@ -4214,15 +4857,17 @@ async function main() {
   const modelCacheDir = path4.join(os2.homedir(), ".virlow-mcp", "models");
   const embeddingCacheDir = path4.join(os2.homedir(), ".virlow-mcp", "cache");
   const memoriesEnabled = !process.argv.includes("--no-memories");
-  const serverOpts = { apiUrl, modelCacheDir, embeddingCacheDir, memoriesEnabled };
+  const http2 = process.argv.includes("--http");
+  const host = flagValue("host") ?? "127.0.0.1";
+  const fileAccess = localFileAccess({ http: http2, host });
+  const serverOpts = { apiUrl, modelCacheDir, embeddingCacheDir, memoriesEnabled, fileAccess };
   const services = createServices2(serverOpts);
   const { server } = buildServer2({ ...serverOpts, services });
-  if (process.argv.includes("--http")) {
+  if (http2) {
     const token = await loadOrCreateToken(
       flagValue("token-file") ?? defaultTokenPath(os2.homedir())
     );
     const portFlag = flagValue("port");
-    const host = flagValue("host") ?? "127.0.0.1";
     const running = await startHttpServer({
       makeServer: () => buildServer2({ ...serverOpts, services }).server,
       authorize: (bearer) => tokenMatches(bearer, token) ? { clientId: "cli" } : null,
@@ -4233,9 +4878,9 @@ async function main() {
       `virlow-mcp: listening on http://${running.host}:${running.port}/mcp
 `
     );
-    if (host !== "127.0.0.1") {
+    if (!isLoopbackBind(host)) {
       process.stderr.write(
-        "virlow-mcp: WARNING \u2014 bound to a non-loopback address. Anyone who can reach this port and holds the token can read your decrypted notes.\nvirlow-mcp: WARNING \u2014 this listener speaks plain HTTP, not HTTPS. Off loopback, your notes and the bearer token travel unencrypted. Put a TLS-terminating tunnel in front of it (cloudflared, ssh -R, Tailscale) rather than exposing this port directly.\n"
+        "virlow-mcp: WARNING \u2014 bound to a non-loopback address. Anyone who can reach this port and holds the token can read your decrypted notes.\nvirlow-mcp: WARNING \u2014 this listener speaks plain HTTP, not HTTPS. Off loopback, your notes and the bearer token travel unencrypted. Put a TLS-terminating tunnel in front of it (cloudflared, ssh -R, Tailscale) rather than exposing this port directly.\nvirlow-mcp: local file access is disabled for remote binding: the attachment tools cannot read or write files on this machine (no path or save_to).\n"
       );
     }
     process.stderr.write(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "virlow-mcp",
-  "version": "3.80.0",
+  "version": "3.81.0",
   "description": "Local MCP server for Virlow Secure Notes: end-to-end-encrypted AI memories and notes for Cursor, Claude, Codex, and any MCP client.",
   "license": "UNLICENSED",
   "type": "module",
@@ -34,9 +34,9 @@
     "esbuild": "^0.25.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0",
-    "@batalabs/virlow-crypto": "3.80.0",
-    "@batalabs/virlow-mcp-core": "3.80.0",
-    "@batalabs/virlow-memory": "3.80.0"
+    "@batalabs/virlow-crypto": "3.81.0",
+    "@batalabs/virlow-mcp-core": "3.81.0",
+    "@batalabs/virlow-memory": "3.81.0"
   },
   "scripts": {
     "build": "node build.mjs",