fix: return tool errors with vault-relative paths and the server's own messages

AGENTS.md

@@ -169,7 +169,7 @@ A module's folder is decided by **what it depends on**, not just its topic:
   (`createSafeHandlers`, `formatNoteMetadata`, `ToolRegistrationContext`
   type) live in `tool-helpers.ts`. Group modules take `safeHandler` and
   `safeHandlerContent` from the registration context; `createSafeHandlers`
-  builds them per server from the enabled tools.
+  builds them per server from the enabled tools and the vault path.
   **Tool handlers stay thin**: schema, wire mapping (snake_case ↔ camelCase),
   one data-layer call, and content-block/JSON formatting. Multi-step
   composition — filtering, counting, pagination, dispatching across parsers
@@ -390,8 +390,13 @@ log would produce N lines during a vault rebuild (one per note), it's
   what went wrong in their own domain and never name API surfaces
   (tool names, routes) or prescribe caller-level remediation.
 - Log full detail internally, return generic messages externally —
-  error responses to clients never include paths, stack traces, or
-  implementation state.
+  error responses to clients never include the server's own paths,
+  stack traces, or implementation state. A Node error's paths reach the
+  client vault-relative, because the tool and prompt boundaries rewrite
+  them (`describeErrorRelativeTo`), so a wrapper passes the Node error as
+  `cause` and never copies its message into its own. Errors the server
+  throws itself keep their text, since they can quote the caller's input
+  (a refused absolute path comes back as sent).
 - `/healthz` needs no sign-in, so never add deployment settings or host
   details to its response. The full server returns `{ ok: true }`, and
   setup mode adds `mode: "setup"` so the setup page can tell when the full

ARCHITECTURE.md

@@ -1288,11 +1288,25 @@ Docker hardening, and durability seatbelts above.
 - **`safeHandler()`** (built per server by `createSafeHandlers` in
   `tool-helpers.ts`): wraps every MCP tool handler with try/catch. Errors
   return a structured `isError` response with the error's name and message,
-  plus how to fix a properties-block refusal — no stack traces, no absolute
-  paths. A buggy tool never crashes the server.
+  plus how to fix a properties-block refusal — no stack traces. A buggy tool
+  never crashes the server.
+- **Library errors**: an image sharp cannot decode, a password-protected
+  PDF, a damaged PDF, and a PDF reader that fails to start (pdf.js or the
+  canvas library failing to load, whose error quotes install paths) each
+  return the server's own message, with the library's error kept as the
+  cause.
+- **Vault-relative error paths**: `describeErrorRelativeTo`
+  (`src/utils/describe-error.ts`) rewrites the paths in a Node error's
+  message (a filesystem failure or an invalid path argument) relative to
+  the vault root, for `safeHandler()` and the prompts' fallback messages.
+  Errors the server throws itself keep their text, since they can quote the
+  caller's input. The `tool_error`, `prompt_error` and
+  `pdf_page_render_failed` logs, and the logs of PDFs the search index or
+  file watcher cannot read, keep the full message
+  and the cause of a wrapped error (`describeErrorForLog`).
 - **In-lock existence checks**: `deleteNote` and `moveNote` check file
-  existence inside the lock, returning a vault-relative "not found"
-  instead of ENOENT (whose message leaks the absolute container path).
+  existence inside the lock, so a missing note returns the "note not found"
+  error the tools document instead of Node's ENOENT text.
 - **Graceful shutdown** (`server.ts`): SIGTERM handler drains in-flight
   requests with a 10-second force-exit fallback, so a write is never
   interrupted mid-rename.

SECURITY.md

@@ -181,8 +181,15 @@ mechanism-level detail.
 - `safeHandler()` catches all exceptions and returns the error's name and
   message, plus how to fix a properties-block refusal — no stack traces
   reach the client
-- In-lock existence checks return vault-relative "not found" instead of
-  ENOENT (whose message leaks the container's absolute path)
+- An image sharp cannot decode, a password-protected PDF, a damaged PDF,
+  and a PDF reader that fails to start each return the server's own
+  message; the library's error, which can quote the server's install paths,
+  stays in the server log
+- A Node error's paths (a filesystem failure or an invalid path argument)
+  reach the client vault-relative, from tools and from the prompts' fallback
+  messages alike, so the container's absolute path stays in the server log
+- In-lock existence checks return the documented "note not found" error
+  instead of Node's ENOENT text
 - Error middleware returns `"internal server error"` to clients;
   request metadata and the error message are logged server-side only