Domerge of current develop (with #341/#349) into feat/git-sync left two CI blockers:
- F1: `pnpm-lock.yaml` — the auto-merge dropped `@docmost/git-sync` from the
`apps/server` importer (present in apps/server/package.json), so
`pnpm install --frozen-lockfile` failed (CI + Docker red at install).
Regenerated with `pnpm install --lockfile-only --fix-lockfile`; faithful frozen
install now EXIT 0.
- F2: removed `packages/mcp/test/unit/schema-surface.test.mjs` — a branch-only
ORPHAN. develop deleted it when mcp moved onto `@docmost/prosemirror-markdown`
(mcp's docmost-schema.ts now RE-EXPORTS the package schema); its inline
reference was stale (missing the package's image `caption`). Coverage lives in
`packages/prosemirror-markdown/test/schema-surface-snapshot.test.ts` on develop.
mcp node --test now 480/480.
Verified (merged head): frozen install 0, editor-ext/pm-markdown/git-sync/mcp
build 0, server tsc 0, mcp 480/480, gate + schema-attribute-contract 32/32.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Blocking (review id 2514):
- [security] Forbid symlinks in vaults. ensureServable now sets
core.symlinks=false in each vault's local git config (a pushed symlink is
checked out as a plain file, never a real link), and the engine cycle wraps
every read/write/mkdir in an lstat/realpath guard (new path-guard.ts) that
refuses a path that is — or traverses — a symlink, or whose realpath escapes
the vault root. Prevents a writer from publishing /etc/passwd or the server
.env, or writing outside the vault. Adds unit tests (path-guard.test.ts) +
a read-guard integration test (cycle.test.ts) + real lstat/realpath in the
roundtrip integration test.
- [simplification] Delete dead lib/diff.ts + test/diff.test.ts and drop the
now-unused @fellow/prosemirror-recreate-transform dependency.
- [documentation] Add a CHANGELOG [Unreleased] → Added entry for git-sync.
Warnings:
- [test-coverage] Cover the CREATE-branch conflict-markers guard (a new .md with
markers and no gitmost_id is recorded as a create failure, never created).
Suggestions:
- [stability] Bound each `git config` in ensureServable with a timeout.
- [authz] Trigger endpoint resolves spaceId workspace-scoped and 404s a foreign
space before any vault directory is created.
- [stability] Attribute git-initiated moves to the service account
(lastUpdatedById), via an optional actor param on PageService.movePage.
- [documentation] Document the per-space autoMergeConflicts toggle in AGENTS.md.
- [test-coverage] Cover the unterminated `:::` callout fence fallback.
- [simplification] Move test-only roundtrip-helpers.ts out of src/ into test/.
Architecture:
- Move the Yjs/ProseMirror merge primitives (yjs-body-merge, three-way-merge,
lcs + specs) into collaboration/merge/, breaking the collaboration →
integrations/git-sync dependency cycle this PR introduced.
- Port the schema-surface drift gate to packages/mcp (the mcp schema mirror had
none); pins 52 entries.
Deferred (with rationale in the review thread): the incremental-pull perf
warning (correctness-neutral; needs a high-water-mark design + its own tests on
the data-loss-critical path) and the redis-sync rolling-deploy mixed-version
edge (the deficient behavior is in already-released old-instance code; the new
code is correct on both sides; impact is a transient rollout-window artifact).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
agent_coder
claude code agent 227